Trojaner-Board - Windows 7: Laptop läuft langsam. Versteckte Malware?

Hallo,

ich habe hier den Laptop von einer Freundin. Sie sagt, dass er zu langsam ist, obwohl er eigentlich ganz neu ist. Ich vermute, dass viele unnütze Programme auf dem Computer installiert worden sind, zumal auch viele Leute diesen Laptop benutzen.
Es ist zwar noch nichts Dramatisches vorgefallen, aber ich wollte euch trotzdem bitten, ihn einmal auf Malware zu untersuchen. Man kann ja nie wissen...
Für eure Hilfe wäre ich euch sehr dankbar! :rolleyes:

Liebe Grüße,

Schahin

Die Log-Files kommen jetzt:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-04-2014 01

Ran by Recep (administrator) on RECEP-PC on 12-04-2014 17:58:12

Running from C:\Users\Recep\Desktop

Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 

The only official download link for FRST:

Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 

Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

() C:\Program Files\Google\Update\Install\{8DDEEFBF-1641-4AF3-B1C9-BD2254E0AB84}\34.0.1847.116_33.0.1750.154_chrome_updater.exe

(Google Inc.) C:\Windows\TEMP\CR_10CE1.tmp\setup.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10889832 2011-12-27] (Realtek Semiconductor)

HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-21] (Avira Operations GmbH & Co. KG)

HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [280576 2013-10-15] (Microsoft Corporation)

AppInit_DLLs: C:\PROGRA~1\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => C:\Program Files\SearchProtect\SearchProtect\bin\SPVC32Loader.dll [1050912 2014-03-03] (Conduit)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com/?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP332B59D3-6B44-4BBB-8084-D5798C5F08AD&SSPV=

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x4BF3E3079AB0CE01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

SearchScopes: HKLM - DefaultScope {A96AD802-91CB-406E-B0F6-0710CB218E2C} URL = hxxp://www.sm.de/?q={searchTerms}

SearchScopes: HKLM - {A96AD802-91CB-406E-B0F6-0710CB218E2C} URL = hxxp://www.sm.de/?q={searchTerms}

SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP332B59D3-6B44-4BBB-8084-D5798C5F08AD&q={searchTerms}&SSPV=

SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP332B59D3-6B44-4BBB-8084-D5798C5F08AD&q={searchTerms}&SSPV=

SearchScopes: HKCU - {A96AD802-91CB-406E-B0F6-0710CB218E2C} URL = hxxp://www.sm.de/?q={searchTerms}

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)

Winsock: Catalog9 19 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Recep\AppData\Roaming\Mozilla\Firefox\Profiles\lj9yzm5b.default

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Recep\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Adblock Plus - C:\Users\Recep\AppData\Roaming\Mozilla\Firefox\Profiles\lj9yzm5b.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-04-12]
 

Chrome: 

=======

CHR HomePage: hxxp://search.conduit.com/?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP332B59D3-6B44-4BBB-8084-D5798C5F08AD&SSPV=

CHR DefaultSearchKeyword: conduit.search

CHR DefaultSearchProvider: Conduit Search

CHR DefaultSearchURL: hxxp://search.conduit.com/Results.aspx?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP332B59D3-6B44-4BBB-8084-D5798C5F08AD&q={searchTerms}&SSPV=

CHR DefaultNewTabURL: 

CHR Extension: (Google Docs) - C:\Users\Recep\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-09-13]

CHR Extension: (Google Drive) - C:\Users\Recep\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-13]

CHR Extension: (YouTube) - C:\Users\Recep\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-09-13]

CHR Extension: (Google-Suche) - C:\Users\Recep\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-09-13]

CHR Extension: (Google Wallet) - C:\Users\Recep\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-13]

CHR Extension: (Google Mail) - C:\Users\Recep\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-09-13]
 

========================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)

S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-21] (Avira Operations GmbH & Co. KG)

S4 CltMngSvc; C:\Program Files\SearchProtect\Main\bin\CltMngSvc.exe [2454816 2014-03-03] (Conduit)

S3 cphs; C:\Windows\system32\IntelCpHeciSvc.exe [276248 2012-02-19] (Intel Corporation)
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)

R3 b57xdbd; C:\Windows\System32\DRIVERS\b57xdbd.sys [60968 2011-11-04] (Broadcom Corporation)

R3 b57xdmp; C:\Windows\System32\DRIVERS\b57xdmp.sys [17960 2011-11-04] (Broadcom Corporation)

R3 bScsiMSx; C:\Windows\System32\DRIVERS\bScsiMSx.sys [43560 2011-09-02] (Broadcom Corporation)

R3 bScsiSDx; C:\Windows\System32\DRIVERS\bScsiSDx.sys [47104 2012-05-03] (Broadcom Corporation)

R3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [55104 2012-07-17] (Intel Corporation)

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-09-27] (Avira GmbH)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-04-12 17:58 - 2014-04-12 17:58 - 00009135 _____ () C:\Users\Recep\Desktop\FRST.txt

2014-04-12 17:58 - 2014-04-12 17:58 - 00000000 ____D () C:\FRST

2014-04-12 17:56 - 2014-04-12 17:57 - 01145856 _____ (Farbar) C:\Users\Recep\Desktop\FRST.exe

2014-04-12 17:54 - 2014-04-12 17:54 - 00000472 _____ () C:\Users\Recep\Desktop\defogger_disable.log

2014-04-12 17:54 - 2014-04-12 17:54 - 00000000 _____ () C:\Users\Recep\defogger_reenable

2014-04-12 17:52 - 2014-04-12 17:52 - 00050477 _____ () C:\Users\Recep\Desktop\Defogger.exe

2014-04-12 17:48 - 2014-04-12 17:49 - 00000000 ____D () C:\Users\Recep\AppData\Roaming\Mozilla

2014-04-12 17:48 - 2014-04-12 17:49 - 00000000 ____D () C:\Users\Recep\AppData\Local\Mozilla

2014-04-12 17:47 - 2014-04-12 17:47 - 00001109 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-04-12 17:47 - 2014-04-12 17:47 - 00000000 ____D () C:\ProgramData\Mozilla

2014-04-12 17:47 - 2014-04-12 17:47 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2014-04-12 17:47 - 2014-04-12 17:47 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-04-12 17:29 - 2014-04-12 17:32 - 00000000 ____D () C:\Windows\system32\MRT

2014-03-23 19:23 - 2014-03-23 19:42 - 00000000 ____D () C:\Users\Recep\Desktop\Neuer Ordner

2014-03-15 13:47 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-03-15 13:47 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-03-15 13:47 - 2014-03-01 06:10 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-03-15 13:47 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-03-15 13:47 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-03-15 13:47 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-03-15 13:47 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-03-15 13:47 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-03-15 13:47 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-03-15 13:47 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-03-15 13:47 - 2014-03-01 05:38 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-03-15 13:47 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-03-15 13:47 - 2014-03-01 05:31 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-03-15 13:47 - 2014-03-01 05:25 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-03-15 13:47 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-03-15 13:47 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-03-15 13:47 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-03-15 13:47 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-03-15 13:47 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-03-15 13:47 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-03-15 13:47 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-03-15 13:47 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-03-14 21:07 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll

2014-03-14 21:06 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2014-03-14 21:00 - 2014-02-07 03:07 - 02349056 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-03-14 21:00 - 2014-01-28 04:07 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll

2014-03-14 20:59 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
 

==================== One Month Modified Files and Folders =======
 

2014-04-12 17:58 - 2014-04-12 17:58 - 00009135 _____ () C:\Users\Recep\Desktop\FRST.txt

2014-04-12 17:58 - 2014-04-12 17:58 - 00000000 ____D () C:\FRST

2014-04-12 17:57 - 2014-04-12 17:56 - 01145856 _____ (Farbar) C:\Users\Recep\Desktop\FRST.exe

2014-04-12 17:56 - 2013-09-13 18:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-04-12 17:54 - 2014-04-12 17:54 - 00000472 _____ () C:\Users\Recep\Desktop\defogger_disable.log

2014-04-12 17:54 - 2014-04-12 17:54 - 00000000 _____ () C:\Users\Recep\defogger_reenable

2014-04-12 17:54 - 2013-09-13 17:14 - 00000000 ____D () C:\Users\Recep

2014-04-12 17:53 - 2013-09-13 17:59 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-04-12 17:52 - 2014-04-12 17:52 - 00050477 _____ () C:\Users\Recep\Desktop\Defogger.exe

2014-04-12 17:49 - 2014-04-12 17:48 - 00000000 ____D () C:\Users\Recep\AppData\Roaming\Mozilla

2014-04-12 17:49 - 2014-04-12 17:48 - 00000000 ____D () C:\Users\Recep\AppData\Local\Mozilla

2014-04-12 17:47 - 2014-04-12 17:47 - 00001109 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-04-12 17:47 - 2014-04-12 17:47 - 00000000 ____D () C:\ProgramData\Mozilla

2014-04-12 17:47 - 2014-04-12 17:47 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2014-04-12 17:47 - 2014-04-12 17:47 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-04-12 17:45 - 2013-09-13 17:08 - 01908305 _____ () C:\Windows\WindowsUpdate.log

2014-04-12 17:32 - 2014-04-12 17:29 - 00000000 ____D () C:\Windows\system32\MRT

2014-04-12 17:32 - 2009-07-14 06:34 - 00019712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-04-12 17:32 - 2009-07-14 06:34 - 00019712 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-04-12 17:29 - 2013-09-13 17:19 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-04-12 17:23 - 2013-09-13 17:59 - 00001092 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-04-12 17:23 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-04-12 17:23 - 2009-07-14 06:39 - 00083964 _____ () C:\Windows\setupact.log

2014-04-05 14:31 - 2013-09-14 15:54 - 00000928 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1672892535-4115935350-2035100348-1000UA.job

2014-04-04 12:59 - 2013-09-14 15:54 - 00000906 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1672892535-4115935350-2035100348-1000Core.job

2014-03-23 19:42 - 2014-03-23 19:23 - 00000000 ____D () C:\Users\Recep\Desktop\Neuer Ordner

2014-03-15 13:21 - 2009-07-14 06:33 - 00268272 _____ () C:\Windows\system32\FNTCACHE.DAT
 

Some content of TEMP:

====================

C:\Users\Recep\AppData\Local\Temp\AskSLib.dll

C:\Users\Recep\AppData\Local\Temp\avgnt.exe

C:\Users\Recep\AppData\Local\Temp\install_flashplayer11x32ax_gtba_chra_dy_aaa_aih.exe

C:\Users\Recep\AppData\Local\Temp\nsd4A02.exe

C:\Users\Recep\AppData\Local\Temp\nsd8963.exe

C:\Users\Recep\AppData\Local\Temp\nsd8DA8.exe

C:\Users\Recep\AppData\Local\Temp\nsy46D6.exe

C:\Users\Recep\AppData\Local\Temp\PrefJsonCpp.exe

C:\Users\Recep\AppData\Local\Temp\SPSetup.exe

C:\Users\Recep\AppData\Local\Temp\sqlite3.exe

C:\Users\Recep\AppData\Local\Temp\utt18D4.tmp.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\system32\winlogon.exe => MD5 is legit

C:\Windows\system32\wininit.exe => MD5 is legit

C:\Windows\system32\svchost.exe => MD5 is legit

C:\Windows\system32\services.exe => MD5 is legit

C:\Windows\system32\User32.dll => MD5 is legit

C:\Windows\system32\userinit.exe => MD5 is legit

C:\Windows\system32\rpcss.dll => MD5 is legit

C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-12-11 20:34
 

==================== End Of Log ============================

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-04-2014 01

Ran by Recep at 2014-04-12 17:58:55

Running from C:\Users\Recep\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

µTorrent (HKCU\...\uTorrent) (Version: 3.3.2.30446 - BitTorrent Inc.)

Adobe Flash Player 12 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 12.0.0.70 - Adobe Systems Incorporated)

Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)

Broadcom Card Reader Driver Installer (HKLM\...\{4710662C-8204-4334-A977-B1AC9E547819}) (Version: 15.0.7.2 - Broadcom Corporation)

Broadcom NetLink Controller (HKLM\...\{C91DCB72-F5BB-410D-A91A-314F5D1B4284}) (Version: 15.0.7.1 - Broadcom Corporation)

Facebook Video Calling 2.0.0.447 (HKLM\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)

Google Chrome (HKLM\...\Google Chrome) (Version: 33.0.1750.154 - Google Inc.)

Google Update Helper (Version: 1.3.23.9 - Google Inc.) Hidden

Intel(R) OpenCL CPU Runtime (HKLM\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version:  - Intel Corporation)

Intel(R) Processor Graphics (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2653 - Intel Corporation)

Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Office Word Viewer 2003 (HKLM\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Mozilla Firefox 28.0 (x86 de) (HKLM\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)

Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)

Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6543 - Realtek Semiconductor Corp.)

Search Protect (HKLM\...\SearchProtect) (Version: 2.11.11.7 - Conduit) <==== ATTENTION

VLC media player 2.1.2 (HKLM\...\VLC media player) (Version: 2.1.2 - VideoLAN)
 

==================== Restore Points  =========================
 

11-03-2014 11:41:52 Windows Update

14-03-2014 18:46:40 Windows Update

15-03-2014 11:01:10 Windows Update

15-03-2014 14:37:21 Windows Update

18-03-2014 16:22:08 Windows Update

21-03-2014 17:52:54 Windows Update

26-03-2014 12:05:38 Windows Update

02-04-2014 11:54:28 Windows Update

12-04-2014 15:28:11 Windows Update
 

==================== Hosts content: ==========================
 

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {4760F1B8-D141-4AE4-89B1-EF10342FB605} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-27] (Adobe Systems Incorporated)

Task: {65F537DB-C1A6-46E7-B911-6D93FCF6AB51} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-09-13] (Google Inc.)

Task: {7E04538B-4AB5-45E0-935F-AE87626A3BBD} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1672892535-4115935350-2035100348-1000Core => C:\Users\Recep\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-09-14] (Facebook Inc.)

Task: {99BE2FD7-A777-4B27-9DE7-65D4A220020E} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1672892535-4115935350-2035100348-1000UA => C:\Users\Recep\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-09-14] (Facebook Inc.)

Task: {DF6A0846-E748-4CEC-A7BC-EDCC3BAA42E6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-09-13] (Google Inc.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1672892535-4115935350-2035100348-1000Core.job => C:\Users\Recep\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1672892535-4115935350-2035100348-1000UA.job => C:\Users\Recep\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-09-27 23:33 - 2013-09-27 23:27 - 00394824 _____ () C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll

2013-09-13 17:26 - 2012-02-14 09:53 - 00094208 _____ () C:\Windows\System32\IccLibDll.dll

2014-04-12 17:47 - 2014-03-15 10:40 - 03642480 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

2014-04-12 17:55 - 2014-04-08 19:02 - 08704216 _____ () C:\Program Files\Google\Update\Install\{8DDEEFBF-1641-4AF3-B1C9-BD2254E0AB84}\34.0.1847.116_33.0.1750.154_chrome_updater.exe
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Disabled items from MSCONFIG ==============
 

MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3

MSCONFIG\Services: CltMngSvc => 2

MSCONFIG\Services: gupdate => 2

MSCONFIG\Services: gupdatem => 3

MSCONFIG\Services: IEEtwCollectorService => 3

MSCONFIG\startupreg: Facebook Update => "C:\Users\Recep\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

MSCONFIG\startupreg: uTorrent => "C:\Users\Recep\AppData\Roaming\uTorrent\uTorrent.exe"  /MINIMIZED
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (03/07/2014 11:54:12 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: DllHost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc6b7

Name des fehlerhaften Moduls: igdumd32.dll, Version: 8.15.10.2653, Zeitstempel: 0x4f3aab9f

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0027d0d8

ID des fehlerhaften Prozesses: 0xb14

Startzeit der fehlerhaften Anwendung: 0xDllHost.exe0

Pfad der fehlerhaften Anwendung: DllHost.exe1

Pfad des fehlerhaften Moduls: DllHost.exe2

Berichtskennung: DllHost.exe3
 

Error: (03/07/2014 11:49:36 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: DllHost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc6b7

Name des fehlerhaften Moduls: igdumd32.dll, Version: 8.15.10.2653, Zeitstempel: 0x4f3aab9f

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0027d0d8

ID des fehlerhaften Prozesses: 0xdc4

Startzeit der fehlerhaften Anwendung: 0xDllHost.exe0

Pfad der fehlerhaften Anwendung: DllHost.exe1

Pfad des fehlerhaften Moduls: DllHost.exe2

Berichtskennung: DllHost.exe3
 

Error: (03/07/2014 11:45:10 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: DllHost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc6b7

Name des fehlerhaften Moduls: igdumd32.dll, Version: 8.15.10.2653, Zeitstempel: 0x4f3aab9f

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0027d0d8

ID des fehlerhaften Prozesses: 0xff4

Startzeit der fehlerhaften Anwendung: 0xDllHost.exe0

Pfad der fehlerhaften Anwendung: DllHost.exe1

Pfad des fehlerhaften Moduls: DllHost.exe2

Berichtskennung: DllHost.exe3
 

Error: (03/07/2014 11:35:49 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: DllHost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc6b7

Name des fehlerhaften Moduls: igdumd32.dll, Version: 8.15.10.2653, Zeitstempel: 0x4f3aab9f

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0027d0d8

ID des fehlerhaften Prozesses: 0xf20

Startzeit der fehlerhaften Anwendung: 0xDllHost.exe0

Pfad der fehlerhaften Anwendung: DllHost.exe1

Pfad des fehlerhaften Moduls: DllHost.exe2

Berichtskennung: DllHost.exe3
 

Error: (03/06/2014 10:42:39 PM) (Source: Application Hang) (User: )

Description: Programm FacebookVideoCalling.exe, Version 2.0.0.447 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 1518
 

Startzeit: 01cf397bc0b891d8
 

Endzeit: 29
 

Anwendungspfad: C:\Users\Recep\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe
 

Berichts-ID: 36fb048d-a56f-11e3-b352-b888e35c3cb4
 

Error: (03/04/2014 09:51:55 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 33.0.1750.117, Zeitstempel: 0x5305442b

Name des fehlerhaften Moduls: SPVC32Loader.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x52f38c73

Ausnahmecode: 0xc0000005

Fehleroffset: 0x7011272b

ID des fehlerhaften Prozesses: 0xeac

Startzeit der fehlerhaften Anwendung: 0xchrome.exe0

Pfad der fehlerhaften Anwendung: chrome.exe1

Pfad des fehlerhaften Moduls: chrome.exe2

Berichtskennung: chrome.exe3
 

Error: (02/28/2014 07:25:55 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 33.0.1750.117, Zeitstempel: 0x5305442b

Name des fehlerhaften Moduls: SPVC32Loader.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x52f38c73

Ausnahmecode: 0xc0000005

Fehleroffset: 0x6e87272b

ID des fehlerhaften Prozesses: 0x240

Startzeit der fehlerhaften Anwendung: 0xchrome.exe0

Pfad der fehlerhaften Anwendung: chrome.exe1

Pfad des fehlerhaften Moduls: chrome.exe2

Berichtskennung: chrome.exe3
 

Error: (02/28/2014 06:19:20 PM) (Source: .NET Runtime Optimization Service) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80070003
 

Error: (02/17/2014 04:59:49 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.10.20.64, Zeitstempel: 0x52f38d32

Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000

Ausnahmecode: 0xc0000005

Fehleroffset: 0x005895c0

ID des fehlerhaften Prozesses: 0xa1c

Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0

Pfad der fehlerhaften Anwendung: cltmngui.exe1

Pfad des fehlerhaften Moduls: cltmngui.exe2

Berichtskennung: cltmngui.exe3
 

Error: (02/03/2014 02:11:42 PM) (Source: Application Hang) (User: )

Description: Programm iexplore.exe, Version 11.0.9600.16428 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: f10
 

Startzeit: 01cf20d84f98ff54
 

Endzeit: 62
 

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe
 

Berichts-ID:
 
 

System errors:

=============

Error: (04/05/2014 02:32:12 PM) (Source: DCOM) (User: )

Description: {4EB61BAC-A3B6-4760-9581-655041EF4D69}
 

Error: (04/05/2014 02:31:42 PM) (Source: Service Control Manager) (User: )

Description: Dienst "Google Update-Dienst (gupdate)" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (03/27/2014 00:30:13 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Anwendungserfahrung" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1115
 

Error: (03/27/2014 00:30:13 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Enumeratordienst für tragbare Geräte" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1115
 

Error: (03/27/2014 00:30:13 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Netzwerkverbindungen" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1115
 

Error: (03/27/2014 00:30:13 AM) (Source: DCOM) (User: )

Description: 1115netman{BA126AD1-2166-11D1-B1D0-00805FC1270E}
 

Error: (03/27/2014 00:30:13 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Diagnosediensthost" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1069
 

Error: (03/27/2014 00:30:13 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "WdiServiceHost" konnte sich nicht als "NT AUTHORITY\LocalService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 

%%50
 

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
 

Error: (03/27/2014 00:30:13 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Netzwerklistendienst" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1069
 

Error: (03/27/2014 00:30:13 AM) (Source: Service Control Manager) (User: )

Description: Der Dienst "netprofm" konnte sich nicht als "NT AUTHORITY\LocalService" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 

%%1352
 

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
 
 

Microsoft Office Sessions:

=========================

Error: (03/07/2014 11:54:12 PM) (Source: Application Error)(User: )

Description: DllHost.exe6.1.7600.163854a5bc6b7igdumd32.dll8.15.10.26534f3aab9fc00000050027d0d8b1401cf3a4f29d3d420C:\Windows\system32\DllHost.exeC:\Windows\system32\igdumd32.dll03f52d08-a643-11e3-b2f1-b888e35c3cb4
 

Error: (03/07/2014 11:49:36 PM) (Source: Application Error)(User: )

Description: DllHost.exe6.1.7600.163854a5bc6b7igdumd32.dll8.15.10.26534f3aab9fc00000050027d0d8dc401cf3a4e89920f8eC:\Windows\system32\DllHost.exeC:\Windows\system32\igdumd32.dll5f6971d2-a642-11e3-b2f1-b888e35c3cb4
 

Error: (03/07/2014 11:45:10 PM) (Source: Application Error)(User: )

Description: DllHost.exe6.1.7600.163854a5bc6b7igdumd32.dll8.15.10.26534f3aab9fc00000050027d0d8ff401cf3a4e638f162dC:\Windows\system32\DllHost.exeC:\Windows\system32\igdumd32.dllc0ddaa72-a641-11e3-b2f1-b888e35c3cb4
 

Error: (03/07/2014 11:35:49 PM) (Source: Application Error)(User: )

Description: DllHost.exe6.1.7600.163854a5bc6b7igdumd32.dll8.15.10.26534f3aab9fc00000050027d0d8f2001cf3a4d33346615C:\Windows\system32\DllHost.exeC:\Windows\system32\igdumd32.dll72c4284d-a640-11e3-b2f1-b888e35c3cb4
 

Error: (03/06/2014 10:42:39 PM) (Source: Application Hang)(User: )

Description: FacebookVideoCalling.exe2.0.0.447151801cf397bc0b891d829C:\Users\Recep\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe36fb048d-a56f-11e3-b352-b888e35c3cb4
 

Error: (03/04/2014 09:51:55 PM) (Source: Application Error)(User: )

Description: chrome.exe33.0.1750.1175305442bSPVC32Loader.dll_unloaded0.0.0.052f38c73c00000057011272beac01cf37e26c4df824C:\Program Files\Google\Chrome\Application\chrome.exeSPVC32Loader.dll6f9e9375-a3d6-11e3-b3d1-b888e35c3cb4
 

Error: (02/28/2014 07:25:55 PM) (Source: Application Error)(User: )

Description: chrome.exe33.0.1750.1175305442bSPVC32Loader.dll_unloaded0.0.0.052f38c73c00000056e87272b24001cf34a968e85626C:\Program Files\Google\Chrome\Application\chrome.exeSPVC32Loader.dll60a02d0f-a09d-11e3-b303-b888e35c3cb4
 

Error: (02/28/2014 06:19:20 PM) (Source: .NET Runtime Optimization Service)(User: )

Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80070003 

mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
 

Error: (02/17/2014 04:59:49 PM) (Source: Application Error)(User: )

Description: cltmngui.exe2.10.20.6452f38d32unknown0.0.0.000000000c0000005005895c0a1c01cf2bf0c32782e1C:\PROGRA~1\SearchProtect\UI\bin\cltmngui.exeunknown2570c159-97e4-11e3-b34f-b888e35c3cb4
 

Error: (02/03/2014 02:11:42 PM) (Source: Application Hang)(User: )

Description: iexplore.exe11.0.9600.16428f1001cf20d84f98ff5462C:\Program Files\Internet Explorer\iexplore.exe
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 47%

Total physical RAM: 2642.36 MB

Available physical RAM: 1374.63 MB

Total Pagefile: 5283.01 MB

Available Pagefile: 3923.29 MB

Total Virtual: 2047.88 MB

Available Virtual: 1910.32 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:149.05 GB) (Free:107.74 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149 GB) (Disk ID: 98CD3C36)

Partition 1: (Active) - (Size=149 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Code:

GMER 2.1.19357 - hxxp://www.gmer.net

Rootkit scan 2014-04-12 18:30:38

Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_MK1646GSX rev.LB114C 149,05GB

Running: Gmer-19357.exe; Driver: C:\Users\Recep\AppData\Local\Temp\uglorpow.sys
 
 

---- System - GMER 2.1 ----
 

SSDT   93C539D6                                  ZwCreateSection

SSDT   93C539E0                                  ZwRequestWaitReplyPort

SSDT   93C539DB                                  ZwSetContextThread

SSDT   93C539E5                                  ZwSetSecurityObject

SSDT   93C539EA                                  ZwSystemDebugControl

SSDT   93C53977                                  ZwTerminateProcess
 

---- Kernel code sections - GMER 2.1 ----
 

.text  ntkrnlpa.exe!ZwRollbackEnlistment + 142D  82C5BA15 1 Byte  [06]

.text  ntkrnlpa.exe!KiDispatchInterrupt + 5A2    82C95212 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

.text  ntkrnlpa.exe!KeRemoveQueueEx + 11F7       82C9C58C 4 Bytes  [D6, 39, C5, 93] {SALC ; CMP EBP, EAX; XCHG EBX, EAX}

.text  ntkrnlpa.exe!KeRemoveQueueEx + 1553       82C9C8E8 4 Bytes  [E0, 39, C5, 93]

.text  ntkrnlpa.exe!KeRemoveQueueEx + 1597       82C9C92C 4 Bytes  [DB, 39, C5, 93]

.text  ntkrnlpa.exe!KeRemoveQueueEx + 1613       82C9C9A8 4 Bytes  [E5, 39, C5, 93]

.text  ntkrnlpa.exe!KeRemoveQueueEx + 1667       82C9C9FC 4 Bytes  JMP B793C539 

.text  ...                                       
 

---- EOF - GMER 2.1 ----