| Sabomnim | 10.12.2013 17:16 |
Und noch Gmer: Code:
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-12-10 16:18:48
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GH01 298,09GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\user\AppData\Local\Temp\pxldypow.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe[1248] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe[1248] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe[1248] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe[1924] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe[1924] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe[1924] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Windows\system32\Dwm.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile 0000000077901600 6 bytes [48, B8, 60, 23, BF, 02]
.text C:\Windows\system32\Dwm.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile + 8 0000000077901608 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Windows\system32\Dwm.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 00000000779017d0 6 bytes [48, B8, 40, 2B, BF, 02]
.text C:\Windows\system32\Dwm.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread + 8 00000000779017d8 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Windows\system32\Dwm.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000779018b0 6 bytes [48, B8, B0, 2E, BF, 02]
.text C:\Windows\system32\Dwm.exe[536] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8 00000000779018b8 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Windows\system32\Dwm.exe[536] C:\Windows\SYSTEM32\ntdll.dll!DbgUiRemoteBreakin + 1 00000000779a7f11 11 bytes {MOV EAX, 0x2bf2e20; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Windows\system32\Dwm.exe[536] C:\Windows\system32\WS2_32.dll!send + 1 000007fefdde8001 11 bytes {MOV EAX, 0x2bf4490; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Windows\Explorer.EXE[1364] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile 0000000077901600 6 bytes [48, B8, 60, 23, 2E, 03]
.text C:\Windows\Explorer.EXE[1364] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile + 8 0000000077901608 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Windows\Explorer.EXE[1364] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 00000000779017d0 6 bytes [48, B8, 40, 2B, 2E, 03]
.text C:\Windows\Explorer.EXE[1364] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread + 8 00000000779017d8 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Windows\Explorer.EXE[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000779018b0 6 bytes [48, B8, B0, 2E, 2E, 03]
.text C:\Windows\Explorer.EXE[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8 00000000779018b8 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Windows\Explorer.EXE[1364] C:\Windows\SYSTEM32\ntdll.dll!DbgUiRemoteBreakin + 1 00000000779a7f11 11 bytes {MOV EAX, 0x32e2e20; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Windows\Explorer.EXE[1364] C:\Windows\system32\kernel32.dll!CopyFileExW 00000000777a23d0 5 bytes JMP 000000016fff00d8
.text C:\Windows\Explorer.EXE[1364] C:\Windows\system32\kernel32.dll!MoveFileWithProgressW 000000007781f6c0 8 bytes JMP 000000016fff0110
.text C:\Windows\Explorer.EXE[1364] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe7f7490 11 bytes JMP 000007fffe7c00d8
.text C:\Windows\system32\taskhost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile 0000000077901600 6 bytes [48, B8, 60, 23, 94, 04]
.text C:\Windows\system32\taskhost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile + 8 0000000077901608 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Windows\system32\taskhost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 00000000779017d0 6 bytes [48, B8, 40, 2B, 94, 04]
.text C:\Windows\system32\taskhost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread + 8 00000000779017d8 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Windows\system32\taskhost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000779018b0 6 bytes [48, B8, B0, 2E, 94, 04]
.text C:\Windows\system32\taskhost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8 00000000779018b8 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Windows\system32\taskhost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!DbgUiRemoteBreakin + 1 00000000779a7f11 11 bytes {MOV EAX, 0x4942e20; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Windows\system32\taskhost.exe[1672] C:\Windows\system32\WS2_32.dll!send + 1 000007fefdde8001 11 bytes {MOV EAX, 0x4944490; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Windows\system32\taskhost.exe[1672] C:\Windows\system32\wininet.dll!HttpSendRequestW + 1 000007fefde46f11 11 bytes {MOV EAX, 0x4943100; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Windows\system32\taskhost.exe[1672] C:\Windows\system32\wininet.dll!HttpSendRequestA + 1 000007fefdf2cb61 11 bytes {MOV EAX, 0x49433a0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Windows\system32\taskeng.exe[2088] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile 0000000077901600 6 bytes [48, B8, 60, 23, EE, 01]
.text C:\Windows\system32\taskeng.exe[2088] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile + 8 0000000077901608 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Windows\system32\taskeng.exe[2088] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 00000000779017d0 6 bytes [48, B8, 40, 2B, EE, 01]
.text C:\Windows\system32\taskeng.exe[2088] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread + 8 00000000779017d8 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Windows\system32\taskeng.exe[2088] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000779018b0 6 bytes [48, B8, B0, 2E, EE, 01]
.text C:\Windows\system32\taskeng.exe[2088] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8 00000000779018b8 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Windows\system32\taskeng.exe[2088] C:\Windows\SYSTEM32\ntdll.dll!DbgUiRemoteBreakin + 1 00000000779a7f11 11 bytes {MOV EAX, 0x1ee2e20; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Windows\system32\taskeng.exe[2088] C:\Windows\system32\WS2_32.dll!send + 1 000007fefdde8001 11 bytes {MOV EAX, 0x1ee4490; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2276] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2276] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2276] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe[2328] C:\Windows\syswow64\kernel32.dll!LoadLibraryW 0000000075a048cb 5 bytes JMP 00000001737143d0
.text C:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe[2328] C:\Windows\syswow64\kernel32.dll!LoadLibraryA 0000000075a04977 5 bytes JMP 0000000173714200
.text C:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe[2328] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe[2328] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe[2328] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2448] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2448] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2448] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe[2500] C:\Windows\syswow64\kernel32.dll!LoadLibraryW 0000000075a048cb 5 bytes JMP 00000001737143d0
.text C:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe[2500] C:\Windows\syswow64\kernel32.dll!LoadLibraryA 0000000075a04977 5 bytes JMP 0000000173714200
.text C:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe[2500] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe[2500] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe[2500] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe[2776] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe[2776] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe[2776] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Windows\SysWOW64\NLSSRV32.EXE[2820] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Windows\SysWOW64\NLSSRV32.EXE[2820] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Windows\SysWOW64\NLSSRV32.EXE[2820] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe[2892] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe[2892] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe[2892] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[2372] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[2372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[2372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe[2548] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe[2548] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe[2548] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe[1976] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe[1976] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe[1976] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe[3076] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe[3076] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe[3076] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3140] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3140] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3140] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe[3236] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe[3236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe[3236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[3320] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[3320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[3320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[3328] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[3328] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[3328] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Windows\SysWOW64\DllHost.exe[3400] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Windows\SysWOW64\DllHost.exe[3400] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Windows\SysWOW64\DllHost.exe[3400] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Windows\SysWOW64\DllHost.exe[3512] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Windows\SysWOW64\DllHost.exe[3512] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Windows\SysWOW64\DllHost.exe[3512] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESGfxMgr.exe[3784] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile 0000000077901600 5 bytes [48, B8, 60, 23, 31]
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESGfxMgr.exe[3784] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile + 8 0000000077901608 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESGfxMgr.exe[3784] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 00000000779017d0 5 bytes [48, B8, 40, 2B, 31]
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESGfxMgr.exe[3784] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread + 8 00000000779017d8 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESGfxMgr.exe[3784] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000779018b0 5 bytes [48, B8, B0, 2E, 31]
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESGfxMgr.exe[3784] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8 00000000779018b8 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESGfxMgr.exe[3784] C:\Windows\SYSTEM32\ntdll.dll!DbgUiRemoteBreakin + 1 00000000779a7f11 11 bytes {MOV EAX, 0x312e20; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESGfxMgr.exe[3784] C:\Windows\system32\WS2_32.dll!send + 1 000007fefdde8001 11 bytes {MOV EAX, 0x314490; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[3940] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[3940] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[3940] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3736] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3736] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3736] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe[5104] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile 0000000077aafd98 6 bytes [68, 40, 1C, C6, 03, C3]
.text C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe[5104] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000077ab0068 6 bytes [68, 70, 21, C6, 03, C3]
.text C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe[5104] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000077ab01c4 6 bytes [68, 70, 24, C6, 03, C3]
.text C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe[5104] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin 0000000077b2f8ea 7 bytes [68, 10, 24, C6, 03, C3, 7D]
.text C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe[5104] C:\Windows\syswow64\WS2_32.dll!send 0000000076f06f01 6 bytes [68, C0, 36, C6, 03, C3]
.text C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe[5104] C:\Windows\syswow64\WININET.dll!HttpSendRequestW 00000000774e7676 6 bytes [68, 30, 26, C6, 03, C3]
.text C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe[5104] C:\Windows\syswow64\WININET.dll!HttpSendRequestA 00000000775b3456 6 bytes [68, 00, 28, C6, 03, C3]
.text C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe[5104] C:\Windows\syswow64\user32.DLL!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe[5104] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe[5104] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Windows\SysWOW64\schtasks.exe[4436] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Windows\SysWOW64\schtasks.exe[4436] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Windows\SysWOW64\schtasks.exe[4436] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4596] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile 0000000077901600 6 bytes [48, B8, 60, 23, 13, 02]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4596] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile + 8 0000000077901608 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4596] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 00000000779017d0 6 bytes [48, B8, 40, 2B, 13, 02]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4596] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread + 8 00000000779017d8 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4596] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000779018b0 6 bytes [48, B8, B0, 2E, 13, 02]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4596] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8 00000000779018b8 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4596] C:\Windows\SYSTEM32\ntdll.dll!DbgUiRemoteBreakin + 1 00000000779a7f11 11 bytes {MOV EAX, 0x2132e20; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4596] C:\Windows\system32\WS2_32.dll!send + 1 000007fefdde8001 11 bytes {MOV EAX, 0x2134490; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4616] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile 0000000077901600 6 bytes [48, B8, 60, 23, 0B, 02]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4616] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile + 8 0000000077901608 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4616] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 00000000779017d0 6 bytes [48, B8, 40, 2B, 0B, 02]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4616] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread + 8 00000000779017d8 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4616] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000779018b0 6 bytes [48, B8, B0, 2E, 0B, 02]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4616] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8 00000000779018b8 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4616] C:\Windows\SYSTEM32\ntdll.dll!DbgUiRemoteBreakin + 1 00000000779a7f11 11 bytes {MOV EAX, 0x20b2e20; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4616] C:\Windows\system32\WS2_32.dll!send + 1 000007fefdde8001 11 bytes {MOV EAX, 0x20b4490; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4616] C:\Windows\system32\WININET.dll!HttpSendRequestW + 1 000007fefde46f11 11 bytes {MOV EAX, 0x20b3100; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4616] C:\Windows\system32\WININET.dll!HttpSendRequestA + 1 000007fefdf2cb61 11 bytes {MOV EAX, 0x20b33a0; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Users\user\AppData\Local\Apps\2.0\32WW39EP.APM\9NQMZ9EZ.4Y9\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\fritzbox-usb-fernanschluss.exe[4320] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile 0000000077aafd98 4 bytes [68, 40, 1C, 4F]
.text C:\Users\user\AppData\Local\Apps\2.0\32WW39EP.APM\9NQMZ9EZ.4Y9\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\fritzbox-usb-fernanschluss.exe[4320] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile + 5 0000000077aafd9d 1 byte [C3]
.text C:\Users\user\AppData\Local\Apps\2.0\32WW39EP.APM\9NQMZ9EZ.4Y9\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\fritzbox-usb-fernanschluss.exe[4320] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000077ab0068 4 bytes [68, 70, 21, 4F]
.text C:\Users\user\AppData\Local\Apps\2.0\32WW39EP.APM\9NQMZ9EZ.4Y9\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\fritzbox-usb-fernanschluss.exe[4320] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread + 5 0000000077ab006d 1 byte [C3]
.text C:\Users\user\AppData\Local\Apps\2.0\32WW39EP.APM\9NQMZ9EZ.4Y9\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\fritzbox-usb-fernanschluss.exe[4320] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000077ab01c4 4 bytes [68, 70, 24, 4F]
.text C:\Users\user\AppData\Local\Apps\2.0\32WW39EP.APM\9NQMZ9EZ.4Y9\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\fritzbox-usb-fernanschluss.exe[4320] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 5 0000000077ab01c9 1 byte [C3]
.text C:\Users\user\AppData\Local\Apps\2.0\32WW39EP.APM\9NQMZ9EZ.4Y9\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\fritzbox-usb-fernanschluss.exe[4320] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin 0000000077b2f8ea 7 bytes [68, 10, 24, 4F, 00, C3, 7D]
.text C:\Users\user\AppData\Local\Apps\2.0\32WW39EP.APM\9NQMZ9EZ.4Y9\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\fritzbox-usb-fernanschluss.exe[4320] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Users\user\AppData\Local\Apps\2.0\32WW39EP.APM\9NQMZ9EZ.4Y9\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\fritzbox-usb-fernanschluss.exe[4320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Users\user\AppData\Local\Apps\2.0\32WW39EP.APM\9NQMZ9EZ.4Y9\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\fritzbox-usb-fernanschluss.exe[4320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Users\user\AppData\Local\Apps\2.0\32WW39EP.APM\9NQMZ9EZ.4Y9\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\fritzbox-usb-fernanschluss.exe[4320] C:\Windows\syswow64\WININET.dll!HttpSendRequestW 00000000774e7676 6 bytes [68, 30, 26, 4F, 00, C3]
.text C:\Users\user\AppData\Local\Apps\2.0\32WW39EP.APM\9NQMZ9EZ.4Y9\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\fritzbox-usb-fernanschluss.exe[4320] C:\Windows\syswow64\WININET.dll!HttpSendRequestA 00000000775b3456 6 bytes [68, 00, 28, 4F, 00, C3]
.text C:\Users\user\AppData\Local\Apps\2.0\32WW39EP.APM\9NQMZ9EZ.4Y9\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\fritzbox-usb-fernanschluss.exe[4320] C:\Windows\syswow64\WS2_32.dll!send 0000000076f06f01 6 bytes [68, C0, 36, 4F, 00, C3]
.text C:\Program Files (x86)\MySQL\MySQL Notifier 1.1.4\MySQLNotifier.exe[2700] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile 0000000077aafd98 4 bytes [68, 40, 1C, E4]
.text C:\Program Files (x86)\MySQL\MySQL Notifier 1.1.4\MySQLNotifier.exe[2700] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile + 5 0000000077aafd9d 1 byte [C3]
.text C:\Program Files (x86)\MySQL\MySQL Notifier 1.1.4\MySQLNotifier.exe[2700] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000077ab0068 4 bytes [68, 70, 21, E4]
.text C:\Program Files (x86)\MySQL\MySQL Notifier 1.1.4\MySQLNotifier.exe[2700] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread + 5 0000000077ab006d 1 byte [C3]
.text C:\Program Files (x86)\MySQL\MySQL Notifier 1.1.4\MySQLNotifier.exe[2700] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000077ab01c4 4 bytes [68, 70, 24, E4]
.text C:\Program Files (x86)\MySQL\MySQL Notifier 1.1.4\MySQLNotifier.exe[2700] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 5 0000000077ab01c9 1 byte [C3]
.text C:\Program Files (x86)\MySQL\MySQL Notifier 1.1.4\MySQLNotifier.exe[2700] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin 0000000077b2f8ea 7 bytes [68, 10, 24, E4, 00, C3, 7D]
.text C:\Program Files (x86)\MySQL\MySQL Notifier 1.1.4\MySQLNotifier.exe[2700] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\MySQL\MySQL Notifier 1.1.4\MySQLNotifier.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\MySQL\MySQL Notifier 1.1.4\MySQLNotifier.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\MySQL\MySQL Notifier 1.1.4\MySQLNotifier.exe[2700] C:\Windows\syswow64\WININET.dll!HttpSendRequestW 00000000774e7676 6 bytes [68, 30, 26, E4, 00, C3]
.text C:\Program Files (x86)\MySQL\MySQL Notifier 1.1.4\MySQLNotifier.exe[2700] C:\Windows\syswow64\WININET.dll!HttpSendRequestA 00000000775b3456 6 bytes [68, 00, 28, E4, 00, C3]
.text C:\Program Files (x86)\MySQL\MySQL Notifier 1.1.4\MySQLNotifier.exe[2700] C:\Windows\syswow64\WS2_32.dll!send 0000000076f06f01 6 bytes [68, C0, 36, E4, 00, C3]
.text C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[2172] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile 0000000077901600 6 bytes [48, B8, 60, 23, F1, 02]
.text C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[2172] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile + 8 0000000077901608 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[2172] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 00000000779017d0 6 bytes [48, B8, 40, 2B, F1, 02]
.text C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[2172] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread + 8 00000000779017d8 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[2172] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000779018b0 6 bytes [48, B8, B0, 2E, F1, 02]
.text C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[2172] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8 00000000779018b8 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[2172] C:\Windows\SYSTEM32\ntdll.dll!DbgUiRemoteBreakin + 1 00000000779a7f11 11 bytes {MOV EAX, 0x2f12e20; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[2172] C:\Windows\system32\WS2_32.dll!send + 1 000007fefdde8001 11 bytes {MOV EAX, 0x2f14490; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4296] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile 0000000077aafd98 4 bytes [68, 40, 1C, 63]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4296] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile + 5 0000000077aafd9d 1 byte [C3]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4296] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000077ab0068 4 bytes [68, 70, 21, 63]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4296] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread + 5 0000000077ab006d 1 byte [C3]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4296] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000077ab01c4 4 bytes [68, 70, 24, 63]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4296] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 5 0000000077ab01c9 1 byte [C3]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4296] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin 0000000077b2f8ea 7 bytes [68, 10, 24, 63, 00, C3, 7D]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4296] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile 0000000077aafd98 4 bytes [68, 40, 1C, 2F]
.text C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile + 5 0000000077aafd9d 1 byte [C3]
.text C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000077ab0068 4 bytes [68, 70, 21, 2F]
.text C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread + 5 0000000077ab006d 1 byte [C3]
.text C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000077ab01c4 4 bytes [68, 70, 24, 2F]
.text C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4672] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 5 0000000077ab01c9 1 byte [C3]
.text C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4672] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin 0000000077b2f8ea 7 bytes [68, 10, 24, 2F, 00, C3, 7D]
.text C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4672] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4672] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4672] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4672] C:\Windows\syswow64\WININET.dll!HttpSendRequestW 00000000774e7676 6 bytes [68, 30, 26, 2F, 00, C3]
.text C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4672] C:\Windows\syswow64\WININET.dll!HttpSendRequestA 00000000775b3456 6 bytes [68, 00, 28, 2F, 00, C3]
.text C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4752] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile 0000000077aafd98 6 bytes [68, 40, 1C, 68, 02, C3]
.text C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4752] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000077ab0068 6 bytes [68, 70, 21, 68, 02, C3]
.text C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4752] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000077ab01c4 6 bytes [68, 70, 24, 68, 02, C3]
.text C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4752] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin 0000000077b2f8ea 7 bytes [68, 10, 24, 68, 02, C3, 7D]
.text C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4752] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4752] C:\Windows\syswow64\WS2_32.dll!send 0000000076f06f01 6 bytes [68, C0, 36, 68, 02, C3]
.text C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4752] C:\Windows\syswow64\WININET.dll!HttpSendRequestW 00000000774e7676 6 bytes [68, 30, 26, 68, 02, C3]
.text C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4752] C:\Windows\syswow64\WININET.dll!HttpSendRequestA 00000000775b3456 6 bytes [68, 00, 28, 68, 02, C3]
.text C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4752] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4752] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\PDF24\pdf24.exe[4620] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile 0000000077aafd98 4 bytes [68, 40, 1C, 4A]
.text C:\Program Files (x86)\PDF24\pdf24.exe[4620] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile + 5 0000000077aafd9d 1 byte [C3]
.text C:\Program Files (x86)\PDF24\pdf24.exe[4620] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000077ab0068 4 bytes [68, 70, 21, 4A]
.text C:\Program Files (x86)\PDF24\pdf24.exe[4620] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread + 5 0000000077ab006d 1 byte [C3]
.text C:\Program Files (x86)\PDF24\pdf24.exe[4620] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000077ab01c4 4 bytes [68, 70, 24, 4A]
.text C:\Program Files (x86)\PDF24\pdf24.exe[4620] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 5 0000000077ab01c9 1 byte [C3]
.text C:\Program Files (x86)\PDF24\pdf24.exe[4620] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin 0000000077b2f8ea 7 bytes [68, 10, 24, 4A, 00, C3, 7D]
.text C:\Program Files (x86)\PDF24\pdf24.exe[4620] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\PDF24\pdf24.exe[4620] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\PDF24\pdf24.exe[4620] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Windows\SysWOW64\RunDll32.exe[5252] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile 0000000077aafd98 4 bytes [68, 40, 1C, 1E]
.text C:\Windows\SysWOW64\RunDll32.exe[5252] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile + 5 0000000077aafd9d 1 byte [C3]
.text C:\Windows\SysWOW64\RunDll32.exe[5252] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000077ab0068 4 bytes [68, 70, 21, 1E]
.text C:\Windows\SysWOW64\RunDll32.exe[5252] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread + 5 0000000077ab006d 1 byte [C3]
.text C:\Windows\SysWOW64\RunDll32.exe[5252] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000077ab01c4 4 bytes [68, 70, 24, 1E]
.text C:\Windows\SysWOW64\RunDll32.exe[5252] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 5 0000000077ab01c9 1 byte [C3]
.text C:\Windows\SysWOW64\RunDll32.exe[5252] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin 0000000077b2f8ea 7 bytes [68, 10, 24, 1E, 00, C3, 7D]
.text C:\Windows\SysWOW64\RunDll32.exe[5252] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Windows\SysWOW64\RunDll32.exe[5252] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Windows\SysWOW64\RunDll32.exe[5252] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5288] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile 0000000077901600 6 bytes [48, B8, 60, 23, D9, 07]
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5288] C:\Windows\SYSTEM32\ntdll.dll!NtQueryDirectoryFile + 8 0000000077901608 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5288] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 00000000779017d0 6 bytes [48, B8, 40, 2B, D9, 07]
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5288] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread + 8 00000000779017d8 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5288] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000779018b0 6 bytes [48, B8, B0, 2E, D9, 07]
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5288] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8 00000000779018b8 4 bytes {ADD [RAX], AL; JMP RAX}
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5288] C:\Windows\SYSTEM32\ntdll.dll!DbgUiRemoteBreakin + 1 00000000779a7f11 11 bytes {MOV EAX, 0x7d92e20; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5288] C:\Windows\system32\WS2_32.dll!send + 1 000007fefdde8001 11 bytes {MOV EAX, 0x7d94490; ADD [RAX], AL; ADD [RAX], AL; JMP RAX}
.text C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe[5348] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile 0000000077aafd98 6 bytes [68, 40, 1C, 0A, 06, C3]
.text C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe[5348] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000077ab0068 6 bytes [68, 70, 21, 0A, 06, C3]
.text C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe[5348] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000077ab01c4 6 bytes [68, 70, 24, 0A, 06, C3]
.text C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe[5348] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin 0000000077b2f8ea 7 bytes [68, 10, 24, 0A, 06, C3, 7D]
.text C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe[5348] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe[5348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe[5348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Users\user\AppData\Roaming\Dropbox\bin\Dropbox.exe[5348] C:\Windows\syswow64\WS2_32.dll!send 0000000076f06f01 6 bytes [68, C0, 36, 0A, 06, C3]
.text C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[5580] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile 0000000077aafd98 4 bytes [68, 40, 1C, 2A]
.text C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[5580] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile + 5 0000000077aafd9d 1 byte [C3]
.text C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[5580] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 0000000077ab0068 4 bytes [68, 70, 21, 2A]
.text C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[5580] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread + 5 0000000077ab006d 1 byte [C3]
.text C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[5580] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000077ab01c4 4 bytes [68, 70, 24, 2A]
.text C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[5580] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 5 0000000077ab01c9 1 byte [C3]
.text C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[5580] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin 0000000077b2f8ea 7 bytes [68, 10, 24, 2A, 00, C3, 7D]
.text C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[5580] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[5580] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[5580] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[7120] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[7120] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[7120] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6500] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6500] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6500] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6752] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6752] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6752] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
.text C:\Users\user\Downloads\gmer_2.1.19163.exe[1388] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 000000007740cfca 5 bytes JMP 0000000173707440
.text C:\Users\user\Downloads\gmer_2.1.19163.exe[1388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a61465 2 bytes [A6, 77]
.text C:\Users\user\Downloads\gmer_2.1.19163.exe[1388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a614bb 2 bytes [A6, 77]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\Dwm.exe [536:5388] 0000000002bf0000
Thread C:\Windows\system32\Dwm.exe [536:1652] 0000000002bf5470
Thread C:\Windows\Explorer.EXE [1364:5168] 00000000032e0000
Thread C:\Windows\Explorer.EXE [1364:5172] 00000000032e5470
Thread C:\Windows\Explorer.EXE [1364:5176] 00000000032e6840
Thread C:\Windows\Explorer.EXE [1364:5180] 00000000032e6630
Thread C:\Windows\system32\taskhost.exe [1672:4608] 0000000004940000
Thread C:\Windows\system32\taskhost.exe [1672:4808] 0000000004945470
Thread C:\Windows\system32\taskeng.exe [2088:4604] 0000000001ee0000
Thread C:\Windows\system32\taskeng.exe [2088:2228] 0000000001ee5470
Thread C:\Windows\SysWOW64\RunDll32.exe [5252:4180] 00000000001e0000
Thread C:\Windows\SysWOW64\RunDll32.exe [5252:3068] 00000000001e4430
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\18f46ae2c02b
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\90004eaab123
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\90004eaab123@502d1d2cfbda 0x84 0xD3 0x8D 0x39 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\18f46ae2c02b (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\90004eaab123 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\90004eaab123@502d1d2cfbda 0x84 0xD3 0x8D 0x39 ...
---- EOF - GMER 2.1 ----
|
So funktioniert es:
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
