| gerchla1 | 31.03.2015 14:00 |
GMER.txt
Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-03-31 13:50:18
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AC1 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\MB\AppData\Local\Temp\pxldypoc.sys
---- User code sections - GMER 2.1 ----
.text C:\windows\system32\wininit.exe[616] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007751ef8d 1 byte [62]
.text C:\windows\system32\services.exe[692] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007751ef8d 1 byte [62]
.text C:\windows\system32\winlogon.exe[768] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007751ef8d 1 byte [62]
.text C:\windows\system32\nvvsvc.exe[952] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007751ef8d 1 byte [62]
.text C:\windows\system32\svchost.exe[992] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007751ef8d 1 byte [62]
.text C:\windows\System32\svchost.exe[448] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007751ef8d 1 byte [62]
.text C:\windows\system32\svchost.exe[544] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007751ef8d 1 byte [62]
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076cd1401 2 bytes JMP 755ab21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076cd1419 2 bytes JMP 755ab346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076cd1431 2 bytes JMP 75628ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076cd144a 2 bytes CALL 755848ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076cd14dd 2 bytes JMP 756287a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076cd14f5 2 bytes JMP 75628978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076cd150d 2 bytes JMP 75628698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076cd1525 2 bytes JMP 75628a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076cd153d 2 bytes JMP 7559fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076cd1555 2 bytes JMP 755a68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076cd156d 2 bytes JMP 75628f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076cd1585 2 bytes JMP 75628ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076cd159d 2 bytes JMP 7562865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076cd15b5 2 bytes JMP 7559fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076cd15cd 2 bytes JMP 755ab2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076cd16b2 2 bytes JMP 75628e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\PC Beschleunigen\PCSUService.exe[1140] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076cd16bd 2 bytes JMP 756285f1 C:\windows\syswow64\kernel32.dll
.text C:\windows\system32\nvvsvc.exe[1228] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007751ef8d 1 byte [62]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1820] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1820] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1820] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076cd1401 2 bytes JMP 755ab21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076cd1419 2 bytes JMP 755ab346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076cd1431 2 bytes JMP 75628ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076cd144a 2 bytes CALL 755848ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076cd14dd 2 bytes JMP 756287a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076cd14f5 2 bytes JMP 75628978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076cd150d 2 bytes JMP 75628698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076cd1525 2 bytes JMP 75628a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076cd153d 2 bytes JMP 7559fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076cd1555 2 bytes JMP 755a68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076cd156d 2 bytes JMP 75628f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076cd1585 2 bytes JMP 75628ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076cd159d 2 bytes JMP 7562865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076cd15b5 2 bytes JMP 7559fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076cd15cd 2 bytes JMP 755ab2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076cd16b2 2 bytes JMP 75628e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076cd16bd 2 bytes JMP 756285f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1912] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2000] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2000] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe[2032] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe[2032] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe[2032] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\windows\SysWOW64\Rezip.exe[2112] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\windows\SysWOW64\Rezip.exe[2112] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\windows\SysWOW64\Rezip.exe[2112] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[2144] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[2144] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[2144] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076cd1401 2 bytes JMP 755ab21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076cd1419 2 bytes JMP 755ab346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076cd1431 2 bytes JMP 75628ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076cd144a 2 bytes CALL 755848ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076cd14dd 2 bytes JMP 756287a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076cd14f5 2 bytes JMP 75628978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076cd150d 2 bytes JMP 75628698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076cd1525 2 bytes JMP 75628a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076cd153d 2 bytes JMP 7559fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076cd1555 2 bytes JMP 755a68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076cd156d 2 bytes JMP 75628f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076cd1585 2 bytes JMP 75628ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076cd159d 2 bytes JMP 7562865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076cd15b5 2 bytes JMP 7559fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076cd15cd 2 bytes JMP 755ab2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076cd16b2 2 bytes JMP 75628e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2436] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076cd16bd 2 bytes JMP 756285f1 C:\windows\syswow64\kernel32.dll
? C:\windows\system32\mssprxy.dll [2436] entry point in ".rdata" section 00000000740d71e6
.text C:\windows\Explorer.EXE[2452] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007751ef8d 1 byte [62]
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[2916] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[2916] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[2916] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076cd1401 2 bytes JMP 755ab21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076cd1419 2 bytes JMP 755ab346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076cd1431 2 bytes JMP 75628ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076cd144a 2 bytes CALL 755848ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076cd14dd 2 bytes JMP 756287a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076cd14f5 2 bytes JMP 75628978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076cd150d 2 bytes JMP 75628698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076cd1525 2 bytes JMP 75628a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076cd153d 2 bytes JMP 7559fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076cd1555 2 bytes JMP 755a68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076cd156d 2 bytes JMP 75628f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076cd1585 2 bytes JMP 75628ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076cd159d 2 bytes JMP 7562865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076cd15b5 2 bytes JMP 7559fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076cd15cd 2 bytes JMP 755ab2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076cd16b2 2 bytes JMP 75628e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[3044] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076cd16bd 2 bytes JMP 756285f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2296] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2296] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2296] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
? C:\windows\system32\mssprxy.dll [2296] entry point in ".rdata" section 00000000740d71e6
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076cd1401 2 bytes JMP 755ab21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076cd1419 2 bytes JMP 755ab346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076cd1431 2 bytes JMP 75628ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076cd144a 2 bytes CALL 755848ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076cd14dd 2 bytes JMP 756287a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076cd14f5 2 bytes JMP 75628978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076cd150d 2 bytes JMP 75628698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076cd1525 2 bytes JMP 75628a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076cd153d 2 bytes JMP 7559fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076cd1555 2 bytes JMP 755a68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076cd156d 2 bytes JMP 75628f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076cd1585 2 bytes JMP 75628ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076cd159d 2 bytes JMP 7562865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076cd15b5 2 bytes JMP 7559fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076cd15cd 2 bytes JMP 755ab2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076cd16b2 2 bytes JMP 75628e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3692] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076cd16bd 2 bytes JMP 756285f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe[4032] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\windows\System32\rundll32.exe[4064] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007751ef8d 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4824] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007751ef8d 1 byte [62]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4836] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007751ef8d 1 byte [62]
.text C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[4356] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[4356] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[4356] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076cd1401 2 bytes JMP 755ab21b C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076cd1419 2 bytes JMP 755ab346 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076cd1431 2 bytes JMP 75628ea9 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076cd144a 2 bytes CALL 755848ad C:\windows\syswow64\KERNEL32.dll
.text ... * 9
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076cd14dd 2 bytes JMP 756287a2 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076cd14f5 2 bytes JMP 75628978 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076cd150d 2 bytes JMP 75628698 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076cd1525 2 bytes JMP 75628a62 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076cd153d 2 bytes JMP 7559fca8 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076cd1555 2 bytes JMP 755a68ef C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076cd156d 2 bytes JMP 75628f61 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076cd1585 2 bytes JMP 75628ac2 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076cd159d 2 bytes JMP 7562865c C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076cd15b5 2 bytes JMP 7559fd41 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076cd15cd 2 bytes JMP 755ab2dc C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076cd16b2 2 bytes JMP 75628e24 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Samsung\Kies\Kies.exe[4860] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076cd16bd 2 bytes JMP 756285f1 C:\windows\syswow64\KERNEL32.dll
.text C:\windows\system32\RunDll32.exe[4880] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007751ef8d 1 byte [62]
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[3032] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[3032] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[3032] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[1896] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[1896] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[1896] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe[4700] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe[4700] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe[4700] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076cd1401 2 bytes JMP 755ab21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076cd1419 2 bytes JMP 755ab346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076cd1431 2 bytes JMP 75628ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076cd144a 2 bytes CALL 755848ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076cd14dd 2 bytes JMP 756287a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076cd14f5 2 bytes JMP 75628978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076cd150d 2 bytes JMP 75628698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076cd1525 2 bytes JMP 75628a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076cd153d 2 bytes JMP 7559fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076cd1555 2 bytes JMP 755a68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076cd156d 2 bytes JMP 75628f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076cd1585 2 bytes JMP 75628ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076cd159d 2 bytes JMP 7562865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076cd15b5 2 bytes JMP 7559fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076cd15cd 2 bytes JMP 755ab2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076cd16b2 2 bytes JMP 75628e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2848] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076cd16bd 2 bytes JMP 756285f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4444] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007751ef8d 1 byte [62]
.text C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4672] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4672] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4672] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\Nuance\PDF Viewer Plus\PdfPro7Hook.exe[1580] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\Nuance\PDF Viewer Plus\PdfPro7Hook.exe[1580] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Nuance\PDF Viewer Plus\PdfPro7Hook.exe[1580] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[2968] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[2968] C:\windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075588791 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[2968] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076cd1401 2 bytes JMP 755ab21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076cd1419 2 bytes JMP 755ab346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076cd1431 2 bytes JMP 75628ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076cd144a 2 bytes CALL 755848ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076cd14dd 2 bytes JMP 756287a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076cd14f5 2 bytes JMP 75628978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076cd150d 2 bytes JMP 75628698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076cd1525 2 bytes JMP 75628a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076cd153d 2 bytes JMP 7559fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076cd1555 2 bytes JMP 755a68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076cd156d 2 bytes JMP 75628f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076cd1585 2 bytes JMP 75628ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076cd159d 2 bytes JMP 7562865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076cd15b5 2 bytes JMP 7559fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076cd15cd 2 bytes JMP 755ab2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076cd16b2 2 bytes JMP 75628e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[5140] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076cd16bd 2 bytes JMP 756285f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5184] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5184] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5184] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[5204] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[5204] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[5204] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe[5212] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe[5212] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe[5212] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076cd1401 2 bytes JMP 755ab21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076cd1419 2 bytes JMP 755ab346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076cd1431 2 bytes JMP 75628ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076cd144a 2 bytes CALL 755848ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076cd14dd 2 bytes JMP 756287a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076cd14f5 2 bytes JMP 75628978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076cd150d 2 bytes JMP 75628698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076cd1525 2 bytes JMP 75628a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076cd153d 2 bytes JMP 7559fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076cd1555 2 bytes JMP 755a68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076cd156d 2 bytes JMP 75628f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076cd1585 2 bytes JMP 75628ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076cd159d 2 bytes JMP 7562865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076cd15b5 2 bytes JMP 7559fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076cd15cd 2 bytes JMP 755ab2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076cd16b2 2 bytes JMP 75628e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[5248] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076cd16bd 2 bytes JMP 756285f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076cd1401 2 bytes JMP 755ab21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076cd1419 2 bytes JMP 755ab346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076cd1431 2 bytes JMP 75628ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076cd144a 2 bytes CALL 755848ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076cd14dd 2 bytes JMP 756287a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076cd14f5 2 bytes JMP 75628978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076cd150d 2 bytes JMP 75628698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076cd1525 2 bytes JMP 75628a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076cd153d 2 bytes JMP 7559fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076cd1555 2 bytes JMP 755a68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076cd156d 2 bytes JMP 75628f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076cd1585 2 bytes JMP 75628ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076cd159d 2 bytes JMP 7562865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076cd15b5 2 bytes JMP 7559fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076cd15cd 2 bytes JMP 755ab2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076cd16b2 2 bytes JMP 75628e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076cd16bd 2 bytes JMP 756285f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[5348] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\windows\System32\svchost.exe[2328] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007751ef8d 1 byte [62]
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000076cd1401 2 bytes JMP 755ab21b C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000076cd1419 2 bytes JMP 755ab346 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000076cd1431 2 bytes JMP 75628ea9 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\syswow64\psapi.dll!GetModuleInformation + 42 0000000076cd144a 2 bytes CALL 755848ad C:\windows\syswow64\KERNEL32.dll
.text ... * 9
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 0000000076cd14dd 2 bytes JMP 756287a2 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 0000000076cd14f5 2 bytes JMP 75628978 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 0000000076cd150d 2 bytes JMP 75628698 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000076cd1525 2 bytes JMP 75628a62 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 0000000076cd153d 2 bytes JMP 7559fca8 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\syswow64\psapi.dll!EnumProcesses + 17 0000000076cd1555 2 bytes JMP 755a68ef C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 0000000076cd156d 2 bytes JMP 75628f61 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000076cd1585 2 bytes JMP 75628ac2 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\syswow64\psapi.dll!QueryWorkingSet + 17 0000000076cd159d 2 bytes JMP 7562865c C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 0000000076cd15b5 2 bytes JMP 7559fd41 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 0000000076cd15cd 2 bytes JMP 755ab2dc C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 0000000076cd16b2 2 bytes JMP 75628e24 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[4384] C:\windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 0000000076cd16bd 2 bytes JMP 756285f1 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076cd1401 2 bytes JMP 755ab21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076cd1419 2 bytes JMP 755ab346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076cd1431 2 bytes JMP 75628ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076cd144a 2 bytes CALL 755848ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076cd14dd 2 bytes JMP 756287a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076cd14f5 2 bytes JMP 75628978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076cd150d 2 bytes JMP 75628698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076cd1525 2 bytes JMP 75628a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076cd153d 2 bytes JMP 7559fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076cd1555 2 bytes JMP 755a68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076cd156d 2 bytes JMP 75628f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076cd1585 2 bytes JMP 75628ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076cd159d 2 bytes JMP 7562865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076cd15b5 2 bytes JMP 7559fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076cd15cd 2 bytes JMP 755ab2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076cd16b2 2 bytes JMP 75628e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[5092] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076cd16bd 2 bytes JMP 756285f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076cd1401 2 bytes JMP 755ab21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076cd1419 2 bytes JMP 755ab346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076cd1431 2 bytes JMP 75628ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076cd144a 2 bytes CALL 755848ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076cd14dd 2 bytes JMP 756287a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076cd14f5 2 bytes JMP 75628978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076cd150d 2 bytes JMP 75628698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076cd1525 2 bytes JMP 75628a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076cd153d 2 bytes JMP 7559fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076cd1555 2 bytes JMP 755a68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076cd156d 2 bytes JMP 75628f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076cd1585 2 bytes JMP 75628ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076cd159d 2 bytes JMP 7562865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076cd15b5 2 bytes JMP 7559fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076cd15cd 2 bytes JMP 755ab2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076cd16b2 2 bytes JMP 75628e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3404] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076cd16bd 2 bytes JMP 756285f1 C:\windows\syswow64\kernel32.dll
.text C:\Users\MB\Desktop\Gmer-19357.exe[3176] C:\windows\SysWOW64\ntdll.dll!LdrQueryImageFileExecutionOptionsEx 00000000779210f9 5 bytes JMP 000000007efa0000
.text C:\Users\MB\Desktop\Gmer-19357.exe[3176] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000755aa2fd 1 byte [62]
.text C:\Users\MB\Desktop\Gmer-19357.exe[3176] C:\windows\syswow64\SHELL32.dll!ShellExecuteExW 0000000075bd1e06 5 bytes JMP 000000007ef90000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b654eb87
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b654edff
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b654f56e
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b654f652
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b66b6864
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b66b6982
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b654eb87 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b654edff (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b654f56e (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b654f652 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b66b6864 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b66b6982 (not active ControlSet)
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlauf Datum: 30.03.2015
Suchlauf-Zeit: 15:58:41
Logdatei: Maleware_Logfile_30032015.txt
Administrator: Ja
Version: 2.00.4.1028
Malware Datenbank: v2015.03.30.05
Rootkit Datenbank: v2015.03.26.01
Lizenz: Testversion
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert
Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: MB
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 361982
Verstrichene Zeit: 15 Min, 57 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Warnen
PUM: Aktiviert
Prozesse: 0
(Keine schädliche Elemente erkannt)
Module: 0
(Keine schädliche Elemente erkannt)
Registrierungsschlüssel: 11
PUP.Optional.Babylon.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}, , [4865a9a2d6b4cb6bcad3e448e3209f61],
PUP.Optional.Babylon.A, HKU\S-1-5-21-1125036280-3562319748-3601731155-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}, , [4865a9a2d6b4cb6bcad3e448e3209f61],
PUP.Optional.Claro.A, HKU\S-1-5-21-1125036280-3562319748-3601731155-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{9E131A93-EED7-4BEB-B015-A0ADB30B5646}, , [0aa33e0d11793cfa140c43e8758eab55],
PUP.Optional.Incredibar.A, HKLM\SOFTWARE\IB Updater, , [9e0fda710e7ca591270f8b6c82818a76],
PUP.Optional.SpeedChecker.A, HKLM\SOFTWARE\Speedchecker Limited, , [b1fc54f70a809d99c6bc2e9b7b88758b],
PUP.Optional.Incredibar.A, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\dlnembnfbcpjnepmfjmngjenhhajpdfd, , [1499a7a408828ea875c0d2255fa4cd33],
PUP.Optional.DataMangr.A, HKLM\SOFTWARE\WOW6432NODE\DataMngr, , [723bf358e0aa9b9bf52aeb02f40f7a86],
PUP.Optional.Incredibar.A, HKLM\SOFTWARE\WOW6432NODE\IB Updater, , [beefa0ab5a3084b20d298374f40f6d93],
PUP.Optional.Incredibar.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\dlnembnfbcpjnepmfjmngjenhhajpdfd, , [c3eab5968901231386affbfc8b7811ef],
PUP.Optional.ConduitSearch.A, HKU\S-1-5-21-1125036280-3562319748-3601731155-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Conduit_Search_Protect, , [9716e76486040e282c508e349b684eb2],
PUP.Optional.DataMngr.A, HKU\S-1-5-21-1125036280-3562319748-3601731155-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr, , [01ac5af115752a0c01df819d6c99c33d],
Registrierungswerte: 8
PUP.Optional.Claro.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{9E131A93-EED7-4BEB-B015-A0ADB30B5646}, Claro LTD Toolbar, , [0aa33e0d11793cfa140c43e8758eab55]
PUP.Optional.Claro.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{9E131A93-EED7-4BEB-B015-A0ADB30B5646}, , [b8f5f9527d0dd46278a843e88f74a45c],
PUP.Optional.StartPage.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS\{336D0C35-8A85-403a-B9D2-65C292C39087}, , [78352e1d4f3ba78f053b2507cd363dc3],
PUP.Optional.StartPage.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{336D0C35-8A85-403A-B9D2-65C292C39087}, C:\Program Files\IB Updater\Firefox, , [78352e1d4f3ba78f053b2507cd363dc3]
PUP.Optional.StartPage.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|{336D0C35-8A85-403A-B9D2-65C292C39087}, C:\Program Files\IB Updater\Firefox, , [78352e1d4f3ba78f053b2507cd363dc3]
PUP.Optional.StartPage.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS\{336D0C35-8A85-403a-B9D2-65C292C39087}, , [f9b4d07b1377b68063dd0e1eb152d927],
PUP.BProtector, HKU\S-1-5-21-1125036280-3562319748-3601731155-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|bProtector Start Page, hxxp://www.claro-search.com/?affID=114508&tt=4112_7&babsrc=HP_clro&mntrId=80f6a4bc00000000000090004e43e858, , [961796b5820883b3548dba64c3426f91]
PUP.BProtector, HKU\S-1-5-21-1125036280-3562319748-3601731155-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|bProtectorDefaultScope, {0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}, , [cfdebb9071199a9c0cd6ac7225e06799]
Registrierungsdaten: 2
PUP.Optional.Conduit.A, HKU\S-1-5-21-1125036280-3562319748-3601731155-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://search.conduit.com/?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M3C7F9957-B7F5-4DF2-AC95-E4D8FCD6477C&SearchSource=55&CUI=&UM=5&UP=SPCE6FD9A2-8FB2-4E0A-8789-0E768093C3E1&SSPV=, Gut: (www.google.com), Schlecht: (hxxp://search.conduit.com/?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M3C7F9957-B7F5-4DF2-AC95-E4D8FCD6477C&SearchSource=55&CUI=&UM=5&UP=SPCE6FD9A2-8FB2-4E0A-8789-0E768093C3E1&SSPV=),,[496467e45733072ff8d20ee1f90c0ef2]
PUP.Optional.Claro.A, HKU\S-1-5-21-1125036280-3562319748-3601731155-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|bProtector Start Page, hxxp://www.claro-search.com/?affID=114508&tt=4112_7&babsrc=HP_clro&mntrId=80f6a4bc00000000000090004e43e858, Gut: (www.google.com), Schlecht: (hxxp://www.claro-search.com/?affID=114508&tt=4112_7&babsrc=HP_clro&mntrId=80f6a4bc00000000000090004e43e858),,[eac305468bffe2542a334aa414f16c94]
Ordner: 7
PUP.Optional.OpenCandy, C:\Users\MB\AppData\Roaming\OpenCandy, , [56573f0c4e3cd5613905403ab64dc838],
PUP.Optional.OpenCandy, C:\Users\MB\AppData\Roaming\OpenCandy\C2FE8EDC6D9D437A8E97C31F345647EC, , [56573f0c4e3cd5613905403ab64dc838],
PUP.Optional.OpenCandy, C:\Users\MB\AppData\Roaming\OpenCandy\DF4086E27EB14832AFFE2CA7BE1E2654, , [56573f0c4e3cd5613905403ab64dc838],
PUP.Optional.OpenCandy, C:\Users\MB\AppData\Roaming\OpenCandy\OpenCandy_C2FE8EDC6D9D437A8E97C31F345647EC, , [56573f0c4e3cd5613905403ab64dc838],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.587.187, , [affea2a9711945f11fae9b0e10f33dc3],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.587.187\{61d8b74e-8d89-46ff-afa6-33382c54ac73}, , [affea2a9711945f11fae9b0e10f33dc3],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.587.187\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\traking_settings, , [affea2a9711945f11fae9b0e10f33dc3],
Dateien: 76
PUP.Optional.Conduit.A, C:\Users\MB\AppData\Roaming\OpenCandy\DF4086E27EB14832AFFE2CA7BE1E2654\search_protect_global.exe, , [b8f5202bf892cd690493d673fa0746ba],
PUP.Optional.Softonic.A, C:\Users\MB\Downloads\SoftonicDownloader_fuer_win-lohninfo.exe, , [98150c3f8dfd93a38994d677e61bd030],
PUP.Optional.Somoto.A, C:\Users\MB\Downloads\VLCMediaPlayerSetup.exe, , [6a434a01b0da3ff7b3e1ff394eb2e917],
PUP.MailPassView, C:\Users\MB\Downloads\pstpassword_setup1.6.exe, , [cedf1f2c484288ae75b27c20a7594db3],
PUP.Optional.Somoto, C:\Users\MB\Downloads\Captureit_downloader_by_SchriftartenFontsde.exe, , [397469e2d9b144f2a318db434bbb4fb1],
PUP.Optional.BProtector.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\bProtector_extensions.sqlite, , [3f6e34176e1c1f171b78e41a649fa55b],
PUP.Optional.BProtector.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\bprotector_prefs.js, , [6746f05b77131c1ad7bdb648f40fd42c],
PUP.Optional.BProtector.A, C:\Users\MB\AppData\Local\Google\Chrome\User Data\Default\bProtector Web Data, , [00adcf7c87033afc57d0091942c324dc],
PUP.Optional.BProtector.A, C:\Users\MB\AppData\Local\Google\Chrome\User Data\Default\bProtectorPreferences, , [e7c67ccfd4b6ea4c95933ee4f1147789],
PUP.Optional.OpenCandy, C:\Users\MB\AppData\Roaming\OpenCandy\C2FE8EDC6D9D437A8E97C31F345647EC\pcspeedup_oc.exe, , [56573f0c4e3cd5613905403ab64dc838],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.587.187\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\traking_settings\00, , [affea2a9711945f11fae9b0e10f33dc3],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.587.187\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\traking_settings\01, , [affea2a9711945f11fae9b0e10f33dc3],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.587.187\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\traking_settings\02, , [affea2a9711945f11fae9b0e10f33dc3],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.587.187\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\traking_settings\10, , [affea2a9711945f11fae9b0e10f33dc3],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.587.187\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\traking_settings\11, , [affea2a9711945f11fae9b0e10f33dc3],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.587.187\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\traking_settings\12, , [affea2a9711945f11fae9b0e10f33dc3],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.587.187\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\traking_settings\20, , [affea2a9711945f11fae9b0e10f33dc3],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.587.187\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\traking_settings\21, , [affea2a9711945f11fae9b0e10f33dc3],
PUP.Optional.BrowserManager.A, C:\ProgramData\Browser Manager\2.2.587.187\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\traking_settings\22, , [affea2a9711945f11fae9b0e10f33dc3],
PUP.Optional.Claro.A, C:\Users\MB\AppData\Local\Google\Chrome\User Data\Default\Preferences, Gut: (), Schlecht: ( "homepage": "hxxp://www.claro-search.com/?affID=114508&tt=4112_7&babsrc=HP_clro&mntrId=80f6a4bc00000000000090004e43e858",), ,[c0ed1c2f6624d85e4a517abb3fc722de]
PUP.Optional.Babylon.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.BabylonToolbar_i.newTab", true);), ,[bcf1123985052f0755e9ed4a877f7a86]
PUP.Optional.Babylon.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (rences
/* Do not edit this file.
*
* If you make changes t), ,[a4090b40d5b57cba50ee96a10ff76e92]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.admin", false);), ,[09a4da71ee9c2e082d19999e36d08c74]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (ferences
/* Do not edit this file.
*
* If ), ,[6d40e863ccbec472ad9997a082840ef2]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (erences
/* Do not edit this file.
*
* If), ,[f9b454f74b3f52e47fc73ef9c442db25]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (eferences
/* Do not edit this file.
*
* ), ,[affe4cff9af0ba7ccc7ae5524bbba060]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (eferences
/* Do not edit this file.
*
* If y), ,[9e0f65e65931a591390d6bcc7195e818]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (ences
/* Do not edit this file.
*
* If yo), ,[c1ec9ab1454582b40d394ceb3fc77a86]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (ferences
/* Do not edit this file.
*
* If you make), ,[d5d84ffceaa074c2fd492710c640669a]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (
/* Do not edit this file.
*
* If you make c), ,[268785c6aedcf24431159a9df2147987]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (rences
/* Do not edit this file.
*
* If you make changes to this file w), ,[cde070db305a57df34129d9a2cda36ca]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (s file.
*
* If you make changes to this fil), ,[c1ecb992d9b11b1b2323b681ee1847b9]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (eferences
/* Do not edit this file.
*
* If you make changes to this), ,[f0bddc6f58320a2c77cfa592858157a9]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: ( this file.
*
* If you make changes to this file while t), ,[7a33c487d7b3a49257efe15649bdc040]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (/* Do not edit this file.
*
* If you make changes), ,[4c61f7544e3ccd692b1bd2658d7917e9]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (ces
/* Do not edit this file.
*
* If you ), ,[f6b7e269acde5ed860e6d85f16f09967]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (ferences
/* Do not edit this file.
*
* If you m), ,[634aa3a8dab0bb7b13330c2b4eb849b7]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (es
/* Do not edit this file.
*
* If you make changes to this), ,[dcd126257b0fc5716ed83700e026d12f]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (ot edit this file.
*
* If you make changes to thi), ,[f2bb8cbfd2b8e056ba8c7bbcc93d8977]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (ces
/* Do not edit this file.
*
* If you m), ,[cedf0843820820160d39ae896c9a5ba5]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (erences
/* Do not edit this file.
*
* If you ), ,[248958f31674d66087bf1d1a40c6649c]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (nces
/* Do not edit this file.
*
* If you m), ,[6f3e4308ff8bb87e81c51423e422d22e]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (rences
/* Do not edit this file.
*
* If you make), ,[c1ecda71b1d98fa7de6879bef11558a8]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (s
/* Do not edit this file.
*
* If you make ), ,[327b1b302763fa3c4ff7ee498680659b]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (ences
/* Do not edit this file.
*
* If you make ch), ,[c6e72d1e98f2ce68c97d7dbaa85ec937]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (
/* Do not edit this file.
*
* If you ma), ,[1c91c289602a1422c77fd364a85eca36]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (references
/* Do not edit this file.
*
* If ), ,[6c41212a4248989eea5c3cfb7492db25]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (ences
/* Do not edit this file.
*
* If you ), ,[c2ebee5d92f8ee482f17b0873bcb40c0]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (rences
/* Do not edit this file.
*
* If you make changes to this file while the application is running,
* th), ,[a40923282763ef4792b4bc7b41c52ed2]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (this file while the application is running,
* the ch), ,[6548a5a6f991082e79cd82b5a264c43c]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (es
/* Do not edit this file.
*
* If you make changes to), ,[5b52a4a7c0ca4aecda6c5cdb26e07987]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: ( Do not edit this file.
*
* If you make changes t), ,[c9e422296525b3834bfb0c2b2cda768a]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (ces
/* Do not edit this file.
*
* If you make changes to), ,[ffae81ca46445ed878ce1720b55134cc]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (Do not edit this file.
*
* If you make changes to ), ,[ac01f754e1a97bbbea5cbd7ad1356c94]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (es
/* Do not edit this file.
*
* If you make), ,[cce1252696f430065fe7e354f80ead53]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (ences
/* Do not edit this file.
*
* If you), ,[fab350fb32580b2b6ed8c47363a39a66]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (erences
/* Do not edit this file.
*
* If yo), ,[68450e3d8802cc6a66e068cfea1cab55]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (rences
/* Do not edit this file.
*
* If you m), ,[8627ff4c355574c20f371027679f7b85]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (nces
/* Do not edit this file.
*
* If you make changes to this file w), ,[d6d7fd4eddad181e3e081a1d55b13bc5]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (his file.
*
* If you make changes to this file while the a), ,[dfce074404862b0bbe885ed922e413ed]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: ( Do not edit this file.
*
* If you make changes to ), ,[5756ea61afdb0f2768dec0779b6be61a]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (s
/* Do not edit this file.
*
* If you make), ,[0ca1d17af892280e72d48ea9a3638b75]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (rences
/* Do not edit this file.
*
* If you ), ,[228b90bbf991f93dca7c6dca27df3fc1]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (ences
/* Do not edit this file.
*
* If you m), ,[d5d8e7646228a88e8db99d9a917515eb]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (ences
/* Do not edit this file.
*
* If you ma), ,[3d70df6c7416ec4afc4ac077b3536e92]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (nces
/* Do not edit this file.
*
* If you make cha), ,[317cd279fa90979fae98a29527df3ac6]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (
/* Do not edit this file.
*
* If you make chan), ,[179638133357f640d3737cbb54b2aa56]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (ces
/* Do not edit this file.
*
* If you make change), ,[9a13c883286239fd0a3c211684822cd4]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (
/* Do not edit this file.
*
* If you make change), ,[e2cb8cbf4b3fb1854105ba7d58ae8b75]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (ces
/* Do not edit this file.
*
* If you make), ,[1e8fa1aafb8fb086d5719b9c19ed4ab6]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (nces
/* Do not edit this file.
*
* If you make changes to this file while the application is running,
* the ch), ,[109dfd4e8dfdca6c5aec7dba877f50b0]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (is file while the application is running,
* the change), ,[723b9ead4b3fca6c46008fa80df90af6]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (
/* Do not edit this file.
*
* If you make changes to thi), ,[75383219b2d8ae880d392611a95d8e72]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (o not edit this file.
*
* If you make changes to th), ,[733a14374b3fe056b78f4fe816f0a35d]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: (s
/* Do not edit this file.
*
* If you make changes to thi), ,[109dfc4f1b6fec4a3b0b7abdaa5cbd43]
PUP.Optional.Incredibar.A, C:\Users\MB\AppData\Roaming\Mozilla\Firefox\Profiles\1gil7azr.default\prefs.js, Gut: (), Schlecht: ( not edit this file.
*
* If you make changes to this), ,[9c1178d3b8d28da9a6a041f60afc08f8]
Physische Sektoren: 0
(Keine schädliche Elemente erkannt)
(end)
Erster Bluescreen während Gmer: Code:
Problemsignatur:
Problemereignisname: BlueScreen
Betriebsystemversion: 6.1.7601.2.1.0.768.3
Gebietsschema-ID: 1031
Zusatzinformationen zum Problem:
BCCode: 3b
BCP1: 0000000080000004
BCP2: FFFFF8000447EE6B
BCP3: FFFFF880057E5F10
BCP4: 0000000000000000
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1
Zweiter Bluescreen: Code:
Problemsignatur:
Problemereignisname: BlueScreen
Betriebsystemversion: 6.1.7601.2.1.0.768.3
Gebietsschema-ID: 1031
Zusatzinformationen zum Problem:
BCCode: 1000009f
BCP1: 0000000000000004
BCP2: 0000000000000258
BCP3: FFFFFA80036EFB50
BCP4: FFFFF80000B9A510
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1
|
Lesestoff:
Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
AdwCleaner auf deinen Desktop.
FRST 32-Bit | FRST 64-Bit
Malwarebytes Anti-Malware 
