Browser öffnet Tabs selbstständig + Trojaner gefunden

Romy1309 · 09.10.2010, 17:42

Hallo zusammen,

habe seit einiger Zeit das Problem:

1. dass Firefox selbstständig Tabs öffnet. Hab dann NoScript als Adon installiert, damit werden die Seiten immerhin nicht gelanden. Aber da das nicht aufhört und noch andere Probleme dazukommen wollte ich euch fragen, was man dagegen machen kann.

2. Wenn ich Seiten öffnen möchte (manchmal sogar bei google.de) kommt eine Seite "alice suche" mit dem Text: Die von Ihnen eingegebene Internetadresse www.google.de konnte nicht gefunden werden. Wir haben für Sie folgende weiterführende Ergebnisse: (dann kommen andere links wie yahoo)

3. Ausserdem habe ich noch von Antivir und Malware die Meldung bekommen, dass irgendwelche Trojaner auf dem Rechner sind.

Habe schon gegoogelt und auch hier im Forum Beiträge gefunden, allerdings kann ich die Logfiles nicht auswerten und weiss auch nicht, ob ich das alles so machen soll, wie es den Leuten (die vor mir das Problem hier schilderten) empfohlen wurde.

Malewarebytes hab ich vor ein Paar Tagen schon mal durchlaufen lassen, mit dem selben Ergebnis. Habe den Eintrag (siehe unten) gelöscht. ABer heute tauchte der schon wieder auf.

LOGFILES folgen gleich..

DANKE FÜR EURE HILFE!!

Lg, Romy

Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Samstag, 9. Oktober 2010 17:58

Es wird nach 2914708 Virenstämmen gesucht.

Lizenznehmer : Avira AntiVir Personal - FREE Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows XP
Windowsversion : (Service Pack 3) [5.1.2600]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : ***

Versionsinformationen:
BUILD.DAT : 9.0.0.422 21701 Bytes 09.03.2010 10:23:00
AVSCAN.EXE : 9.0.3.10 466689 Bytes 20.11.2009 12:24:17
AVSCAN.DLL : 9.0.3.0 49409 Bytes 13.02.2009 11:04:10
LUKE.DLL : 9.0.3.2 209665 Bytes 20.02.2009 10:35:44
LUKERES.DLL : 9.0.2.0 13569 Bytes 26.01.2009 09:41:59
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 12:24:16
VBASE001.VDF : 7.10.1.0 1372672 Bytes 19.11.2009 12:24:16
VBASE002.VDF : 7.10.3.1 3143680 Bytes 20.01.2010 18:47:55
VBASE003.VDF : 7.10.3.75 996864 Bytes 26.01.2010 19:46:17
VBASE004.VDF : 7.10.4.203 1579008 Bytes 05.03.2010 19:01:15
VBASE005.VDF : 7.10.6.82 2494464 Bytes 15.04.2010 17:15:26
VBASE006.VDF : 7.10.7.218 2294784 Bytes 02.06.2010 12:38:07
VBASE007.VDF : 7.10.9.165 4840960 Bytes 23.07.2010 09:49:35
VBASE008.VDF : 7.10.11.133 3454464 Bytes 13.09.2010 14:50:08
VBASE009.VDF : 7.10.11.134 2048 Bytes 13.09.2010 14:50:08
VBASE010.VDF : 7.10.11.135 2048 Bytes 13.09.2010 14:50:09
VBASE011.VDF : 7.10.11.136 2048 Bytes 13.09.2010 14:50:09
VBASE012.VDF : 7.10.11.137 2048 Bytes 13.09.2010 14:50:09
VBASE013.VDF : 7.10.11.165 172032 Bytes 15.09.2010 22:40:58
VBASE014.VDF : 7.10.11.202 144384 Bytes 18.09.2010 14:32:42
VBASE015.VDF : 7.10.11.231 129024 Bytes 21.09.2010 18:25:04
VBASE016.VDF : 7.10.12.4 126464 Bytes 23.09.2010 09:11:39
VBASE017.VDF : 7.10.12.38 146944 Bytes 27.09.2010 15:07:38
VBASE018.VDF : 7.10.12.64 133120 Bytes 29.09.2010 00:05:36
VBASE019.VDF : 7.10.12.99 134144 Bytes 01.10.2010 02:09:07
VBASE020.VDF : 7.10.12.122 131584 Bytes 05.10.2010 15:34:16
VBASE021.VDF : 7.10.12.148 119296 Bytes 07.10.2010 15:34:32
VBASE022.VDF : 7.10.12.149 2048 Bytes 07.10.2010 15:34:32
VBASE023.VDF : 7.10.12.150 2048 Bytes 07.10.2010 15:34:32
VBASE024.VDF : 7.10.12.151 2048 Bytes 07.10.2010 15:34:32
VBASE025.VDF : 7.10.12.152 2048 Bytes 07.10.2010 15:34:32
VBASE026.VDF : 7.10.12.153 2048 Bytes 07.10.2010 15:34:32
VBASE027.VDF : 7.10.12.154 2048 Bytes 07.10.2010 15:34:32
VBASE028.VDF : 7.10.12.155 2048 Bytes 07.10.2010 15:34:32
VBASE029.VDF : 7.10.12.156 2048 Bytes 07.10.2010 15:34:32
VBASE030.VDF : 7.10.12.157 2048 Bytes 07.10.2010 15:34:32
VBASE031.VDF : 7.10.12.167 75776 Bytes 08.10.2010 17:45:09
Engineversion : 8.2.4.72
AEVDF.DLL : 8.1.2.1 106868 Bytes 30.07.2010 09:45:38
AESCRIPT.DLL : 8.1.3.45 1368443 Bytes 18.09.2010 09:41:00
AESCN.DLL : 8.1.6.1 127347 Bytes 14.05.2010 13:49:04
AESBX.DLL : 8.1.3.1 254324 Bytes 24.04.2010 09:14:26
AERDL.DLL : 8.1.9.2 635252 Bytes 21.09.2010 18:25:07
AEPACK.DLL : 8.2.3.7 471413 Bytes 18.09.2010 09:40:57
AEOFFICE.DLL : 8.1.1.8 201081 Bytes 23.07.2010 09:49:54
AEHEUR.DLL : 8.1.2.30 2941303 Bytes 02.10.2010 02:09:10
AEHELP.DLL : 8.1.13.4 242038 Bytes 25.09.2010 11:24:08
AEGEN.DLL : 8.1.3.23 401779 Bytes 02.10.2010 02:09:08
AEEMU.DLL : 8.1.2.0 393588 Bytes 24.04.2010 09:14:24
AECORE.DLL : 8.1.17.0 196982 Bytes 25.09.2010 11:24:08
AEBB.DLL : 8.1.1.0 53618 Bytes 24.04.2010 09:14:23
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12.12.2008 07:47:56
AVPREF.DLL : 9.0.3.0 44289 Bytes 08.09.2009 17:48:38
AVREP.DLL : 8.0.0.7 159784 Bytes 17.02.2010 18:21:43
AVREG.DLL : 9.0.0.0 36609 Bytes 07.11.2008 14:25:04
AVARKT.DLL : 9.0.0.3 292609 Bytes 24.03.2009 14:05:37
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30.01.2009 09:37:04
SQLITE3.DLL : 3.6.1.0 326401 Bytes 28.01.2009 14:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02.02.2009 07:21:28
NETNT.DLL : 9.0.0.0 11521 Bytes 07.11.2008 14:41:21
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 15.05.2009 14:35:17
RCTEXT.DLL : 9.0.73.0 87297 Bytes 20.11.2009 12:24:16

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: c:\programme\avira\antivir desktop\sysscan.avp
Protokollierung.......................: niedrig
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: mittel

Beginn des Suchlaufs: Samstag, 9. Oktober 2010 17:58

Der Suchlauf nach versteckten Objekten wird begonnen.
Es wurden '62787' Objekte überprüft, '0' versteckte Objekte wurden gefunden.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'jucheck.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'plugin-container.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'notepad.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ForceField.exe' - '0' Modul(e) wurden durchsucht
Durchsuche Prozess 'alg.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiapsrv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'iPodService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxsrvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxext.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WDSmartWareBackgroundService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WDDMService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'VESMgr.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wdfmgr.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SmartHDD.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RegSrvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'NMBgMonitor.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ctfmon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'DivXUpdate.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'zlclient.exe' - '0' Modul(e) wurden durchsucht
Durchsuche Prozess 'ezprint.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'MacDrive8Service.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WrtProc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'lxcicoms.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WrtMon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ApntEx.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'PIFSvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'PIFSvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'menusw.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SPMgr.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxsrvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ISBMgr.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'jqs.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxpers.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'hkcmd.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Apoint.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'FlipShareService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'EvtEng.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'MMERefresh.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'mDNSResponder.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'explorer.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ISWSVC.exe' - '0' Modul(e) wurden durchsucht
Durchsuche Prozess 'vsmon.exe' - '0' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'S24EvMon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '1' Modul(e) wurden durchsucht
Es wurden '63' Prozesse mit '63' Modulen durchsucht

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD1
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD2
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'D:\'
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '67' Dateien ).

Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <VAIO>
C:\hiberfil.sys
[WARNUNG] Die Datei konnte nicht geöffnet werden!
[HINWEIS] Bei dieser Datei handelt es sich um eine Windows Systemdatei.
[HINWEIS] Es ist in Ordnung, dass diese Datei für die Suche nicht geöffnet werden kann.
C:\pagefile.sys
[WARNUNG] Die Datei konnte nicht geöffnet werden!
[HINWEIS] Bei dieser Datei handelt es sich um eine Windows Systemdatei.
[HINWEIS] Es ist in Ordnung, dass diese Datei für die Suche nicht geöffnet werden kann.
C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\13\4a8f75cd-243fce5c
[0] Archivtyp: ZIP
--> bpac/a.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Agent.HN
C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\3\5f003843-4ecefd94
[0] Archivtyp: ZIP
--> bpac/a.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Agent.HN

Beginne mit der Desinfektion:
C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\13\4a8f75cd-243fce5c
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4ce892d5.qua' verschoben!
C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\3\5f003843-4ecefd94
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4ce092da.qua' verschoben!

Ende des Suchlaufs: Samstag, 9. Oktober 2010 18:04
Benötigte Zeit: 05:38 Minute(n)

Der Suchlauf wurde abgebrochen!

1222 Verzeichnisse wurden überprüft
5520 Dateien wurden geprüft
2 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
2 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
2 Dateien konnten nicht durchsucht werden
5516 Dateien ohne Befall
32 Archive wurden durchsucht
2 Warnungen
4 Hinweise
62787 Objekte wurden beim Rootkitscan durchsucht
0 Versteckte Objekte wurden gefunden

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4770

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

09.10.2010 17:39:21
mbam-log-2010-10-09 (17-39-21).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 223218
Laufzeit: 1 Stunde(n), 7 Minute(n), 39 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\fheydbueyj.exe\fheydbueyj.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.OTL EXTRAS Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 09.10.2010 18:18:31 - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Dokumente und Einstellungen\Username\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 71,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 55,88 Gb Total Space | 14,13 Gb Free Space | 25,29% Space Free | Partition Type: NTFS
Drive D: | 47,98 Gb Total Space | 18,89 Gb Free Space | 39,36% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Unable to calculate disk information.
I: Drive not present or media not loaded
 
Computer Name: COMPUTERNAME
Current User Name: Username
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\iTunes\iTunes.exe" = C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\WINDOWS\system32\lxcicoms.exe" = C:\WINDOWS\system32\lxcicoms.exe:*:Enabled:7300 Series Server -- ( )
"C:\Programme\wLite\wLite.exe" = C:\Programme\wLite\wLite.exe:*:Enabled:webcamXP -- File not found
"C:\Programme\wLite\wService.exe" = C:\Programme\wLite\wService.exe:*:Enabled:webcamXP Service -- File not found
"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
"C:\WINDOWS\system32\ZoneLabs\vsmon.exe" = C:\WINDOWS\system32\ZoneLabs\vsmon.exe:*:Enabled:vsmon -- (Check Point Software Technologies LTD)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{04830D0F-F980-4EC0-89F1-594F2FD2A1B5}" = ElsterFormular 2008/2009
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{075473F5-846A-448B-BCB3-104AA1760205}" = Roxio DigitalMedia Data
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{0E6B352F-F91D-43E6-8BB6-B772C32E83A9}" = Avid Media Composer
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{232DB76D-4751-41A9-9EC2-CDC0DAC1FAB6}" = WD SmartWare
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{25613C10-27D2-410B-942B-D922D5C3A7BE}" = Interlok driver setup x32
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{27337663-2619-11D4-99DC-0000F49094C7}" = Memory Stick Formatter
"{2A2FF7F5-6F0E-4A5D-A881-39365E718BD6}" = VAIO Cozy Orange Wallpaper
"{2DFB5485-A3EF-4298-9280-4AF80C9F4BE9}" = Microsoft SQL Server VSS Writer
"{2F227ACA-204C-4529-BA33-D095C42C72DB}" = Avid Audio Drivers (x86)
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{4781569D-5404-1F26-4B2B-6DF444441031}" = Nero 7 Ultra Edition
"{48820099-ED7D-424B-890C-9A82EF00656D}" = VAIO Update 3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AB60DF3-DB89-928C-023E-4001C28A49BF}" = FlipShare
"{4C8EB03D-32BA-11D4-BE13-006094EB4405}" = Pinnacle DV25 Codec
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{547DCEC7-DD2A-47E9-82C7-5CF1EAB526DA}" = Microsoft SQL Server Native Client
"{59452470-A902-477F-9338-9B88101681BD}" = Setting Utility Series
"{5958CAC6-373E-402F-84FE-0A699AA920B9}" = LAN Setting Utility
"{5A180ED5-0AC1-410A-B790-5E0319CD0A93}" = Sentinel Protection Installer 7.4.0
"{5BF2B19D-9C79-492A-8969-F059F06A627F}" = Print to Fax
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{72CD4C5F-AB0B-4814-8780-9A4F26A2086B}" = Presto! PageManager 7.12.10
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7CDC26F7-D6BF-442A-B599-0075A48310F7}" = SA32xx Device Manager
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8C8224B7-AA9B-4807-97CD-55899BAC83FE}" = YouSendIt Express
"{8C938F54-A994-4BBF-A06F-6AD5581A0012}" = SmartAP
"{8DF4C627-4AF3-4245-9F13-3518FC8584DC}" = Protector Suite QL 5.3
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD for VAIO
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97BCD719-6ECB-458F-97D6-F38D2E07375E}" = VAIO Aqua Breeze Wallpaper
"{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}" = iTunes
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9E319E96-ED8E-4B01-9775-C521A1869A25}" = VAIO Power Management
"{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
 
Error - 09.10.2010 09:30:43 | Computer Name = COMPUTERNAME | Source = Service Control Manager | ID = 7034
Description = Dienst "MacDrive 8 service" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
 
Error - 09.10.2010 09:31:06 | Computer Name = COMPUTERNAME | Source = Service Control Manager | ID = 7034
Description = Dienst "LiveUpdate Notice Service" wurde unerwartet beendet. Dies 
ist bereits 1 Mal passiert.
 
Error - 09.10.2010 09:31:33 | Computer Name = COMPUTERNAME | Source = Service Control Manager | ID = 7034
Description = Dienst "WD SmartWare Background Service" wurde unerwartet beendet.
Dies ist bereits 1 Mal passiert.
 
Error - 09.10.2010 11:46:51 | Computer Name = COMPUTERNAME | Source = sr | ID = 1
Description = Beim Verarbeiten der Datei "" auf Volume "HarddiskVolume2" ist im 
Wiederherstellungsfilter der unerwartete Fehler "0xC0000001" aufgetreten. Die Volumeüberwachung
wurde angehalten.
 
Error - 09.10.2010 11:46:51 | Computer Name = COMPUTERNAME | Source = Ftdisk | ID = 262189
Description = Das System konnte den Treiber für das Speicherabbild nicht laden.
 
Error - 09.10.2010 11:46:51 | Computer Name = COMPUTERNAME | Source = Ftdisk | ID = 262193
Description = Die Konfiguration der Auslagerungsdatei für das Speicherabbild ist
fehlgeschlagen. Stellen Sie sicher, dass eine Auslagerungsdatei auf der Startpartition
vorhanden ist und dass diese groß genug ist, um den gesamten physikalischen Speicher
abbilden zu können.
 
Error - 09.10.2010 11:47:34 | Computer Name = COMPUTERNAME | Source = Service Control Manager | ID = 7000
Description = Der Dienst "TrackerCam Video Capture Driver" wurde aufgrund folgenden
Fehlers nicht gestartet: %%1058
 
 
< End of report >

--- --- ---

OTL Logfile:
OTL EXTRAS Logfile:

Code:

ATTFilter

OTL logfile created on: 09.10.2010 18:18:30 - Run 1
OTL by OldTimer - Version 3.2.14.1     Folder = C:\Dokumente und Einstellungen\Username\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 71,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 55,88 Gb Total Space | 14,13 Gb Free Space | 25,29% Space Free | Partition Type: NTFS
Drive D: | 47,98 Gb Total Space | 18,89 Gb Free Space | 39,36% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Unable to calculate disk information.
I: Drive not present or media not loaded
 
Computer Name: COMPUTER
Current User Name: Username
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\Username\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
PRC - C:\Programme\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)
PRC - C:\Programme\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
PRC - C:\Programme\Digidesign\Drivers\MMERefresh.exe (Avid Technology, Inc.)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\Mediafour\MacDrive 8\MacDrive8Service.exe (Mediafour Corporation)
PRC - C:\Programme\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe (WDC)
PRC - C:\Programme\Flip Video\FlipShare\FlipShareService.exe ()
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe (Memeo)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
PRC - C:\Programme\Sony\VAIO Power Management\SPMgr.exe (Sony Corporation)
PRC - C:\Programme\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
PRC - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\igfxext.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\lxcicoms.exe ( )
PRC - C:\Programme\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe ()
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe ()
PRC - C:\Programme\Protector Suite QL\menusw.exe (UPEK Inc.)
PRC - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe (Nero AG)
PRC - C:\Programme\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
PRC - C:\Programme\Microsoft Office\Office\OUTLOOK.EXE (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\Username\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (Check Point Software Technologies)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcp80.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (LiveUpdate Notice Ex) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe File not found
SRV - (vsmon) -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SRV - (IswSvc) -- C:\Programme\CheckPoint\ZAForceField\IswSvc.exe (Check Point Software Technologies)
SRV - (DigiRefresh) -- C:\Programme\Digidesign\Drivers\MMERefresh.exe (Avid Technology, Inc.)
SRV - (MacDrive8Service) -- C:\Programme\Mediafour\MacDrive 8\MacDrive8Service.exe (Mediafour Corporation)
SRV - (WDDMService) -- C:\Programme\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe (WDC)
SRV - (FlipShare Service) -- C:\Programme\Flip Video\FlipShare\FlipShareService.exe ()
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (WDSmartWareBackgroundService) -- C:\Programme\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe (Memeo)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (LiveUpdate Notice Service) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
SRV - (EvtEng) Intel(R) -- C:\Programme\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (S24EventMonitor) Intel(R) -- C:\Programme\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
SRV - (RegSrvc) Intel(R) -- C:\Programme\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (lxci_device) -- C:\WINDOWS\System32\lxcicoms.exe ( )
SRV - (VAIO Event Service) -- C:\Programme\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
SRV - (SQLWriter) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (SPLITCAM) -- C:\WINDOWS\System32\DRIVERS\splitcam.sys File not found
DRV - (InCDRm) -- C:\WINDOWS\System32\drivers\InCDRm.sys File not found
DRV - (InCDPass) -- C:\WINDOWS\System32\drivers\InCDPass.sys File not found
DRV - (InCDFs) -- C:\WINDOWS\System32\drivers\InCDFs.sys File not found
DRV - (ISWKL) -- C:\Programme\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies)
DRV - (vsdatant) -- C:\WINDOWS\system32\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (MDFSYSNT) -- C:\WINDOWS\System32\drivers\MDFSYSNT.SYS (Mediafour Corporation)
DRV - (MDPMGRNT) -- C:\WINDOWS\System32\drivers\MDPMGRNT.SYS (Mediafour Corporation)
DRV - (CBDisk) -- C:\WINDOWS\system32\drivers\CBDisk.sys (EldoS Corporation)
DRV - (TPkd) -- C:\WINDOWS\System32\drivers\TPkd.sys (PACE Anti-Piracy, Inc.)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (Serial) -- C:\WINDOWS\system32\drivers\AvidXPSerial.sys ()
DRV - (trackcam) -- C:\WINDOWS\system32\drivers\trackcam.sys (Eagletron Inc.)
DRV - (Aspi32) -- C:\WINDOWS\System32\drivers\aspi32.sys (Adaptec)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (WDC_SAM) -- C:\WINDOWS\system32\drivers\wdcsam.sys (Western Digital Technologies)
DRV - (61883) -- C:\WINDOWS\system32\drivers\61883.sys (Microsoft Corporation)
DRV - (Avc) -- C:\WINDOWS\system32\drivers\avc.sys (Microsoft Corporation)
DRV - (MSDV) -- C:\WINDOWS\system32\drivers\msdv.sys (Microsoft Corporation)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (s24trans) -- C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (NETw4x32) Intel(R) -- C:\WINDOWS\system32\drivers\NETw4x32.sys (Intel Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Sentinel) -- C:\WINDOWS\System32\Drivers\SENTINEL.SYS (SafeNet, Inc.)
DRV - (SonyImgF) -- C:\WINDOWS\system32\drivers\SonyImgF.sys (Sony Corporation)
DRV - (ialm) -- C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation)
DRV - (shpf) -- C:\WINDOWS\system32\DRIVERS\shpf.sys (Sony Corporation)
DRV - (ti21sony) -- C:\WINDOWS\system32\drivers\ti21sony.sys (Texas Instruments)
DRV - (HSF_DPV) -- C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSFHWAZL) -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (IFXTPM) -- C:\WINDOWS\system32\drivers\ifxtpm.sys (Infineon Technologies AG)
DRV - (ApfiltrService) -- C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (Ser2pl) -- C:\WINDOWS\system32\drivers\ser2pl.sys (Prolific Technology Inc.)
DRV - (yukonwxp) -- C:\WINDOWS\system32\drivers\yk51x86.sys (Marvell)
DRV - (SNC) -- C:\WINDOWS\system32\drivers\SonyNC.sys (Sony Corporation)
DRV - (AnyDVD) -- C:\WINDOWS\system32\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV - (FdRedir) -- C:\Programme\Gemeinsame Dateien\Protector Suite QL\Drivers\FdRedir.sys (UPEK Inc.)
DRV - (FileDisk2) -- C:\Programme\Gemeinsame Dateien\Protector Suite QL\Drivers\filedisk.sys (UPEK Inc.)
DRV - (TcUsb) -- C:\WINDOWS\system32\drivers\tcusb.sys (UPEK Inc.)
DRV - (ElbyCDIO) -- C:\WINDOWS\system32\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV - (ElbyDelay) -- C:\WINDOWS\system32\drivers\ElbyDelay.sys (Elaborate Bytes AG)
DRV - (OVT511Plus) -- C:\WINDOWS\system32\drivers\omcamvid.sys (OmniVision Technologies, Inc.)
DRV - (DMICall) -- C:\WINDOWS\system32\drivers\DMICall.sys (Sony Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Alice - Willkommen
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Google Toolbar
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Alice - Willkommen
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = Google Toolbar
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = Google Toolbar
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "google.de"
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {FFB96CC1-7EB3-449D-B827-DB661701C6BB}:1.5.232.0
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0.3.3
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2
FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Programme\CheckPoint\ZAForceField\TrustChecker [2010.09.02 15:55:38 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.09.17 12:48:54 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.09.17 12:48:54 | 000,000,000 | ---D | M]
 
[2009.07.29 22:17:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Username\Anwendungsdaten\Mozilla\Extensions
[2010.10.08 19:54:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Username\Anwendungsdaten\Mozilla\Firefox\Profiles\bhp1qgcy.default\extensions
[2010.05.24 16:13:42 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Username\Anwendungsdaten\Mozilla\Firefox\Profiles\bhp1qgcy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.10.05 20:11:53 | 000,000,000 | ---D | M] (NoScript) -- C:\Dokumente und Einstellungen\Username\Anwendungsdaten\Mozilla\Firefox\Profiles\bhp1qgcy.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010.05.28 18:49:17 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Username\Anwendungsdaten\Mozilla\Firefox\Profiles\bhp1qgcy.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.09.20 18:43:18 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\Username\Anwendungsdaten\Mozilla\Firefox\Profiles\bhp1qgcy.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009.12.02 19:26:35 | 000,002,235 | ---- | M] () -- C:\Dokumente und Einstellungen\Username\Anwendungsdaten\Mozilla\Firefox\Profiles\bhp1qgcy.default\searchplugins\askcom.xml
[2010.10.08 19:54:20 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.06.16 12:48:39 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.06.16 12:48:20 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.09.14 11:27:05 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.09.14 11:27:05 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.09.14 11:27:05 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.09.14 11:27:05 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.09.14 11:27:05 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2004.08.04 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Programme\Google BAE\BAE.dll (Your Company Name)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AzMixerSel] C:\Programme\Realtek\InstallShield\AzMixerSel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Biomenu] C:\Programme\Protector Suite QL\menusw.exe (UPEK Inc.)
O4 - HKLM..\Run: [DigidesignMMERefresh] C:\Programme\Digidesign\Drivers\MMERefresh.exe (Avid Technology, Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [EzPrint] C:\Programme\Lexmark 7300 Series\ezprint.exe (Lexmark International Inc.)
O4 - HKLM..\Run: [ISBMgr.exe] C:\Programme\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [ISW] C:\Programme\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [LXCICATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCItime.DLL (Lexmark International Inc.)
O4 - HKLM..\Run: [lxcimon.exe] C:\Programme\Lexmark 7300 Series\lxcimon.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NWEReboot]  File not found
O4 - HKLM..\Run: [SonyPowerCfg] C:\Programme\Sony\VAIO Power Management\SPMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - HKLM..\Run: [VAIO Update 3] C:\Programme\Sony\VAIO Update 3\VAIOUpdt.exe (Sony Corporation)
O4 - HKLM..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [fheydbueyj.exe] C:\fheydbueyj.exe\fheydbueyj.exe File not found
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Launcher.lnk = C:\WINDOWS\Installer\{8C938F54-A994-4BBF-A06F-6AD5581A0012}\_1BBA5E134AA9BA6534F3F8.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Free YouTube Download - C:\Dokumente und Einstellungen\Username\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\psfus: DllName - fusstub.dll - C:\WINDOWS\System32\fusstub.dll (UPEK Inc.)
O20 - Winlogon\Notify\VESWinlogon: DllName - VESWinlogon.dll - C:\WINDOWS\System32\VESWinlogon.dll (Sony Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Username\Desktop\egal_da.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Username\Desktop\egal_da.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.07.11 10:58:52 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{477dc104-cee8-11df-a609-001cbf5abbb5}\Shell\AutoRun\command - "" = .\Encryption Tool\MaxtorEncryption.exe
O33 - MountPoints2\{581db204-4413-11df-ac9f-001cbf5abbb5}\Shell - "" = AutoRun
O33 - MountPoints2\{581db204-4413-11df-ac9f-001cbf5abbb5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5cf35164-8111-11df-86c6-001cbf5abbb5}\Shell\AutoRun\command - "" = G:\Setup_FlipShare.exe -- File not found
O33 - MountPoints2\{5cf35164-8111-11df-86c6-001cbf5abbb5}\Shell\Setup FlipShare\command - "" = G:\Setup_FlipShare.exe -- File not found
O33 - MountPoints2\{75253627-0aa6-11df-b03a-001cbf5abbb5}\Shell\AutoRun\command - "" = .\Encryption Tool\MaxtorEncryption.exe
O33 - MountPoints2\{85f5f608-ac18-11de-a17e-001cbf5abbb5}\Shell\AutoRun\command - "" = .\Encryption Tool\MaxtorEncryption.exe
O33 - MountPoints2\{85f5f8a8-ac18-11de-a17e-001cbf5abbb5}\Shell\AutoRun\command - "" = .\Encryption Tool\MaxtorEncryption.exe
O33 - MountPoints2\{c74198d3-9f3c-11df-8cce-001cbf5abbb5}\Shell\AutoRun\command - "" = F:\setup.exe -- File not found
O33 - MountPoints2\{e7a9cb43-fb7b-11de-86e7-001cbf5abbb5}\Shell\AutoRun\command - "" = .\Encryption Tool\MaxtorEncryption.exe
O33 - MountPoints2\Z\Shell - "" = AutoRun
O33 - MountPoints2\Z\Shell\AutoRun - "" = Auto&Play
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.10.09 18:12:04 | 000,576,512 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Username\Desktop\OTL.exe
[2010.10.09 18:05:41 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010.10.09 18:05:18 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Username\Recent
[2010.10.09 14:44:00 | 000,000,000 | R-SD | C] -- C:\Dokumente und Einstellungen\Username\Eigene Dateien\Safe
[2010.10.07 16:01:51 | 000,000,000 | ---D | C] -- C:\DBControl
[2010.10.07 16:01:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\DBControl
[2010.10.07 16:01:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\DBControl
[2010.10.07 16:01:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Username\Lokale Einstellungen\Anwendungsdaten\DBControl
[2010.09.25 21:51:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Username\Desktop\stiftung
[2010.09.23 16:38:17 | 000,000,000 | ---D | C] -- C:\Program Files
[2010.09.20 12:27:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Username\Desktop\TRANSKRIBT EGAL
[2010.09.16 16:30:02 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\cock
[2010.09.16 15:50:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Username\Anwendungsdaten\elsterformular
[2010.09.16 15:46:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular
[2010.09.16 15:36:46 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010.09.15 12:57:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Google
[2010.07.25 20:24:54 | 000,413,696 | ---- | C] ( ) -- C:\WINDOWS\System32\lxciinpa.dll
[2010.07.25 20:24:54 | 000,323,584 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcihcp.dll
[2010.07.25 20:24:53 | 000,991,232 | ---- | C] ( ) -- C:\WINDOWS\System32\lxciusb1.dll
[2010.07.25 20:24:53 | 000,397,312 | ---- | C] ( ) -- C:\WINDOWS\System32\lxciiesc.dll
[2010.07.25 20:24:52 | 001,224,704 | ---- | C] ( ) -- C:\WINDOWS\System32\lxciserv.dll
[2010.07.25 20:24:51 | 000,163,840 | ---- | C] ( ) -- C:\WINDOWS\System32\lxciprox.dll
[2010.07.25 20:24:51 | 000,094,208 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcipplc.dll
[2010.07.25 20:24:50 | 000,643,072 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcipmui.dll
[2010.07.25 20:24:50 | 000,585,728 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcilmpm.dll
[2010.07.25 20:24:47 | 000,696,320 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcihbn3.dll
[2010.07.25 20:24:44 | 000,684,032 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcicomc.dll
[2010.07.25 20:24:44 | 000,421,888 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcicomm.dll
[6 C:\Dokumente und Einstellungen\Username\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\Username\Desktop\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\*.tmp files -> C:\*.tmp -> ]
[15 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.10.09 18:12:05 | 000,576,512 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Username\Desktop\OTL.exe
[2010.10.09 18:05:42 | 000,041,084 | ---- | M] () -- C:\Dokumente und Einstellungen\Username\Lokale Einstellungen\Anwendungsdaten\HDDs
[2010.10.09 18:05:32 | 008,126,464 | ---- | M] () -- C:\Dokumente und Einstellungen\Username\ntuser.dat
[2010.10.09 17:47:15 | 000,002,439 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Launcher.lnk
[2010.10.09 17:46:32 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.10.09 17:46:31 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.10.09 17:46:24 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.10.09 17:46:21 | 2137,313,280 | -HS- | M] () -- C:\hiberfil.sys
[2010.10.09 17:36:59 | 000,054,985 | ---- | M] () -- C:\Dokumente und Einstellungen\Username\Desktop\thesen95_thomas_imbach.pdf
[2010.10.09 16:58:10 | 001,275,144 | ---- | M] () -- C:\Dokumente und Einstellungen\Username\Desktop\julekruzbäum.pdf
[2010.10.09 16:57:40 | 001,263,591 | ---- | M] () -- C:\Dokumente und Einstellungen\Username\Desktop\silvana_Username_berlinale.pdf
[2010.10.09 16:44:00 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.10.09 03:34:09 | 000,000,300 | -HS- | M] () -- C:\Dokumente und Einstellungen\Username\ntuser.ini
[2010.10.07 16:13:26 | 009,382,130 | ---- | M] () -- C:\Dokumente und Einstellungen\Username\Desktop\Master_GiS-30_mitTempMusik.mov
[2010.10.07 14:11:26 | 016,333,698 | ---- | M] () -- C:\Dokumente und Einstellungen\Username\Desktop\Master_GiS-45_mitTempMusik.mov
[2010.10.06 17:30:11 | 036,872,160 | ---- | M] () -- C:\Dokumente und Einstellungen\Username\Desktop\interview phillipp - 2 Dateien.zip
[2010.10.04 02:06:15 | 000,002,433 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avid Media Composer.lnk
[2010.10.03 13:27:28 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.09.27 12:57:20 | 003,762,050 | ---- | M] () -- C:\Dokumente und Einstellungen\Username\Desktop\Radio _DasDing_ Interview mit Semy Slimani am 01.07.2010.mp3
[2010.09.27 12:44:21 | 002,680,704 | ---- | M] () -- C:\Dokumente und Einstellungen\Username\Desktop\20100624_074000_Youtube.mp3
[2010.09.27 12:33:58 | 002,973,696 | ---- | M] () -- C:\Dokumente und Einstellungen\Username\Desktop\20100624_075500_Youtube.mp3
[2010.09.25 23:58:27 | 000,019,456 | ---- | M] () -- C:\Dokumente und Einstellungen\Username\Desktop\PASCAL.doc
[2010.09.25 22:05:49 | 000,019,968 | ---- | M] () -- C:\Dokumente und Einstellungen\Username\Desktop\KOPFKINO_Doktage.doc
[2010.09.24 20:56:03 | 000,000,916 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.09.24 20:56:02 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010.09.23 16:38:20 | 000,000,684 | ---- | M] () -- C:\Dokumente und Einstellungen\Username\Desktop\SequoiaView.lnk
[6 C:\Dokumente und Einstellungen\Username\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\Username\Desktop\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\*.tmp files -> C:\*.tmp -> ]
[15 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.10.09 17:36:59 | 000,054,985 | ---- | C] () -- C:\Dokumente und Einstellungen\Username\Desktop\thesen95_thomas_imbach.pdf
[2010.10.09 16:58:10 | 001,275,144 | ---- | C] () -- C:\Dokumente und Einstellungen\Username\Desktop\julekruzbäum.pdf
[2010.10.09 16:57:40 | 001,263,591 | ---- | C] () -- C:\Dokumente und Einstellungen\Username\Desktop\silvana_Username_berlinale.pdf
[2010.10.07 16:13:10 | 009,382,130 | ---- | C] () -- C:\Dokumente und Einstellungen\Username\Desktop\Master_GiS-30_mitTempMusik.mov
[2010.10.07 16:01:50 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\googleupdate.log
[2010.10.07 16:01:50 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\googleupdate.log
[2010.10.07 16:01:41 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Username\Lokale Einstellungen\Anwendungsdaten\googleupdate.log
[2010.10.07 14:10:31 | 016,333,698 | ---- | C] () -- C:\Dokumente und Einstellungen\Username\Desktop\Master_GiS-45_mitTempMusik.mov
[2010.10.06 17:28:11 | 036,872,160 | ---- | C] () -- C:\Dokumente und Einstellungen\Username\Desktop\interview phillipp - 2 Dateien.zip
[2010.09.27 12:46:37 | 003,762,050 | ---- | C] () -- C:\Dokumente und Einstellungen\Username\Desktop\Radio _DasDing_ Interview mit Semy Slimani am 01.07.2010.mp3
[2010.09.27 12:33:58 | 002,973,696 | ---- | C] () -- C:\Dokumente und Einstellungen\Username\Desktop\20100624_075500_Youtube.mp3
[2010.09.27 12:33:51 | 002,680,704 | ---- | C] () -- C:\Dokumente und Einstellungen\Username\Desktop\20100624_074000_Youtube.mp3
[2010.09.25 23:58:27 | 000,019,456 | ---- | C] () -- C:\Dokumente und Einstellungen\Username\Desktop\PASCAL.doc
[2010.09.25 21:45:41 | 000,019,968 | ---- | C] () -- C:\Dokumente und Einstellungen\Username\Desktop\KOPFKINO_Doktage.doc
[2010.09.23 16:38:20 | 000,000,684 | ---- | C] () -- C:\Dokumente und Einstellungen\Username\Desktop\SequoiaView.lnk
[2010.07.25 20:26:34 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxcivs.dll
[2010.07.25 20:26:28 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\lxcicoin.dll
[2010.07.25 20:25:53 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\lxcicnv4.dll
[2010.07.25 20:24:55 | 000,274,432 | ---- | C] () -- C:\WINDOWS\System32\lxciinst.dll
[2010.06.17 16:01:06 | 000,000,416 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2010.06.16 16:43:25 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2010.06.09 12:00:58 | 000,041,084 | ---- | C] () -- C:\Dokumente und Einstellungen\Username\Lokale Einstellungen\Anwendungsdaten\HDDs
[2010.05.29 22:40:35 | 000,017,408 | ---- | C] () -- C:\Dokumente und Einstellungen\Username\Lokale Einstellungen\Anwendungsdaten\WebpageIcons.db
[2009.10.20 15:47:18 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\drivers\AvidXPSerial.sys
[2009.10.05 15:09:42 | 001,658,973 | ---- | C] () -- C:\WINDOWS\System32\libmmd.dll
[2009.10.05 15:09:42 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\PtSSE2.dll
[2009.10.05 15:09:42 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\Cpuinf32.dll
[2009.08.25 20:45:11 | 000,028,672 | ---- | C] () -- C:\WINDOWS\hookdllX.dll
[2009.08.25 20:44:55 | 000,011,776 | ---- | C] () -- C:\WINDOWS\System32\pmsbfn32.dll
[2009.08.15 23:29:33 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009.08.15 23:29:33 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009.07.29 23:04:49 | 000,235,520 | ---- | C] () -- C:\Dokumente und Einstellungen\Username\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.07.29 22:53:53 | 000,000,403 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009.07.29 22:31:05 | 016,378,478 | ---- | C] () -- C:\Dokumente und Einstellungen\Username\Anwendungsdaten\MediaComposer_Install.log
[2009.07.29 21:27:16 | 000,000,146 | ---- | C] () -- C:\Dokumente und Einstellungen\Username\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2008.02.19 08:33:34 | 000,446,352 | ---- | C] () -- C:\WINDOWS\System32\OpenQuicktimeLib.dll
[2007.07.12 15:56:35 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2007.07.12 10:38:48 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2007.07.12 10:38:48 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2007.07.12 10:38:48 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2007.07.12 10:38:48 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2007.07.12 10:38:48 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2007.07.12 10:38:48 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2007.07.12 10:01:28 | 000,000,000 | ---- | C] () -- C:\WINDOWS\VAIOUpdt.INI
[2007.07.11 11:21:25 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2007.07.11 03:46:02 | 000,701,840 | ---- | C] () -- C:\WINDOWS\System32\igmedkrn.dll
[2007.07.11 03:46:02 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4785.dll
[2007.07.11 03:45:56 | 000,004,870 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2007.07.11 03:45:29 | 000,056,880 | ---- | C] () -- C:\WINDOWS\System32\scvideo.dll
[2007.01.12 05:37:22 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2004.07.29 01:19:46 | 000,175,104 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2001.09.18 12:00:00 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\bmpproc.dll
[1999.01.22 20:46:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 1271 bytes -> C:\Programme\Gemeinsame Dateien\System:segK7s7ZIJfrd565BRvUT
@Alternate Data Stream - 1175 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft:mKK8MUEyJshT45TXlTP791eP
@Alternate Data Stream - 1070 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft:X9YmwfIIDHEgjek5oqZgILTMYu
@Alternate Data Stream - 1042 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft:D5IlmsqOfwCPIA6pCMfod
< End of report >

--- --- ---

--- --- ---

Romy1309 · 09.10.2010, 18:05

Aja.. vor ein paar Tagen hat Antivir folgenden Trojaner gefunden. Vielleicht hat der was damit zu tun?

C:\System Volume Information\_restore{E83456EE-AF4A-4644-A761-9BF6F8E0B63E}\RP269\A0196876.exe
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2
C:\WINDOWS\Temp\Acr8BE9.tmp
[FUND] Enthält Erkennungsmuster des HTML-Scriptvirus HTML/Malicious.PDF.Gen

Chris4You · 09.10.2010, 20:13

Hi,

ich nehme an, das Verzeichnis kennst Du nicht:
"[2010.09.16 16:30:02 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\cock"

Probieren wir mal was...
Scan mit SystemLook

Lade SystemLook von einem der folgenden Links und speichere das Tool auf dem Desktop.
http://jpshortstuff.247fixes.com/SystemLook.exe - http://images.malwareremoval.com/jps...SystemLook.exe

Doppelklick auf die SystemLook.exe, um das Tool zu starten.

Vista-User mit Rechtsklick und als Administrator starten.

Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:

Code:

ATTFilter

:dir
C:\WINDOWS\System32\cock /s

Klicke nun auf den Button Look, um den Scan zu starten.

Wenn der Suchlauf beendet ist, wird sich Dein Editor mit den Ergebnissen öffnen, diese hier in den Thread posten.
Die Ergebnisse werden auf dem Desktop als SystemLook.txt gespeichert.

Bitte folgende Files prüfen:

Dateien Online überprüfen lassen:

Als erstes versteckte Dateien anzeigen lassen!
(nur Punkt 1 durchführen!)

Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“
und suche folgende Datei/Dateien:

Code:

ATTFilter

C:\WINDOWS\System32\fusstub.dll
C:\WINDOWS\System32\lxcicomm.dll
C:\WINDOWS\System32\lxcivs.dll

Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)

Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.

Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

Viel Arbeit und Zeit für Dich... aber bevor ich rabiat werde will ich erst mal sehen ob wir was "rauskitzeln" können...

OTL:

Doppelklick auf die OTL.exe, um das Programm auszuführen.

Vista/Win7-User bitte per Rechtsklick und "Ausführen als Administrator" starten.

Kopiere den Inhalt der folgenden Codebox komplett in die OTL-Box unter "Custom Scan/Fixes"

Code:

ATTFilter

:OTL
DRV - (SPLITCAM) -- C:\WINDOWS\System32\DRIVERS\splitcam.sys File not found
DRV - (InCDRm) -- C:\WINDOWS\System32\drivers\InCDRm.sys File not found
DRV - (InCDPass) -- C:\WINDOWS\System32\drivers\InCDPass.sys File not found
DRV - (InCDFs) -- C:\WINDOWS\System32\drivers\InCDFs.sys File not found
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
O4 - HKLM..\Run: [NWEReboot]  File not found
O4 - HKCU..\Run: [fheydbueyj.exe] C:\fheydbueyj.exe\fheydbueyj.exe File not found
@Alternate Data Stream - 1271 bytes -> C:\Programme\Gemeinsame Dateien\System:segK7s7ZIJfrd565BRvUT
@Alternate Data Stream - 1175 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft:mKK8MUEyJshT45TXlTP791eP
@Alternate Data Stream - 1070 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft:X9YmwfIIDHEgjek5oqZgILTMYu
@Alternate Data Stream - 1042 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft:D5IlmsqOfwCPIA6pCMfod

:REG
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = dword:0x00
"AntiVirusOverride" = dword:0x00
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = dword:0x00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = dword:0x00
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = dword:0x00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = dword:0x00

:Commands
[purity]
[emptytemp]
[CREATERESTOREPOINT]
[EMPTYFLASH]
[Reboot]

Den roten Run Fixes! Button anklicken.

Bitte alles aus dem Ergebnisfenster (Results) herauskopieren.

Eine Kopie eines OTL-Fix-Logs wird in einer Textdatei in folgendem Ordner gespeichert:

%systemroot%\_OTL

Gmer:
http://www.trojaner-board.de/74908-a...t-scanner.html
Den Downloadlink findest Du links oben (GMER - Rootkit Detector and Remover), dort dann
auf den Button "Download EXE", dabei wird ein zufälliger Name generiert (den und den Pfad wo Du sie gespeichert hast bitte merken).
Starte GMER und schaue, ob es schon was meldet. Macht es das, bitte alle Fragen mit "nein" beantworten, auf den Reiter "rootkit" gehen, wiederum die Frage mit "nein" beantworten und mit Hilfe von copy den Bericht in den Thread einfügen. Meldet es so nichts, gehe auf den Reiter Rootkit und mache einen Scan. Ist dieser beendet, wähle Copy und füge den Bericht ein.

TDSS-Killer
Download und Anweisung unter: Wie werden Schadprogramme der Familie Rootkit.Win32.TDSS bekämpft?
Entpacke alle Dateien in einem eigenen Verzeichnis (z. B: C:\TDSS)!
Aufruf über den Explorer duch Doppelklick auf die TDSSKiller.exe.
Nach dem Start erscheint ein Fenster, dort dann "Start Scan".
Wenn der Scan fertig ist bitte "Report" anwählen. Es öffnet sich ein Fenster, den Text abkopieren und hier posten...

Eine Umleitung über die Ukraine per DNS-Changer liegt momentan nicht vor, aber wahrscheinlich ein Rootkit...

chris

Romy1309 · 09.10.2010, 20:18

Tausend Dank, dass du mir hilfst!!!!

1.

SystemLook 04.09.10 by jpshortstuff
Log created at 21:17 on 09/10/2010 by Rommel
Administrator - Elevation successful

========== dir ==========

C:\WINDOWS\System32\cock - Parameters: "/s"

---Files---
None found.

No folders found.

-= EOF =-

Romy1309 · 09.10.2010, 20:37

fusstub.dll
Submission date:
2010-10-09 19:28:08 (UTC)
Current status:
queued (#4) queued (#4) analysing finished
Result:
0/ 43 (0.0%)

VT Community

not reviewed
Safety score: -
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2010.10.10.00 2010.10.09 -
AntiVir 7.10.12.167 2010.10.08 -
Antiy-AVL 2.0.3.7 2010.10.09 -
Authentium 5.2.0.5 2010.10.09 -
Avast 4.8.1351.0 2010.10.09 -
Avast5 5.0.594.0 2010.10.09 -
AVG 9.0.0.851 2010.10.09 -
BitDefender 7.2 2010.10.09 -
CAT-QuickHeal 11.00 2010.10.09 -
ClamAV 0.96.2.0-git 2010.10.09 -
Comodo 6331 2010.10.09 -
DrWeb 5.0.2.03300 2010.10.09 -
Emsisoft 5.0.0.50 2010.10.09 -
eSafe 7.0.17.0 2010.10.07 -
eTrust-Vet 36.1.7901 2010.10.08 -
F-Prot 4.6.2.117 2010.10.08 -
F-Secure 9.0.15370.0 2010.10.09 -
Fortinet 4.2.249.0 2010.10.09 -
GData 21 2010.10.09 -
Ikarus T3.1.1.90.0 2010.10.09 -
Jiangmin 13.0.900 2010.10.09 -
K7AntiVirus 9.65.2713 2010.10.09 -
Kaspersky 7.0.0.125 2010.10.09 -
McAfee 5.400.0.1158 2010.10.09 -
McAfee-GW-Edition 2010.1C 2010.10.09 -
Microsoft 1.6201 2010.10.09 -
NOD32 5518 2010.10.09 -
Norman 6.06.07 2010.10.09 -
nProtect 2010-10-09.01 2010.10.09 -
Panda 10.0.2.7 2010.10.09 -
PCTools 7.0.3.5 2010.10.09 -
Prevx 3.0 2010.10.09 -
Rising 22.68.05.00 2010.10.09 -
Sophos 4.58.0 2010.10.09 -
Sunbelt 7025 2010.10.09 -
SUPERAntiSpyware 4.40.0.1006 2010.10.09 -
Symantec 20101.2.0.161 2010.10.09 -
TheHacker 6.7.0.1.053 2010.10.09 -
TrendMicro 9.120.0.1004 2010.10.09 -
TrendMicro-HouseCall 9.120.0.1004 2010.10.09 -
VBA32 3.12.14.1 2010.10.08 -
ViRobot 2010.9.25.4060 2010.10.09 -
VirusBuster 12.67.10.0 2010.10.09 -
Additional information
Show all
MD5 : 057107cc4a47e368615167c4351209c2
SHA1 : d7c5c1d5e104a1f78eb64063087cd81a3153c533
SHA256: 8c80d57239337980e28a8bdc9d27bf556ec613423c725b4a7bceecbe95bacc54

---

Antivirus Version Last Update Result
AhnLab-V3 2010.10.10.00 2010.10.09 -
AntiVir 7.10.12.167 2010.10.08 -
Antiy-AVL 2.0.3.7 2010.10.09 -
Authentium 5.2.0.5 2010.10.09 -
Avast 4.8.1351.0 2010.10.09 -
Avast5 5.0.594.0 2010.10.09 -
AVG 9.0.0.851 2010.10.09 -
BitDefender 7.2 2010.10.09 -
CAT-QuickHeal 11.00 2010.10.09 -
ClamAV 0.96.2.0-git 2010.10.09 -
Comodo 6331 2010.10.09 -
DrWeb 5.0.2.03300 2010.10.09 -
Emsisoft 5.0.0.50 2010.10.09 -
eSafe 7.0.17.0 2010.10.07 -
eTrust-Vet 36.1.7901 2010.10.08 -
F-Prot 4.6.2.117 2010.10.08 -
F-Secure 9.0.15370.0 2010.10.09 -
Fortinet 4.2.249.0 2010.10.09 -
GData 21 2010.10.09 -
Ikarus T3.1.1.90.0 2010.10.09 -
Jiangmin 13.0.900 2010.10.09 -
K7AntiVirus 9.65.2713 2010.10.09 -
Kaspersky 7.0.0.125 2010.10.09 -
McAfee 5.400.0.1158 2010.10.09 -
McAfee-GW-Edition 2010.1C 2010.10.09 -
Microsoft 1.6201 2010.10.09 -
NOD32 5518 2010.10.09 -
Norman 6.06.07 2010.10.09 -
nProtect 2010-10-09.01 2010.10.09 -
Panda 10.0.2.7 2010.10.09 -
PCTools 7.0.3.5 2010.10.09 -
Prevx 3.0 2010.10.09 -
Rising 22.68.05.00 2010.10.09 -
Sophos 4.58.0 2010.10.09 -
Sunbelt 7025 2010.10.09 -
SUPERAntiSpyware 4.40.0.1006 2010.10.09 -
Symantec 20101.2.0.161 2010.10.09 -
TheHacker 6.7.0.1.053 2010.10.09 -
TrendMicro 9.120.0.1004 2010.10.09 -
TrendMicro-HouseCall 9.120.0.1004 2010.10.09 -
VBA32 3.12.14.1 2010.10.08 -
ViRobot 2010.9.25.4060 2010.10.09 -
Additional information
Show all
MD5 : c026f4ce4a40526fdbd1f9bf2ffe31f6
SHA1 : 440d660ae7ba26dd22d80869c9f29819b884c1ba
SHA256: 8263c5c487b6779754a6211d7d1071e3236d40af5c9b1db0a75dd012a1dd8fda

-----
File name:
lxcivs.dll
Submission date:
2010-10-09 19:35:34 (UTC)
Current status:
queued queued analysing finished
Result:
0/ 43 (0.0%)

VT Community

not reviewed
Safety score: -
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2010.10.10.00 2010.10.09 -
AntiVir 7.10.12.167 2010.10.08 -
Antiy-AVL 2.0.3.7 2010.10.09 -
Authentium 5.2.0.5 2010.10.09 -
Avast 4.8.1351.0 2010.10.09 -
Avast5 5.0.594.0 2010.10.09 -
AVG 9.0.0.851 2010.10.09 -
BitDefender 7.2 2010.10.09 -
CAT-QuickHeal 11.00 2010.10.09 -
ClamAV 0.96.2.0-git 2010.10.09 -
Comodo 6331 2010.10.09 -
DrWeb 5.0.2.03300 2010.10.09 -
Emsisoft 5.0.0.50 2010.10.09 -
eSafe 7.0.17.0 2010.10.07 -
eTrust-Vet 36.1.7901 2010.10.08 -
F-Prot 4.6.2.117 2010.10.08 -
F-Secure 9.0.15370.0 2010.10.09 -
Fortinet 4.2.249.0 2010.10.09 -
GData 21 2010.10.09 -
Ikarus T3.1.1.90.0 2010.10.09 -
Jiangmin 13.0.900 2010.10.09 -
K7AntiVirus 9.65.2713 2010.10.09 -
Kaspersky 7.0.0.125 2010.10.09 -
McAfee 5.400.0.1158 2010.10.09 -
McAfee-GW-Edition 2010.1C 2010.10.09 -
Microsoft 1.6201 2010.10.09 -
NOD32 5518 2010.10.09 -
Norman 6.06.07 2010.10.09 -
nProtect 2010-10-09.01 2010.10.09 -
Panda 10.0.2.7 2010.10.09 -
PCTools 7.0.3.5 2010.10.09 -
Prevx 3.0 2010.10.09 -
Rising 22.68.05.00 2010.10.09 -
Sophos 4.58.0 2010.10.09 -
Sunbelt 7025 2010.10.09 -
SUPERAntiSpyware 4.40.0.1006 2010.10.09 -
Symantec 20101.2.0.161 2010.10.09 -
TheHacker 6.7.0.1.053 2010.10.09 -
TrendMicro 9.120.0.1004 2010.10.09 -
TrendMicro-HouseCall 9.120.0.1004 2010.10.09 -
VBA32 3.12.14.1 2010.10.08 -
ViRobot 2010.9.25.4060 2010.10.09 -
VirusBuster 12.67.10.0 2010.10.09 -
Additional information
Show all
MD5 : c0cc3cadf562952665625fc11fbcbf1e
SHA1 : c49fcf4fc5629001a0d02df20be29aaca3e35eee
SHA256: 140cf8321a73906fc62933bf25f11a91b8a323972a4f7768730d510597a2b9c2

Chris4You · 09.10.2010, 20:48

Hi,

wäre auch zu einfach gewesen...
Mal sehen was die nächsten Logs so bringen..

chris

Romy1309 · 09.10.2010, 20:51

All processes killed
========== OTL ==========
Service SPLITCAM stopped successfully!
Service SPLITCAM deleted successfully!
File C:\WINDOWS\System32\DRIVERS\splitcam.sys File not found not found.
Service InCDRm stopped successfully!
Service InCDRm deleted successfully!
File C:\WINDOWS\System32\drivers\InCDRm.sys File not found not found.
Service InCDPass stopped successfully!
Service InCDPass deleted successfully!
File C:\WINDOWS\System32\drivers\InCDPass.sys File not found not found.
Service InCDFs stopped successfully!
Service InCDFs deleted successfully!
File C:\WINDOWS\System32\drivers\InCDFs.sys File not found not found.
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: "Ask.com" removed from browser.search.order.1
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NWEReboot deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\fheydbueyj.exe deleted successfully.
ADS C:\Programme\Gemeinsame Dateien\System:segK7s7ZIJfrd565BRvUT deleted successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft:mKK8MUEyJshT45TXlTP791eP deleted successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft:X9YmwfIIDHEgjek5oqZgILTMYu deleted successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft

5IlmsqOfwCPIA6pCMfod deleted successfully.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\"FirstRunDisabled" | dword:0x00 /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\"AntiVirusOverride" |dword:0x00 /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\\"DisableMonitoring" | dword:0x00 /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus\\"DisableMonitoring" |dword:0x00 /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall\\"DisableMonitoring" | dword:0x00 /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall\\"DisableMonitoring" | dword:0x00 /E : value set successfully!
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: LocalService
->Temp folder emptied: 2198936 bytes
->Temporary Internet Files folder emptied: 3224136 bytes
->Flash cache emptied: 1117 bytes

User: NetworkService
->Temp folder emptied: 2132440 bytes
->Temporary Internet Files folder emptied: 16416357 bytes
->Java cache emptied: 4860 bytes
->Flash cache emptied: 12987 bytes

User: icke
->Temp folder emptied: 2043718 bytes
->Temporary Internet Files folder emptied: 6201997 bytes
->Java cache emptied: 2286343 bytes
->FireFox cache emptied: 64742787 bytes
->Flash cache emptied: 1984056 bytes

%systemdrive% .tmp files removed: 288 bytes
%systemroot% .tmp files removed: 109681 bytes
%systemroot%\System32 .tmp files removed: 13691687 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 143342 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 110,00 mb

Restore point Set: OTL Restore Point (0)

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default User

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService
->Flash cache emptied: 931 bytes

User: icke
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb

OTL by OldTimer - Version 3.2.14.1 log created on 10092010_214241

Files\Folders moved on Reboot...
File\Folder C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\WXYFSTM7\statstracker[1].htm not found!
File\Folder C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\LSGR1PKH\openhand_8_8[1].bmp not found!
File\Folder C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\LSGR1PKH\st[1].htm not found!
File\Folder C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CXEB4TAV\news[1] not found!
File\Folder C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CR9JYAJL\statstracker[1].htm not found!
C:\Dokumente und Einstellungen\icke\Lokale Einstellungen\Temp\~DFFAD8.tmp moved successfully.
C:\Dokumente und Einstellungen\icke\Lokale Einstellungen\Anwendungsdaten\Mozilla\Firefox\Profiles\bhp1qgcy.default\Cache\_CACHE_001_ moved successfully.
C:\Dokumente und Einstellungen\icke\Lokale Einstellungen\Anwendungsdaten\Mozilla\Firefox\Profiles\bhp1qgcy.default\Cache\_CACHE_002_ moved successfully.
C:\Dokumente und Einstellungen\icke\Lokale Einstellungen\Anwendungsdaten\Mozilla\Firefox\Profiles\bhp1qgcy.default\Cache\_CACHE_003_ moved successfully.
C:\Dokumente und Einstellungen\icke\Lokale Einstellungen\Anwendungsdaten\Mozilla\Firefox\Profiles\bhp1qgcy.default\Cache\_CACHE_MAP_ moved successfully.
C:\Dokumente und Einstellungen\icke\Lokale Einstellungen\Anwendungsdaten\Mozilla\Firefox\Profiles\bhp1qgcy.default\urlclassifier3.sqlite moved successfully.
C:\WINDOWS\temp\inf1clrg.tmp moved successfully.
File\Folder C:\WINDOWS\temp\ZLT02ad8.TMP not found!

Registry entries deleted on Reboot...

Romy1309 · 09.10.2010, 21:37

Nach dem GMER scan auf Copyright geklickt, wollte dann txt Datei öffnen um alles Dateinamen zu kopieren.dann ging gar nichts mehr.nicht mal taskmanager.hab ihm dann per Knopf runtergefahren.beim hochfahren kann er nun auch nix mehr.CPU bei 100 %.davon zlclient.exe 50 und forcefield.exe 25.
Restart mit taskmanager geht nicht.....

Was nun?

LG, romy

Romy1309 · 09.10.2010, 22:17

Hab nochmal nen Crashdown gemacht. Hat normal gestartet. Hab dann Antivir und Zonealarm deaktiviert und nochmal den GMER laufen lassen. Als ich Antivir wieder starten wollten um die Auswertung zu posten, ist der Rechner wieder hängen geblieben. Nix ging mehr. Also nochmal Crashdown.

Hier das GMER Logfile.

GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-10-09 23:00:19
Windows 5.1.2600 Service Pack 3
Running: jlje5mkz.exe; Driver: C:\DOKUME~1\Username\LOKALE~1\Temp\fwdiipog.sys

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwConnectPort [0xAF5C0534]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateFile [0xAF5BA782]
SSDT F6D1E1AE ZwCreateKey
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreatePort [0xAF5C0CC0]
SSDT F6D1E1A4 ZwCreateThread
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0xAF5C0DF6]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteFile [0xAF5BB398]
SSDT F6D1E1B3 ZwDeleteKey
SSDT F6D1E1BD ZwDeleteValueKey
SSDT F6D1E1C2 ZwLoadKey
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0xAF5DBB44]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenFile [0xAF5BAFAA]
SSDT F6D1E190 ZwOpenProcess
SSDT F6D1E195 ZwOpenThread
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRenameKey [0xAF5DC8D2]
SSDT F6D1E1CC ZwReplaceKey
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0xAF5C00F4]
SSDT F6D1E1C7 ZwRestoreKey
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0xAF5BB75C]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetSecurityObject [0xAF5DCE12]
SSDT F6D1E1B8 ZwSetValueKey
SSDT \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xAF565620]

INT 0x62 ? FAD02E54
INT 0x63 ? FA9ECE54
INT 0x73 ? FACA0E54
INT 0x74 ? FA92DE54
INT 0x82 ? FAD2EE54
INT 0x83 ? FA9EB78C
INT 0x84 ? FA9F5E54
INT 0x93 ? FA9C0BC4
INT 0x94 ? FA9894AC
INT 0xA3 ? FA9ADE2C
INT 0xA4 ? FAD9554C
INT 0xB1 ? FAD9E544
INT 0xB4 ? FACA1E54

---- Kernel code sections - GMER 1.0.15 ----

.rsrc C:\WINDOWS\system32\DRIVERS\termdd.sys entry point in ".rsrc" section [0xF67EF214]

---- User code sections - GMER 1.0.15 ----

.text C:\Programme\Digidesign\Drivers\MMERefresh.exe[244] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Digidesign\Drivers\MMERefresh.exe[244] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Digidesign\Drivers\MMERefresh.exe[244] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Digidesign\Drivers\MMERefresh.exe[244] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Digidesign\Drivers\MMERefresh.exe[244] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Digidesign\Drivers\MMERefresh.exe[244] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Digidesign\Drivers\MMERefresh.exe[244] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Digidesign\Drivers\MMERefresh.exe[244] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\IswSvc.exe[460] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\CheckPoint\ZAForceField\IswSvc.exe[460] USER32.dll!DefDlgProcW + 56E 7E3742A8 5 Bytes JMP 20C79270 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Apoint2K\Apoint.exe[588] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Apoint2K\Apoint.exe[588] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Apoint2K\Apoint.exe[588] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Apoint2K\Apoint.exe[588] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Apoint2K\Apoint.exe[588] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Apoint2K\Apoint.exe[588] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Apoint2K\Apoint.exe[588] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Apoint2K\Apoint.exe[588] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[616] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[616] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[616] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[616] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[616] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[616] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[616] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\hkcmd.exe[616] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxpers.exe[648] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxpers.exe[648] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxpers.exe[648] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxpers.exe[648] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxpers.exe[648] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxpers.exe[648] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxpers.exe[648] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxpers.exe[648] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\ISB Utility\ISBMgr.exe[660] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\ISB Utility\ISBMgr.exe[660] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\ISB Utility\ISBMgr.exe[660] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\ISB Utility\ISBMgr.exe[660] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\ISB Utility\ISBMgr.exe[660] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\ISB Utility\ISBMgr.exe[660] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\ISB Utility\ISBMgr.exe[660] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\ISB Utility\ISBMgr.exe[660] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[668] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[668] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[668] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[668] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[668] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[668] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[668] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\Explorer.EXE[668] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Update 3\VAIOUpdt.exe[696] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Update 3\VAIOUpdt.exe[696] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Update 3\VAIOUpdt.exe[696] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Update 3\VAIOUpdt.exe[696] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Update 3\VAIOUpdt.exe[696] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Update 3\VAIOUpdt.exe[696] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Update 3\VAIOUpdt.exe[696] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Update 3\VAIOUpdt.exe[696] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[864] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[864] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[864] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[864] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[864] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[864] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[864] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spoolsv.exe[864] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[900] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[900] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[900] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[900] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[900] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[900] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[900] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\winlogon.exe[900] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[944] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[944] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[944] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[944] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[944] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[944] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[944] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\services.exe[944] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[956] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[956] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[956] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[956] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[956] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[956] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lsass.exe[956] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\EvtEng.exe[1004] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\EvtEng.exe[1004] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\EvtEng.exe[1004] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\EvtEng.exe[1004] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\EvtEng.exe[1004] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\EvtEng.exe[1004] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\EvtEng.exe[1004] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\EvtEng.exe[1004] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1144] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1144] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1144] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1144] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1144] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1144] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1144] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1212] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1212] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1212] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1212] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1212] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1252] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1252] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1252] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1252] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1252] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1252] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1252] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1252] USER32.dll!GetCursorPos 7E37974E 5 Bytes JMP 00BF000A
.text C:\WINDOWS\System32\svchost.exe[1252] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\svchost.exe[1252] ole32.dll!CoCreateInstance 774D057E 5 Bytes JMP 00BE000A
.text C:\Programme\Sony\VAIO Power Management\SPMgr.exe[1260] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Power Management\SPMgr.exe[1260] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Power Management\SPMgr.exe[1260] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Power Management\SPMgr.exe[1260] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Power Management\SPMgr.exe[1260] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Power Management\SPMgr.exe[1260] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Power Management\SPMgr.exe[1260] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Power Management\SPMgr.exe[1260] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Protector Suite QL\menusw.exe[1288] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Protector Suite QL\menusw.exe[1288] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Protector Suite QL\menusw.exe[1288] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Protector Suite QL\menusw.exe[1288] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Protector Suite QL\menusw.exe[1288] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Protector Suite QL\menusw.exe[1288] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Protector Suite QL\menusw.exe[1288] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Protector Suite QL\menusw.exe[1288] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\S24EvMon.exe[1304] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\S24EvMon.exe[1304] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\S24EvMon.exe[1304] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\S24EvMon.exe[1304] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\S24EvMon.exe[1304] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\S24EvMon.exe[1304] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\S24EvMon.exe[1304] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\S24EvMon.exe[1304] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1352] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1352] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1352] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1352] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1352] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1352] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1352] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1352] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1412] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1412] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1412] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1412] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1412] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1412] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1412] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1572] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1572] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1572] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1572] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1572] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1572] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[1572] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Avira\AntiVir Desktop\avguard.exe[1664] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Avira\AntiVir Desktop\avguard.exe[1664] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Avira\AntiVir Desktop\avguard.exe[1664] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Avira\AntiVir Desktop\avguard.exe[1664] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Avira\AntiVir Desktop\avguard.exe[1664] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Avira\AntiVir Desktop\avguard.exe[1664] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Avira\AntiVir Desktop\avguard.exe[1664] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Avira\AntiVir Desktop\avguard.exe[1664] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[1684] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[1684] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[1684] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[1684] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[1684] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[1684] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[1684] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[1684] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Flip Video\FlipShare\FlipShareService.exe[1716] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Flip Video\FlipShare\FlipShareService.exe[1716] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Flip Video\FlipShare\FlipShareService.exe[1716] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Flip Video\FlipShare\FlipShareService.exe[1716] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Flip Video\FlipShare\FlipShareService.exe[1716] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Flip Video\FlipShare\FlipShareService.exe[1716] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Flip Video\FlipShare\FlipShareService.exe[1716] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Flip Video\FlipShare\FlipShareService.exe[1716] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1744] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1744] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1744] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1744] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1744] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1744] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1744] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1744] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\iTunes\iTunesHelper.exe[1756] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\iTunes\iTunesHelper.exe[1756] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\iTunes\iTunesHelper.exe[1756] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\iTunes\iTunesHelper.exe[1756] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\iTunes\iTunesHelper.exe[1756] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\iTunes\iTunesHelper.exe[1756] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\iTunes\iTunesHelper.exe[1756] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\iTunes\iTunesHelper.exe[1756] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Bonjour\mDNSResponder.exe[1780] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Bonjour\mDNSResponder.exe[1780] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Bonjour\mDNSResponder.exe[1780] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Bonjour\mDNSResponder.exe[1780] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Bonjour\mDNSResponder.exe[1780] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Bonjour\mDNSResponder.exe[1780] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Bonjour\mDNSResponder.exe[1780] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Bonjour\mDNSResponder.exe[1780] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe[1856] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe[1856] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe[1856] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe[1856] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe[1856] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe[1856] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe[1856] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe[1856] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxsrvc.exe[2084] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxsrvc.exe[2084] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxsrvc.exe[2084] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxsrvc.exe[2084] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxsrvc.exe[2084] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxsrvc.exe[2084] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxsrvc.exe[2084] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxsrvc.exe[2084] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Lexmark 7300 Series\ezprint.exe[2100] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Lexmark 7300 Series\ezprint.exe[2100] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Lexmark 7300 Series\ezprint.exe[2100] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Lexmark 7300 Series\ezprint.exe[2100] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Lexmark 7300 Series\ezprint.exe[2100] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Lexmark 7300 Series\ezprint.exe[2100] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Lexmark 7300 Series\ezprint.exe[2100] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Lexmark 7300 Series\ezprint.exe[2100] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2200] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2200] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2200] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2200] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2200] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2200] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2200] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2200] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2208] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2208] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2208] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2208] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2208] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2208] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2208] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\ctfmon.exe[2208] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe[2248] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe[2248] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe[2248] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe[2248] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe[2248] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe[2248] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe[2248] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe[2248] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe[2532] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe[2532] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe[2532] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe[2532] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe[2532] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe[2532] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe[2532] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe[2532] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\unsecapp.exe[2772] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\unsecapp.exe[2772] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\unsecapp.exe[2772] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\unsecapp.exe[2772] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\unsecapp.exe[2772] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\unsecapp.exe[2772] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\unsecapp.exe[2772] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\unsecapp.exe[2772] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\iPod\bin\iPodService.exe[2856] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\iPod\bin\iPodService.exe[2856] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\iPod\bin\iPodService.exe[2856] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\iPod\bin\iPodService.exe[2856] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\iPod\bin\iPodService.exe[2856] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\iPod\bin\iPodService.exe[2856] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\iPod\bin\iPodService.exe[2856] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\iPod\bin\iPodService.exe[2856] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Apoint2K\Apntex.exe[3036] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Apoint2K\Apntex.exe[3036] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Apoint2K\Apntex.exe[3036] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Apoint2K\Apntex.exe[3036] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Apoint2K\Apntex.exe[3036] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Apoint2K\Apntex.exe[3036] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Apoint2K\Apntex.exe[3036] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Apoint2K\Apntex.exe[3036] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3148] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3148] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3148] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3148] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3148] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3148] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3148] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3148] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wscntfy.exe[3456] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wscntfy.exe[3456] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wscntfy.exe[3456] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wscntfy.exe[3456] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wscntfy.exe[3456] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wscntfy.exe[3456] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wscntfy.exe[3456] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wscntfy.exe[3456] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lxcicoms.exe[3484] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lxcicoms.exe[3484] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lxcicoms.exe[3484] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lxcicoms.exe[3484] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lxcicoms.exe[3484] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lxcicoms.exe[3484] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lxcicoms.exe[3484] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\lxcicoms.exe[3484] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Mediafour\MacDrive 8\MacDrive8Service.exe[3532] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Mediafour\MacDrive 8\MacDrive8Service.exe[3532] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Mediafour\MacDrive 8\MacDrive8Service.exe[3532] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Mediafour\MacDrive 8\MacDrive8Service.exe[3532] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Mediafour\MacDrive 8\MacDrive8Service.exe[3532] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Mediafour\MacDrive 8\MacDrive8Service.exe[3532] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Mediafour\MacDrive 8\MacDrive8Service.exe[3532] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Mediafour\MacDrive 8\MacDrive8Service.exe[3532] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\Username\Desktop\jlje5mkz.exe[3556] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\Username\Desktop\jlje5mkz.exe[3556] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\Username\Desktop\jlje5mkz.exe[3556] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\Username\Desktop\jlje5mkz.exe[3556] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\Username\Desktop\jlje5mkz.exe[3556] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\Username\Desktop\jlje5mkz.exe[3556] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\Username\Desktop\jlje5mkz.exe[3556] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Dokumente und Einstellungen\Username\Desktop\jlje5mkz.exe[3556] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\RegSrvc.exe[3576] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\RegSrvc.exe[3576] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\RegSrvc.exe[3576] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\RegSrvc.exe[3576] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\RegSrvc.exe[3576] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\RegSrvc.exe[3576] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\RegSrvc.exe[3576] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Intel\Wireless\Bin\RegSrvc.exe[3576] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[3644] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[3644] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[3644] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[3644] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[3644] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[3644] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[3644] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\svchost.exe[3644] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Macpower & Tytech Technology\SmartAP\SmartHDD.exe[3652] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Macpower & Tytech Technology\SmartAP\SmartHDD.exe[3652] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Macpower & Tytech Technology\SmartAP\SmartHDD.exe[3652] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Macpower & Tytech Technology\SmartAP\SmartHDD.exe[3652] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Macpower & Tytech Technology\SmartAP\SmartHDD.exe[3652] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Macpower & Tytech Technology\SmartAP\SmartHDD.exe[3652] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Macpower & Tytech Technology\SmartAP\SmartHDD.exe[3652] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Macpower & Tytech Technology\SmartAP\SmartHDD.exe[3652] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Macpower & Tytech Technology\SmartAP\SmartAP.exe[3708] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Macpower & Tytech Technology\SmartAP\SmartAP.exe[3708] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Macpower & Tytech Technology\SmartAP\SmartAP.exe[3708] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Macpower & Tytech Technology\SmartAP\SmartAP.exe[3708] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Macpower & Tytech Technology\SmartAP\SmartAP.exe[3708] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Macpower & Tytech Technology\SmartAP\SmartAP.exe[3708] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Macpower & Tytech Technology\SmartAP\SmartAP.exe[3708] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Macpower & Tytech Technology\SmartAP\SmartAP.exe[3708] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wdfmgr.exe[3772] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wdfmgr.exe[3772] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wdfmgr.exe[3772] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wdfmgr.exe[3772] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wdfmgr.exe[3772] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wdfmgr.exe[3772] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wdfmgr.exe[3772] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\wdfmgr.exe[3772] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3828] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3828] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3828] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3828] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3828] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3828] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3828] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\System32\alg.exe[3828] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Event Service\VESMgr.exe[3844] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Event Service\VESMgr.exe[3844] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Event Service\VESMgr.exe[3844] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Event Service\VESMgr.exe[3844] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Event Service\VESMgr.exe[3844] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Event Service\VESMgr.exe[3844] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Event Service\VESMgr.exe[3844] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Sony\VAIO Event Service\VESMgr.exe[3844] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3912] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3912] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3912] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3912] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3912] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3912] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3912] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\Programme\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3912] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxext.exe[3992] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxext.exe[3992] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxext.exe[3992] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxext.exe[3992] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxext.exe[3992] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxext.exe[3992] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxext.exe[3992] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxext.exe[3992] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxsrvc.exe[4064] ntdll.dll!NtAccessCheckByType 7C91CE8E 5 Bytes JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxsrvc.exe[4064] ntdll.dll!NtImpersonateClientOfPort 7C91D3FE 5 Bytes JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxsrvc.exe[4064] ntdll.dll!NtSetInformationProcess 7C91DC9E 5 Bytes JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxsrvc.exe[4064] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxsrvc.exe[4064] USER32.dll!FindWindowA 7E3782E1 5 Bytes JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxsrvc.exe[4064] USER32.dll!FindWindowW 7E37C9C3 5 Bytes JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxsrvc.exe[4064] ADVAPI32.dll!ImpersonateNamedPipeClient 77DA7426 5 Bytes JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text C:\WINDOWS\system32\igfxsrvc.exe[4064] ADVAPI32.dll!SetThreadToken 77DAF193 5 Bytes JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [AF5C5672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [AF5C54C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [AF5C5CBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [AF5C3C2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] [AF5C3C2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [AF5C5672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [AF5C54C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [AF5C5CBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [AF5C5672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [AF5C3C2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [AF5C5CBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [AF5C54C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [AF5C5CBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [AF5C54C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [AF5C5672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [AF5C3C2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [AF5C5672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [AF5C54C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [AF5C5CBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [AF5C5672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [AF5C3C2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [AF5C5CBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [AF5C54C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

Romy1309 · 09.10.2010, 22:18

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Programme\Digidesign\Drivers\MMERefresh.exe[244] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Apoint2K\Apoint.exe[588] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\hkcmd.exe[616] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\igfxpers.exe[648] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Sony\ISB Utility\ISBMgr.exe[660] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\Explorer.EXE[668] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Sony\VAIO Update 3\VAIOUpdt.exe[696] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\spoolsv.exe[864] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\winlogon.exe[900] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\services.exe[944] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\lsass.exe[956] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Intel\Wireless\Bin\EvtEng.exe[1004] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\svchost.exe[1144] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\svchost.exe[1212] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\System32\svchost.exe[1252] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Sony\VAIO Power Management\SPMgr.exe[1260] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Protector Suite QL\menusw.exe[1288] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Intel\Wireless\Bin\S24EvMon.exe[1304] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\svchost.exe[1352] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\svchost.exe[1412] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\svchost.exe[1572] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Avira\AntiVir Desktop\avguard.exe[1664] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Avira\AntiVir Desktop\avgnt.exe[1684] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Flip Video\FlipShare\FlipShareService.exe[1716] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1744] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\iTunes\iTunesHelper.exe[1756] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Bonjour\mDNSResponder.exe[1780] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe[1856] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\igfxsrvc.exe[2084] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Lexmark 7300 Series\ezprint.exe[2100] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\DivX\DivX Update\DivXUpdate.exe[2200] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\ctfmon.exe[2208] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe[2248] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe[2532] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\wbem\unsecapp.exe[2772] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\iPod\bin\iPodService.exe[2856] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Apoint2K\Apntex.exe[3036] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\wbem\wmiprvse.exe[3148] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\wscntfy.exe[3456] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\lxcicoms.exe[3484] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Mediafour\MacDrive 8\MacDrive8Service.exe[3532] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Dokumente und Einstellungen\Username\Desktop\jlje5mkz.exe[3556] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Intel\Wireless\Bin\RegSrvc.exe[3576] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\svchost.exe[3644] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Macpower & Tytech Technology\SmartAP\SmartHDD.exe[3652] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Macpower & Tytech Technology\SmartAP\SmartAP.exe[3708] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\wdfmgr.exe[3772] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\System32\alg.exe[3828] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Sony\VAIO Event Service\VESMgr.exe[3844] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\Programme\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3912] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\igfxext.exe[3992] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT C:\WINDOWS\system32\igfxsrvc.exe[4064] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)

AttachedDevice \FileSystem\Ntfs \Ntfs FdRedir.sys (File Disk Redirector/UPEK Inc.)

Device \Driver\Tcpip \Device\Ip vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \FileSystem\MRxDAV \Device\WebDavRedirector MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
Device \Driver\Tcpip \Device\Tcp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\Udp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\RawIp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \FileSystem\MRxSmb \Device\LanmanRedirector MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
Device \FileSystem\Cdfs \Cdfs MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
Device -> \Driver\atapi \Device\Harddisk0\DR0 FA7D8EC5

---- Registry - GMER 1.0.15 ----

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{57AD6693-C3DA-0C93-D1BE-929E14591E09}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{57AD6693-C3DA-0C93-D1BE-929E14591E09}@gaeegnamkiegil 0x61 0x63 0x62 0x67 ...

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\DRIVERS\termdd.sys suspicious modification
File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

---- EOF - GMER 1.0.15 ----

Romy1309 · 09.10.2010, 22:23

2010/10/09 23:21:20.0750 TDSS rootkit removing tool 2.4.4.0 Oct 4 2010 09:06:59
2010/10/09 23:21:20.0750 ================================================================================
2010/10/09 23:21:20.0750 SystemInfo:
2010/10/09 23:21:20.0750
2010/10/09 23:21:20.0750 OS Version: 5.1.2600 ServicePack: 3.0
2010/10/09 23:21:20.0750 Product type: Workstation
2010/10/09 23:21:20.0750 ComputerName: Computer
2010/10/09 23:21:20.0750 UserName: Username
2010/10/09 23:21:20.0750 Windows directory: C:\WINDOWS
2010/10/09 23:21:20.0750 System windows directory: C:\WINDOWS
2010/10/09 23:21:20.0750 Processor architecture: Intel x86
2010/10/09 23:21:20.0750 Number of processors: 2
2010/10/09 23:21:20.0750 Page size: 0x1000
2010/10/09 23:21:20.0750 Boot type: Normal boot
2010/10/09 23:21:20.0750 ================================================================================
2010/10/09 23:21:21.0375 Initialize success
2010/10/09 23:21:24.0843 ================================================================================
2010/10/09 23:21:24.0843 Scan started
2010/10/09 23:21:24.0843 Mode: Manual;
2010/10/09 23:21:24.0843 ================================================================================
2010/10/09 23:21:25.0859 61883 (914a9709fc3bf419ad2f85547f2a4832) C:\WINDOWS\system32\DRIVERS\61883.sys
2010/10/09 23:21:25.0953 ACPI (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2010/10/09 23:21:26.0015 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2010/10/09 23:21:26.0203 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2010/10/09 23:21:26.0406 AegisP (a1ad1a4a9f18d900ca9c93fa3efdcb56) C:\WINDOWS\system32\DRIVERS\AegisP.sys
2010/10/09 23:21:26.0578 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
2010/10/09 23:21:26.0750 AnyDVD (5f9087243a77971a46b67ecc1c0d3a32) C:\WINDOWS\system32\Drivers\AnyDVD.sys
2010/10/09 23:21:26.0859 ApfiltrService (2f8717075620666b40a19dc41e08ace6) C:\WINDOWS\system32\DRIVERS\Apfiltr.sys
2010/10/09 23:21:26.0921 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2010/10/09 23:21:27.0031 Aspi32 (b979979ab8027f7f53fb16ec4229b7db) C:\WINDOWS\system32\drivers\Aspi32.sys
2010/10/09 23:21:27.0062 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2010/10/09 23:21:27.0093 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2010/10/09 23:21:27.0140 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2010/10/09 23:21:27.0203 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2010/10/09 23:21:27.0328 Avc (f8e6956a614f15a0860474c5e2a7de6b) C:\WINDOWS\system32\DRIVERS\avc.sys
2010/10/09 23:21:27.0437 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys
2010/10/09 23:21:27.0453 avgntflt (14fe36d8f2c6a2435275338d061a0b66) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
2010/10/09 23:21:27.0500 avipbb (6d52060b59e7d79cd2a044b6add1f1ef) C:\WINDOWS\system32\DRIVERS\avipbb.sys
2010/10/09 23:21:27.0546 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2010/10/09 23:21:27.0609 CBDisk (93c568904e116607df2389907a9d8899) C:\WINDOWS\system32\drivers\CBDisk.sys
2010/10/09 23:21:27.0671 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2010/10/09 23:21:27.0781 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2010/10/09 23:21:27.0843 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2010/10/09 23:21:27.0890 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2010/10/09 23:21:27.0921 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2010/10/09 23:21:28.0000 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2010/10/09 23:21:28.0031 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2010/10/09 23:21:28.0125 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2010/10/09 23:21:28.0187 dmboot (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
2010/10/09 23:21:28.0250 DMICall (526192bf7696f72e29777bf4a180513a) C:\WINDOWS\system32\DRIVERS\DMICall.sys
2010/10/09 23:21:28.0312 dmio (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
2010/10/09 23:21:28.0375 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2010/10/09 23:21:28.0406 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2010/10/09 23:21:28.0468 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2010/10/09 23:21:28.0531 ElbyCDIO (084a13f18856d610d44d3109a9d2acde) C:\WINDOWS\system32\Drivers\ElbyCDIO.sys
2010/10/09 23:21:28.0578 ElbyDelay (df9957db3bfe5136aad3c2c101806c98) C:\WINDOWS\system32\Drivers\ElbyDelay.sys
2010/10/09 23:21:28.0656 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2010/10/09 23:21:28.0703 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2010/10/09 23:21:28.0781 FdRedir (430d2ae2b905614da6cba869b4f85e38) C:\Programme\Gemeinsame Dateien\Protector Suite QL\Drivers\FdRedir.sys
2010/10/09 23:21:28.0812 FileDisk2 (0997b6b3ab4b085ec4ee9646feb46101) C:\Programme\Gemeinsame Dateien\Protector Suite QL\Drivers\filedisk.sys
2010/10/09 23:21:28.0859 Fips (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
2010/10/09 23:21:28.0890 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2010/10/09 23:21:28.0953 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2010/10/09 23:21:29.0015 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2010/10/09 23:21:29.0078 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2010/10/09 23:21:29.0156 GEARAspiWDM (f2f431d1573ee632975c524418655b84) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2010/10/09 23:21:29.0203 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2010/10/09 23:21:29.0234 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2010/10/09 23:21:29.0265 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2010/10/09 23:21:29.0328 HSFHWAZL (6a5c4732d6803f84e2987edd8e4359ce) C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
2010/10/09 23:21:29.0406 HSF_DPV (21c31273c6cc4826e74be8ae3b09d4a8) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
2010/10/09 23:21:29.0562 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2010/10/09 23:21:29.0656 i8042prt (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2010/10/09 23:21:29.0906 ialm (c1c2d6940d6ec2f247b0f3c11e0a18e0) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
2010/10/09 23:21:30.0218 IFXTPM (0a359837e021bc04a04a6fd189492c65) C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS
2010/10/09 23:21:30.0281 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2010/10/09 23:21:30.0515 IntcAzAudAddService (cdfd5a68a2e1caa89c5c0e0b3cb98731) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2010/10/09 23:21:30.0687 intelppm (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2010/10/09 23:21:30.0718 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2010/10/09 23:21:30.0765 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2010/10/09 23:21:30.0796 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2010/10/09 23:21:30.0828 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2010/10/09 23:21:30.0890 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2010/10/09 23:21:30.0921 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2010/10/09 23:21:30.0953 isapnp (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2010/10/09 23:21:31.0046 ISWKL (7d546f37693797507bf3d9b318564774) C:\Programme\CheckPoint\ZAForceField\ISWKL.sys
2010/10/09 23:21:31.0140 Kbdclass (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2010/10/09 23:21:31.0171 kbdhid (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2010/10/09 23:21:31.0218 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2010/10/09 23:21:31.0265 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2010/10/09 23:21:31.0359 MDFSYSNT (2c70290d63eb639da23ed667b9ebdf84) C:\WINDOWS\system32\drivers\MDFSYSNT.sys
2010/10/09 23:21:31.0421 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
2010/10/09 23:21:31.0468 MDPMGRNT (d94d2e968239ce7f01f2cfa503db57e1) C:\WINDOWS\system32\drivers\MDPMGRNT.sys
2010/10/09 23:21:31.0500 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2010/10/09 23:21:31.0578 Modem (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
2010/10/09 23:21:31.0671 Mouclass (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2010/10/09 23:21:31.0734 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2010/10/09 23:21:31.0781 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2010/10/09 23:21:31.0828 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2010/10/09 23:21:31.0906 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2010/10/09 23:21:32.0046 MSDV (1477849772712bac69c144dcf2c9ce81) C:\WINDOWS\system32\DRIVERS\msdv.sys
2010/10/09 23:21:32.0093 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2010/10/09 23:21:32.0140 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2010/10/09 23:21:32.0171 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2010/10/09 23:21:32.0203 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2010/10/09 23:21:32.0265 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2010/10/09 23:21:32.0296 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2010/10/09 23:21:32.0359 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2010/10/09 23:21:32.0390 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2010/10/09 23:21:32.0484 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2010/10/09 23:21:32.0531 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2010/10/09 23:21:32.0578 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2010/10/09 23:21:32.0593 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2010/10/09 23:21:32.0625 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2010/10/09 23:21:32.0703 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
2010/10/09 23:21:32.0734 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2010/10/09 23:21:32.0765 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2010/10/09 23:21:32.0937 NETw4x32 (b57c3897952a5e327e62fb0f267e69a8) C:\WINDOWS\system32\DRIVERS\NETw4x32.sys
2010/10/09 23:21:33.0078 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2010/10/09 23:21:33.0125 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2010/10/09 23:21:33.0171 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2010/10/09 23:21:33.0250 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2010/10/09 23:21:33.0296 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2010/10/09 23:21:33.0328 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2010/10/09 23:21:33.0421 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2010/10/09 23:21:33.0484 OVT511Plus (c5739be3a8eecdf951955a38e1741f45) C:\WINDOWS\system32\Drivers\omcamvid.sys
2010/10/09 23:21:33.0515 Parport (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
2010/10/09 23:21:33.0562 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2010/10/09 23:21:33.0609 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
2010/10/09 23:21:33.0640 PCI (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
2010/10/09 23:21:33.0703 PCIIde (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
2010/10/09 23:21:33.0718 Pcmcia (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2010/10/09 23:21:33.0875 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2010/10/09 23:21:33.0921 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2010/10/09 23:21:34.0015 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2010/10/09 23:21:34.0078 PxHelp20 (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2010/10/09 23:21:34.0234 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2010/10/09 23:21:34.0296 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2010/10/09 23:21:34.0312 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2010/10/09 23:21:34.0343 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2010/10/09 23:21:34.0375 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2010/10/09 23:21:34.0437 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2010/10/09 23:21:34.0468 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2010/10/09 23:21:34.0562 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2010/10/09 23:21:34.0609 redbook (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
2010/10/09 23:21:34.0687 s24trans (eadfb87f911a7a75d1b80617f92901e8) C:\WINDOWS\system32\DRIVERS\s24trans.sys
2010/10/09 23:21:34.0781 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS
2010/10/09 23:21:34.0843 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS
2010/10/09 23:21:35.0031 sbp2port (b244960e5a1db8e9d5d17086de37c1e4) C:\WINDOWS\system32\DRIVERS\sbp2port.sys
2010/10/09 23:21:35.0171 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2010/10/09 23:21:35.0296 Sentinel (95a26d5d8ceda33377af627dafc2796f) C:\WINDOWS\System32\Drivers\SENTINEL.SYS
2010/10/09 23:21:35.0375 Ser2pl (6ce397c482bede91a38e56a8c4a0dc6d) C:\WINDOWS\system32\DRIVERS\ser2pl.sys
2010/10/09 23:21:35.0406 Serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2010/10/09 23:21:35.0484 Serial (ddb032b5dc45dca340ff96212248df70) C:\WINDOWS\system32\DRIVERS\avidXPserial.sys
2010/10/09 23:21:35.0515 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2010/10/09 23:21:35.0578 shpf (c3fde0e50499cce2948959dd79403d83) C:\WINDOWS\system32\DRIVERS\shpf.sys
2010/10/09 23:21:35.0640 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2010/10/09 23:21:35.0750 SNC (be6038e0a7d2e2fe69107e41a0265831) C:\WINDOWS\system32\Drivers\SonyNC.sys
2010/10/09 23:21:35.0812 SonyImgF (ffdb6f1cb87b42f41b6de116cd6ef809) C:\WINDOWS\system32\DRIVERS\SonyImgF.sys
2010/10/09 23:21:35.0859 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2010/10/09 23:21:35.0906 sr (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
2010/10/09 23:21:35.0968 Srv (89220b427890aa1dffd1a02648ae51c3) C:\WINDOWS\system32\DRIVERS\srv.sys
2010/10/09 23:21:36.0031 ssmdrv (5ec550b8952882ee856b862cf648522d) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
2010/10/09 23:21:36.0093 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2010/10/09 23:21:36.0156 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2010/10/09 23:21:36.0187 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2010/10/09 23:21:36.0296 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2010/10/09 23:21:36.0375 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2010/10/09 23:21:36.0453 TcUsb (fc6fe02f400308606a911640e72326b5) C:\WINDOWS\system32\Drivers\tcusb.sys
2010/10/09 23:21:36.0484 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2010/10/09 23:21:36.0546 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2010/10/09 23:21:36.0609 TermDD (25dadd8f8166c4b5bdcafcf3ae75cbf3) C:\WINDOWS\system32\DRIVERS\termdd.sys
2010/10/09 23:21:36.0609 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\termdd.sys. Real md5: 25dadd8f8166c4b5bdcafcf3ae75cbf3, Fake md5: 88155247177638048422893737429d9e
2010/10/09 23:21:36.0609 TermDD - detected Rootkit.Win32.TDSS.tdl3 (0)
2010/10/09 23:21:36.0687 ti21sony (3106074a87bd5a16e2a3af6902bb6d91) C:\WINDOWS\system32\drivers\ti21sony.sys
2010/10/09 23:21:36.0796 TPkd (409a577fd5781c717e55a28717514c58) C:\WINDOWS\system32\drivers\TPkd.sys
2010/10/09 23:21:36.0875 trackcam (a8840ba61d33e01754168c7674118554) C:\WINDOWS\system32\DRIVERS\trackcam.sys
2010/10/09 23:21:36.0968 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2010/10/09 23:21:37.0046 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2010/10/09 23:21:37.0109 USBAAPL (60a68a5ea173a97971ee9f1ff49eb2b3) C:\WINDOWS\system32\Drivers\usbaapl.sys
2010/10/09 23:21:37.0156 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2010/10/09 23:21:37.0203 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2010/10/09 23:21:37.0218 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2010/10/09 23:21:37.0234 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2010/10/09 23:21:37.0265 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2010/10/09 23:21:37.0328 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2010/10/09 23:21:37.0421 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2010/10/09 23:21:37.0453 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2010/10/09 23:21:37.0515 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
2010/10/09 23:21:37.0546 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2010/10/09 23:21:37.0593 VolSnap (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
2010/10/09 23:21:37.0671 vsdatant (050c38ebb22512122e54b47dc278bccd) C:\WINDOWS\system32\vsdatant.sys
2010/10/09 23:21:38.0031 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2010/10/09 23:21:38.0062 WDC_SAM (d6efaf429fd30c5df613d220e344cce7) C:\WINDOWS\system32\DRIVERS\wdcsam.sys
2010/10/09 23:21:38.0125 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2010/10/09 23:21:38.0203 winachsf (307d248f97835b6879bdd361086924fe) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
2010/10/09 23:21:38.0312 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2010/10/09 23:21:38.0453 yukonwxp (a5d4eae27e68625296d685a786897491) C:\WINDOWS\system32\DRIVERS\yk51x86.sys
2010/10/09 23:21:38.0671 ================================================================================
2010/10/09 23:21:38.0671 Scan finished
2010/10/09 23:21:38.0671 ================================================================================
2010/10/09 23:21:38.0687 Detected object count: 1
2010/10/09 23:22:04.0890 TermDD (25dadd8f8166c4b5bdcafcf3ae75cbf3) C:\WINDOWS\system32\DRIVERS\termdd.sys
2010/10/09 23:22:04.0890 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\termdd.sys. Real md5: 25dadd8f8166c4b5bdcafcf3ae75cbf3, Fake md5: 88155247177638048422893737429d9e
2010/10/09 23:22:05.0281 Backup copy found, using it..
2010/10/09 23:22:05.0296 C:\WINDOWS\system32\DRIVERS\termdd.sys - will be cured after reboot
2010/10/09 23:22:05.0296 Rootkit.Win32.TDSS.tdl3(TermDD) - User select action: Cure

Romy1309 · 09.10.2010, 22:24

ich mach dann ma nen neustart..

Chris4You · 10.10.2010, 19:02

Hi,

wie ist der Stand?
Was treibt der Rechner so?

chris

Browser öffnet Tabs selbstständig + Trojaner gefunden

Plagegeister aller Art und deren Bekämpfung: Browser öffnet Tabs selbstständig + Trojaner gefunden