Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Trojaner Generic17.CNOG gefunden (https://www.trojaner-board.de/86981-trojaner-generic17-cnog-gefunden.html)

chicken87 11.06.2010 17:01
Also ich hab GMER durchlaufen lassen allerdings mit allen Partitionen und nach ner Weile kam dann ne Fehlermeldung und es brach den Scan ab.
Hab jetzt nur den Quickscan- Log hoffe der reicht.

GMER 1.0.15.15281 - hxxp://www.g**r.net
Rootkit quick scan 2010-06-11 17:45:33
Windows 5.1.2600 Service Pack 3
Running: 7219g12m.exe; Driver: C:\DOKUME~1\***\LOKALE~1\Temp\uwlyypoc.sys


---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip fwdrv.sys (Kerio Technologies)
AttachedDevice \Driver\Tcpip \Device\Ip ntkrnlpa.exe (NT-Kernel und -System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp fwdrv.sys (Kerio Technologies)
AttachedDevice \Driver\Tcpip \Device\Tcp ntkrnlpa.exe (NT-Kernel und -System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp fwdrv.sys (Kerio Technologies)
AttachedDevice \Driver\Tcpip \Device\Udp ntkrnlpa.exe (NT-Kernel und -System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp fwdrv.sys (Kerio Technologies)
AttachedDevice \Driver\Tcpip \Device\RawIp ntkrnlpa.exe (NT-Kernel und -System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

---- EOF - GMER 1.0.15 ----

markusg 11.06.2010 17:28
bitte lass gmer noch mal durchlaufen, diesmal nur partition c: auswählen.

chicken87 14.06.2010 01:00
Trojaner Generic17.CNOG gefunden
 
So nun hatte ich übers Wochenende kaum Zeit aber bin nun endlich ma zum GMER gekommen hier die Log Datei (musste sie Splitten da zuviele Zeichen)
GMER Logfile:
Code:
GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-06-14 01:37:45
Windows 5.1.2600 Service Pack 3
Running: 7219g12m.exe; Driver: C:\DOKUME~1\***\LOKALE~1\Temp\uwlyypoc.sys
 
 
---- System - GMER 1.0.15 ----
 
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies) ZwClose [0xACC70435]
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies) ZwCreateFile [0xACC6FC5C]
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies) ZwCreateKey [0xACC6C0B0]
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies) ZwCreateProcess [0xACC6F031]
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies) ZwCreateProcessEx [0xACC6EEAE]
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies) ZwCreateThread [0xACC6F693]
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies) ZwDeleteFile [0xACC704B5]
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies) ZwDeleteKey [0xACC6C4E1]
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies) ZwDeleteValueKey [0xACC6C574]
SSDT \SystemRoot\system32\drivers\khips.sys ZwLoadDriver [0xACA5E8B0]
SSDT \SystemRoot\system32\drivers\khips.sys ZwMapViewOfSection [0xACA5EA20]
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies) ZwOpenFile [0xACC6FF27]
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies) ZwOpenKey [0xACC6C307]
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies) ZwResumeThread [0xACC6F71F]
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies) ZwSetInformationFile [0xACC70229]
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies) ZwSetValueKey [0xACC6C67D]
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies) ZwWriteFile [0xACC70186]
 
---- Kernel code sections - GMER 1.0.15 ----
 
.text ntkrnlpa.exe!ZwCallbackReturn + 2D54 805045F0 4 Bytes CALL DA3CF29A
.text ntkrnlpa.exe!ZwCallbackReturn + 2D80 8050461C 4 Bytes JMP 861CACA5
PAGENDSM NDIS.sys!NdisMIndicateStatus B9E479EF 6 Bytes JMP ACC641EC \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies)
.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xB933A000, 0x1C5D58, 0xE8000020]
.text C:\WINDOWS\system32\DRIVERS\atksgt.sys section is writeable [0xAA121300, 0x3B6D8, 0xE8000020]
.text C:\WINDOWS\system32\DRIVERS\lirsgt.sys section is writeable [0xBA408300, 0x1BEE, 0xE8000020]
 
---- User code sections - GMER 1.0.15 ----
 
.text C:\WINDOWS\Explorer.EXE[116] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\Explorer.EXE[116] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\Explorer.EXE[116] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\Explorer.EXE[116] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\Explorer.EXE[116] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\Explorer.EXE[116] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\Explorer.EXE[116] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\Explorer.EXE[116] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\Explorer.EXE[116] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\Explorer.EXE[116] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\Explorer.EXE[116] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\Explorer.EXE[116] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\Explorer.EXE[116] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\Explorer.EXE[116] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\Explorer.EXE[116] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\Explorer.EXE[116] WININET.dll!InternetConnectA 408CDEAE 5 Bytes JMP 00080F54
.text C:\WINDOWS\Explorer.EXE[116] WININET.dll!InternetConnectW 408CF862 5 Bytes JMP 00080FE0
.text C:\WINDOWS\Explorer.EXE[116] WININET.dll!InternetOpenA 408DD690 5 Bytes JMP 00080D24
.text C:\WINDOWS\Explorer.EXE[116] WININET.dll!InternetOpenW 408DDB09 5 Bytes JMP 00080DB0
.text C:\WINDOWS\Explorer.EXE[116] WININET.dll!InternetOpenUrlA 408DF3A4 5 Bytes JMP 00080E3C
.text C:\WINDOWS\Explorer.EXE[116] WININET.dll!InternetOpenUrlW 40926DDF 5 Bytes JMP 00080EC8
.text C:\WINDOWS\Explorer.EXE[116] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\Explorer.EXE[116] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\Explorer.EXE[116] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\Programme\Java\jre6\bin\jqs.exe[220] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\Java\jre6\bin\jqs.exe[220] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\Java\jre6\bin\jqs.exe[220] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\Java\jre6\bin\jqs.exe[220] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\Java\jre6\bin\jqs.exe[220] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\Java\jre6\bin\jqs.exe[220] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\Java\jre6\bin\jqs.exe[220] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\Java\jre6\bin\jqs.exe[220] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\Java\jre6\bin\jqs.exe[220] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\Java\jre6\bin\jqs.exe[220] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\Java\jre6\bin\jqs.exe[220] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\Java\jre6\bin\jqs.exe[220] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\Java\jre6\bin\jqs.exe[220] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\Java\jre6\bin\jqs.exe[220] WS2_32.dll!socket 71A14211 5 Bytes JMP 001308C4
.text C:\Programme\Java\jre6\bin\jqs.exe[220] WS2_32.dll!bind 71A14480 5 Bytes JMP 00130838
.text C:\Programme\Java\jre6\bin\jqs.exe[220] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00130950
.text C:\Programme\Java\jre6\bin\jqs.exe[220] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\Java\jre6\bin\jqs.exe[220] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000301A8
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00030090
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00030694
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000302C0
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00030234
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00030004
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0003011C
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000304F0
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0003057C
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000303D8
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0003034C
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00030464
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00030608
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] WS2_32.dll!socket 71A14211 5 Bytes JMP 000308C4
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] WS2_32.dll!bind 71A14480 5 Bytes JMP 00030838
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00030950
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000307AC
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00030720
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] WININET.dll!InternetConnectA 408CDEAE 5 Bytes JMP 00030F54
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] WININET.dll!InternetConnectW 408CF862 5 Bytes JMP 00030FE0
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] WININET.dll!InternetOpenA 408DD690 5 Bytes JMP 00030D24
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] WININET.dll!InternetOpenW 408DDB09 5 Bytes JMP 00030DB0
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] WININET.dll!InternetOpenUrlA 408DF3A4 5 Bytes JMP 00030E3C
.text C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe[272] WININET.dll!InternetOpenUrlW 40926DDF 5 Bytes JMP 00030EC8
.text C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe[408] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe[408] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe[408] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe[408] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe[408] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe[408] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe[408] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe[408] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe[408] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe[408] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe[408] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe[408] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe[408] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\CDBurnerXP\NMSAccess.exe[480] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\CDBurnerXP\NMSAccess.exe[480] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\CDBurnerXP\NMSAccess.exe[480] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\CDBurnerXP\NMSAccess.exe[480] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\CDBurnerXP\NMSAccess.exe[480] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\CDBurnerXP\NMSAccess.exe[480] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\CDBurnerXP\NMSAccess.exe[480] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\CDBurnerXP\NMSAccess.exe[480] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\CDBurnerXP\NMSAccess.exe[480] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\CDBurnerXP\NMSAccess.exe[480] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\CDBurnerXP\NMSAccess.exe[480] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\CDBurnerXP\NMSAccess.exe[480] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\CDBurnerXP\NMSAccess.exe[480] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\WINDOWS\system32\PnkBstrA.exe[484] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\WINDOWS\system32\PnkBstrA.exe[484] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\WINDOWS\system32\PnkBstrA.exe[484] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\WINDOWS\system32\PnkBstrA.exe[484] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\WINDOWS\system32\PnkBstrA.exe[484] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\WINDOWS\system32\PnkBstrA.exe[484] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\WINDOWS\system32\PnkBstrA.exe[484] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\WINDOWS\system32\PnkBstrA.exe[484] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\WINDOWS\system32\PnkBstrA.exe[484] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\WINDOWS\system32\PnkBstrA.exe[484] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\WINDOWS\system32\PnkBstrA.exe[484] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\WINDOWS\system32\PnkBstrA.exe[484] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\WINDOWS\system32\PnkBstrA.exe[484] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\WINDOWS\system32\PnkBstrA.exe[484] WS2_32.dll!socket 71A14211 5 Bytes JMP 001308C4
.text C:\WINDOWS\system32\PnkBstrA.exe[484] WS2_32.dll!bind 71A14480 5 Bytes JMP 00130838
.text C:\WINDOWS\system32\PnkBstrA.exe[484] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00130950
.text C:\WINDOWS\system32\PnkBstrA.exe[484] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\WINDOWS\system32\PnkBstrA.exe[484] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\WINDOWS\system32\PnkBstrB.exe[508] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\WINDOWS\system32\PnkBstrB.exe[508] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\WINDOWS\system32\PnkBstrB.exe[508] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\WINDOWS\system32\PnkBstrB.exe[508] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\WINDOWS\system32\PnkBstrB.exe[508] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\WINDOWS\system32\PnkBstrB.exe[508] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\WINDOWS\system32\PnkBstrB.exe[508] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\WINDOWS\system32\PnkBstrB.exe[508] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\WINDOWS\system32\PnkBstrB.exe[508] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\WINDOWS\system32\PnkBstrB.exe[508] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\WINDOWS\system32\PnkBstrB.exe[508] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\WINDOWS\system32\PnkBstrB.exe[508] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\WINDOWS\system32\PnkBstrB.exe[508] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\WINDOWS\system32\PnkBstrB.exe[508] WS2_32.dll!socket 71A14211 5 Bytes JMP 001308C4
.text C:\WINDOWS\system32\PnkBstrB.exe[508] WS2_32.dll!bind 71A14480 5 Bytes JMP 00130838
.text C:\WINDOWS\system32\PnkBstrB.exe[508] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00130950
.text C:\WINDOWS\system32\PnkBstrB.exe[508] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\WINDOWS\system32\PnkBstrB.exe[508] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[516] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[516] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[516] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[516] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[516] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[516] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[516] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[516] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[516] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[516] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[516] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[516] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[516] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[516] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[516] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[516] WS2_32.dll!socket 71A14211 5 Bytes JMP 001308C4
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[516] WS2_32.dll!bind 71A14480 5 Bytes JMP 00130838
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[516] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00130950
.text C:\Programme\CyberLink\Shared Files\RichVideo.exe[576] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\CyberLink\Shared Files\RichVideo.exe[576] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\CyberLink\Shared Files\RichVideo.exe[576] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\CyberLink\Shared Files\RichVideo.exe[576] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\CyberLink\Shared Files\RichVideo.exe[576] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\CyberLink\Shared Files\RichVideo.exe[576] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\CyberLink\Shared Files\RichVideo.exe[576] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\CyberLink\Shared Files\RichVideo.exe[576] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\CyberLink\Shared Files\RichVideo.exe[576] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\CyberLink\Shared Files\RichVideo.exe[576] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\CyberLink\Shared Files\RichVideo.exe[576] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\CyberLink\Shared Files\RichVideo.exe[576] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\CyberLink\Shared Files\RichVideo.exe[576] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\CyberLink\Shared Files\RichVideo.exe[576] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\CyberLink\Shared Files\RichVideo.exe[576] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\WINDOWS\system32\csrss.exe[724] KERNEL32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001601A8
.text C:\WINDOWS\system32\csrss.exe[724] KERNEL32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00160090
.text C:\WINDOWS\system32\csrss.exe[724] KERNEL32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00160694
.text C:\WINDOWS\system32\csrss.exe[724] KERNEL32.dll!CreateProcessW 7C802336 5 Bytes JMP 001602C0
.text C:\WINDOWS\system32\csrss.exe[724] KERNEL32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00160234
.text C:\WINDOWS\system32\csrss.exe[724] KERNEL32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00160004
.text C:\WINDOWS\system32\csrss.exe[724] KERNEL32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0016011C
.text C:\WINDOWS\system32\csrss.exe[724] KERNEL32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001604F0
.text C:\WINDOWS\system32\csrss.exe[724] KERNEL32.dll!CreateThread 7C8106D7 5 Bytes JMP 0016057C
.text C:\WINDOWS\system32\csrss.exe[724] KERNEL32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001603D8
.text C:\WINDOWS\system32\csrss.exe[724] KERNEL32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0016034C
.text C:\WINDOWS\system32\csrss.exe[724] KERNEL32.dll!WinExec 7C86250D 5 Bytes JMP 00160464
.text C:\WINDOWS\system32\csrss.exe[724] KERNEL32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00160608
.text C:\WINDOWS\system32\csrss.exe[724] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001607AC
.text C:\WINDOWS\system32\csrss.exe[724] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00160720
.text C:\WINDOWS\system32\winlogon.exe[756] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000701A8
.text C:\WINDOWS\system32\winlogon.exe[756] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00070090
.text C:\WINDOWS\system32\winlogon.exe[756] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00070694
.text C:\WINDOWS\system32\winlogon.exe[756] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000702C0
.text C:\WINDOWS\system32\winlogon.exe[756] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00070234
.text C:\WINDOWS\system32\winlogon.exe[756] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00070004
.text C:\WINDOWS\system32\winlogon.exe[756] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0007011C
.text C:\WINDOWS\system32\winlogon.exe[756] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000704F0
.text C:\WINDOWS\system32\winlogon.exe[756] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0007057C
.text C:\WINDOWS\system32\winlogon.exe[756] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000703D8
.text C:\WINDOWS\system32\winlogon.exe[756] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0007034C
.text C:\WINDOWS\system32\winlogon.exe[756] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00070464
.text C:\WINDOWS\system32\winlogon.exe[756] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00070608
.text C:\WINDOWS\system32\winlogon.exe[756] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000707AC
.text C:\WINDOWS\system32\winlogon.exe[756] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00070720
.text C:\WINDOWS\system32\winlogon.exe[756] WS2_32.dll!socket 71A14211 5 Bytes JMP 000708C4
.text C:\WINDOWS\system32\winlogon.exe[756] WS2_32.dll!bind 71A14480 5 Bytes JMP 00070838
.text C:\WINDOWS\system32\winlogon.exe[756] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00070950
.text C:\WINDOWS\system32\services.exe[800] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\services.exe[800] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\services.exe[800] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\services.exe[800] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\services.exe[800] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\services.exe[800] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\services.exe[800] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\services.exe[800] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\services.exe[800] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\services.exe[800] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\services.exe[800] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\services.exe[800] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\services.exe[800] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\services.exe[800] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\services.exe[800] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\lsass.exe[812] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\lsass.exe[812] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\lsass.exe[812] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\lsass.exe[812] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\lsass.exe[812] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\lsass.exe[812] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\lsass.exe[812] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\lsass.exe[812] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\lsass.exe[812] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\lsass.exe[812] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\lsass.exe[812] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\lsass.exe[812] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\lsass.exe[812] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\lsass.exe[812] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\lsass.exe[812] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\lsass.exe[812] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\lsass.exe[812] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\lsass.exe[812] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\WINDOWS\system32\Ati2evxx.exe[980] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\WINDOWS\system32\Ati2evxx.exe[980] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\WINDOWS\system32\Ati2evxx.exe[980] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\WINDOWS\system32\Ati2evxx.exe[980] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\WINDOWS\system32\Ati2evxx.exe[980] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\WINDOWS\system32\Ati2evxx.exe[980] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\WINDOWS\system32\Ati2evxx.exe[980] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\WINDOWS\system32\Ati2evxx.exe[980] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\WINDOWS\system32\Ati2evxx.exe[980] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\WINDOWS\system32\Ati2evxx.exe[980] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\WINDOWS\system32\Ati2evxx.exe[980] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\WINDOWS\system32\Ati2evxx.exe[980] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\WINDOWS\system32\Ati2evxx.exe[980] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\WINDOWS\system32\Ati2evxx.exe[980] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\WINDOWS\system32\Ati2evxx.exe[980] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\svchost.exe[1000] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\svchost.exe[1000] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\WINDOWS\system32\svchost.exe[1048] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\svchost.exe[1048] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\svchost.exe[1048] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\svchost.exe[1048] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\svchost.exe[1048] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\svchost.exe[1048] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\svchost.exe[1048] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\svchost.exe[1048] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\svchost.exe[1048] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\svchost.exe[1048] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\svchost.exe[1048] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\svchost.exe[1048] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\svchost.exe[1048] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\svchost.exe[1048] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\svchost.exe[1048] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\svchost.exe[1048] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\svchost.exe[1048] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\svchost.exe[1048] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\WINDOWS\System32\svchost.exe[1128] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\System32\svchost.exe[1128] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\System32\svchost.exe[1128] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\System32\svchost.exe[1128] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\System32\svchost.exe[1128] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\System32\svchost.exe[1128] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\System32\svchost.exe[1128] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\System32\svchost.exe[1128] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\System32\svchost.exe[1128] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\System32\svchost.exe[1128] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\System32\svchost.exe[1128] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\System32\svchost.exe[1128] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\System32\svchost.exe[1128] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\System32\svchost.exe[1128] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\System32\svchost.exe[1128] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\System32\svchost.exe[1128] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\System32\svchost.exe[1128] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\System32\svchost.exe[1128] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\WINDOWS\System32\svchost.exe[1128] WININET.dll!InternetConnectA 408CDEAE 5 Bytes JMP 00080F54
.text C:\WINDOWS\System32\svchost.exe[1128] WININET.dll!InternetConnectW 408CF862 5 Bytes JMP 00080FE0
.text C:\WINDOWS\System32\svchost.exe[1128] WININET.dll!InternetOpenA 408DD690 5 Bytes JMP 00080D24
.text C:\WINDOWS\System32\svchost.exe[1128] WININET.dll!InternetOpenW 408DDB09 5 Bytes JMP 00080DB0
.text C:\WINDOWS\System32\svchost.exe[1128] WININET.dll!InternetOpenUrlA 408DF3A4 5 Bytes JMP 00080E3C
.text C:\WINDOWS\System32\svchost.exe[1128] WININET.dll!InternetOpenUrlW 40926DDF 5 Bytes JMP 00080EC8
.text C:\Dokumente und Einstellungen\***\Desktop\7219g12m.exe[1188] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Dokumente und Einstellungen\***\Desktop\7219g12m.exe[1188] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Dokumente und Einstellungen\***\Desktop\7219g12m.exe[1188] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Dokumente und Einstellungen\***\Desktop\7219g12m.exe[1188] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Dokumente und Einstellungen\***\Desktop\7219g12m.exe[1188] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Dokumente und Einstellungen\***\Desktop\7219g12m.exe[1188] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Dokumente und Einstellungen\***\Desktop\7219g12m.exe[1188] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Dokumente und Einstellungen\***\Desktop\7219g12m.exe[1188] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Dokumente und Einstellungen\***\Desktop\7219g12m.exe[1188] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Dokumente und Einstellungen\***\Desktop\7219g12m.exe[1188] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Dokumente und Einstellungen\***\Desktop\7219g12m.exe[1188] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Dokumente und Einstellungen\***\Desktop\7219g12m.exe[1188] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Dokumente und Einstellungen\***\Desktop\7219g12m.exe[1188] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Dokumente und Einstellungen\***\Desktop\7219g12m.exe[1188] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Dokumente und Einstellungen\***\Desktop\7219g12m.exe[1188] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\WINDOWS\system32\Ati2evxx.exe[1204] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\WINDOWS\system32\Ati2evxx.exe[1204] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\WINDOWS\system32\Ati2evxx.exe[1204] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\WINDOWS\system32\Ati2evxx.exe[1204] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\WINDOWS\system32\Ati2evxx.exe[1204] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\WINDOWS\system32\Ati2evxx.exe[1204] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\WINDOWS\system32\Ati2evxx.exe[1204] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\WINDOWS\system32\Ati2evxx.exe[1204] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\WINDOWS\system32\Ati2evxx.exe[1204] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\WINDOWS\system32\Ati2evxx.exe[1204] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\WINDOWS\system32\Ati2evxx.exe[1204] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\WINDOWS\system32\Ati2evxx.exe[1204] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\WINDOWS\system32\Ati2evxx.exe[1204] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\WINDOWS\system32\Ati2evxx.exe[1204] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\WINDOWS\system32\Ati2evxx.exe[1204] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\svchost.exe[1212] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\svchost.exe[1212] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\svchost.exe[1212] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\svchost.exe[1212] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\svchost.exe[1212] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\Programme\AVG\AVG9\avgchsvx.exe[1220] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\AVG\AVG9\avgchsvx.exe[1220] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\AVG\AVG9\avgchsvx.exe[1220] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\AVG\AVG9\avgchsvx.exe[1220] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\AVG\AVG9\avgchsvx.exe[1220] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\AVG\AVG9\avgchsvx.exe[1220] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\AVG\AVG9\avgchsvx.exe[1220] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\AVG\AVG9\avgchsvx.exe[1220] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\AVG\AVG9\avgchsvx.exe[1220] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\AVG\AVG9\avgchsvx.exe[1220] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\AVG\AVG9\avgchsvx.exe[1220] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\AVG\AVG9\avgchsvx.exe[1220] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\AVG\AVG9\avgchsvx.exe[1220] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\AVG\AVG9\avgchsvx.exe[1220] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\AVG\AVG9\avgchsvx.exe[1220] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\AVG\AVG9\avgrsx.exe[1228] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\AVG\AVG9\avgrsx.exe[1228] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\AVG\AVG9\avgrsx.exe[1228] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\AVG\AVG9\avgrsx.exe[1228] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\AVG\AVG9\avgrsx.exe[1228] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\AVG\AVG9\avgrsx.exe[1228] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\AVG\AVG9\avgrsx.exe[1228] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\AVG\AVG9\avgrsx.exe[1228] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\AVG\AVG9\avgrsx.exe[1228] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\AVG\AVG9\avgrsx.exe[1228] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\AVG\AVG9\avgrsx.exe[1228] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\AVG\AVG9\avgrsx.exe[1228] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\AVG\AVG9\avgrsx.exe[1228] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\WINDOWS\system32\wuauclt.exe[1296] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\wuauclt.exe[1296] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\wuauclt.exe[1296] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\wuauclt.exe[1296] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\wuauclt.exe[1296] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\wuauclt.exe[1296] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\wuauclt.exe[1296] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\wuauclt.exe[1296] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\wuauclt.exe[1296] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\wuauclt.exe[1296] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\wuauclt.exe[1296] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\wuauclt.exe[1296] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\wuauclt.exe[1296] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\wuauclt.exe[1296] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\wuauclt.exe[1296] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\wuauclt.exe[1296] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\wuauclt.exe[1296] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\wuauclt.exe[1296] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[1356] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[1356] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[1356] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[1356] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[1356] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[1356] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[1356] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[1356] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[1356] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[1356] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[1356] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[1356] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[1356] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
 
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\svchost.exe[1368] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\svchost.exe[1368] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\svchost.exe[1368] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\svchost.exe[1368] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\svchost.exe[1368] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\WINDOWS\system32\spoolsv.exe[1540] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\spoolsv.exe[1540] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\spoolsv.exe[1540] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\spoolsv.exe[1540] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\spoolsv.exe[1540] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\spoolsv.exe[1540] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\spoolsv.exe[1540] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\spoolsv.exe[1540] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\spoolsv.exe[1540] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\spoolsv.exe[1540] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\spoolsv.exe[1540] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\spoolsv.exe[1540] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\spoolsv.exe[1540] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\spoolsv.exe[1540] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\spoolsv.exe[1540] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\spoolsv.exe[1540] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\spoolsv.exe[1540] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\spoolsv.exe[1540] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\WINDOWS\system32\svchost.exe[1824] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\svchost.exe[1824] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\svchost.exe[1824] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\svchost.exe[1824] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\svchost.exe[1824] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\svchost.exe[1824] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\svchost.exe[1824] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\svchost.exe[1824] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\svchost.exe[1824] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\svchost.exe[1824] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\svchost.exe[1824] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\svchost.exe[1824] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\svchost.exe[1824] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\svchost.exe[1824] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\svchost.exe[1824] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\svchost.exe[1824] WININET.dll!InternetConnectA 408CDEAE 5 Bytes JMP 00080F54
.text C:\WINDOWS\system32\svchost.exe[1824] WININET.dll!InternetConnectW 408CF862 5 Bytes JMP 00080FE0
.text C:\WINDOWS\system32\svchost.exe[1824] WININET.dll!InternetOpenA 408DD690 5 Bytes JMP 00080D24
.text C:\WINDOWS\system32\svchost.exe[1824] WININET.dll!InternetOpenW 408DDB09 5 Bytes JMP 00080DB0
.text C:\WINDOWS\system32\svchost.exe[1824] WININET.dll!InternetOpenUrlA 408DF3A4 5 Bytes JMP 00080E3C
.text C:\WINDOWS\system32\svchost.exe[1824] WININET.dll!InternetOpenUrlW 40926DDF 5 Bytes JMP 00080EC8
.text C:\WINDOWS\system32\svchost.exe[1824] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\svchost.exe[1824] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\svchost.exe[1824] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\WINDOWS\RTHDCPL.EXE[1900] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\WINDOWS\RTHDCPL.EXE[1900] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\WINDOWS\RTHDCPL.EXE[1900] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\WINDOWS\RTHDCPL.EXE[1900] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\WINDOWS\RTHDCPL.EXE[1900] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\WINDOWS\RTHDCPL.EXE[1900] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\WINDOWS\RTHDCPL.EXE[1900] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\WINDOWS\RTHDCPL.EXE[1900] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\WINDOWS\RTHDCPL.EXE[1900] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\WINDOWS\RTHDCPL.EXE[1900] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\WINDOWS\RTHDCPL.EXE[1900] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\WINDOWS\RTHDCPL.EXE[1900] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\WINDOWS\RTHDCPL.EXE[1900] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\WINDOWS\RTHDCPL.EXE[1900] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\WINDOWS\RTHDCPL.EXE[1900] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[1904] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[1904] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[1904] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[1904] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[1904] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[1904] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[1904] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[1904] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[1904] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[1904] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[1904] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[1904] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[1904] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[1904] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[1904] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[1904] WS2_32.dll!socket 71A14211 5 Bytes JMP 001308C4
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[1904] WS2_32.dll!bind 71A14480 5 Bytes JMP 00130838
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[1904] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00130950
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] WS2_32.dll!socket 71A14211 5 Bytes JMP 001308C4
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] WS2_32.dll!bind 71A14480 5 Bytes JMP 00130838
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00130950
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] WININET.dll!InternetConnectA 408CDEAE 5 Bytes JMP 00130F54
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] WININET.dll!InternetConnectW 408CF862 5 Bytes JMP 00130FE0
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] WININET.dll!InternetOpenA 408DD690 5 Bytes JMP 00130D24
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] WININET.dll!InternetOpenW 408DDB09 5 Bytes JMP 00130DB0
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] WININET.dll!InternetOpenUrlA 408DF3A4 5 Bytes JMP 00130E3C
.text C:\Programme\avmwlanstick\WlanNetService.exe[1980] WININET.dll!InternetOpenUrlW 40926DDF 5 Bytes JMP 00130EC8
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] WININET.dll!InternetConnectA 408CDEAE 5 Bytes JMP 00130F54
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] WININET.dll!InternetConnectW 408CF862 5 Bytes JMP 00130FE0
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] WININET.dll!InternetOpenA 408DD690 5 Bytes JMP 00130D24
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] WININET.dll!InternetOpenW 408DDB09 5 Bytes JMP 00130DB0
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] WININET.dll!InternetOpenUrlA 408DF3A4 5 Bytes JMP 00130E3C
.text C:\Programme\Java\jre6\bin\jusched.exe[2064] WININET.dll!InternetOpenUrlW 40926DDF 5 Bytes JMP 00130EC8
.text C:\Programme\avmwlanstick\wlangui.exe[2072] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\avmwlanstick\wlangui.exe[2072] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\avmwlanstick\wlangui.exe[2072] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\avmwlanstick\wlangui.exe[2072] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\avmwlanstick\wlangui.exe[2072] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\avmwlanstick\wlangui.exe[2072] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\avmwlanstick\wlangui.exe[2072] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\avmwlanstick\wlangui.exe[2072] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\avmwlanstick\wlangui.exe[2072] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\avmwlanstick\wlangui.exe[2072] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\avmwlanstick\wlangui.exe[2072] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\avmwlanstick\wlangui.exe[2072] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\avmwlanstick\wlangui.exe[2072] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\avmwlanstick\wlangui.exe[2072] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\avmwlanstick\wlangui.exe[2072] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\avmwlanstick\wlangui.exe[2072] WININET.dll!InternetConnectA 408CDEAE 5 Bytes JMP 00130F54
.text C:\Programme\avmwlanstick\wlangui.exe[2072] WININET.dll!InternetConnectW 408CF862 5 Bytes JMP 00130FE0
.text C:\Programme\avmwlanstick\wlangui.exe[2072] WININET.dll!InternetOpenA 408DD690 5 Bytes JMP 00130D24
.text C:\Programme\avmwlanstick\wlangui.exe[2072] WININET.dll!InternetOpenW 408DDB09 5 Bytes JMP 00130DB0
.text C:\Programme\avmwlanstick\wlangui.exe[2072] WININET.dll!InternetOpenUrlA 408DF3A4 5 Bytes JMP 00130E3C
.text C:\Programme\avmwlanstick\wlangui.exe[2072] WININET.dll!InternetOpenUrlW 40926DDF 5 Bytes JMP 00130EC8
.text C:\Programme\Gemeinsame Dateien\Logitech\G-series Software\LGDCore.exe[2084] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\Gemeinsame Dateien\Logitech\G-series Software\LGDCore.exe[2084] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\Gemeinsame Dateien\Logitech\G-series Software\LGDCore.exe[2084] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\Gemeinsame Dateien\Logitech\G-series Software\LGDCore.exe[2084] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\Gemeinsame Dateien\Logitech\G-series Software\LGDCore.exe[2084] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\Gemeinsame Dateien\Logitech\G-series Software\LGDCore.exe[2084] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\Gemeinsame Dateien\Logitech\G-series Software\LGDCore.exe[2084] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\Gemeinsame Dateien\Logitech\G-series Software\LGDCore.exe[2084] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\Gemeinsame Dateien\Logitech\G-series Software\LGDCore.exe[2084] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\Gemeinsame Dateien\Logitech\G-series Software\LGDCore.exe[2084] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\Gemeinsame Dateien\Logitech\G-series Software\LGDCore.exe[2084] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\Gemeinsame Dateien\Logitech\G-series Software\LGDCore.exe[2084] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\Gemeinsame Dateien\Logitech\G-series Software\LGDCore.exe[2084] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\Gemeinsame Dateien\Logitech\G-series Software\LGDCore.exe[2084] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\Gemeinsame Dateien\Logitech\G-series Software\LGDCore.exe[2084] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe[2136] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe[2136] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe[2136] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe[2136] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe[2136] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe[2136] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe[2136] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe[2136] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe[2136] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe[2136] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe[2136] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe[2136] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe[2136] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe[2136] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe[2136] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] WININET.dll!InternetConnectA 408CDEAE 5 Bytes JMP 00130F54
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] WININET.dll!InternetConnectW 408CF862 5 Bytes JMP 00130FE0
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] WININET.dll!InternetOpenA 408DD690 5 Bytes JMP 00130D24
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] WININET.dll!InternetOpenW 408DDB09 5 Bytes JMP 00130DB0
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] WININET.dll!InternetOpenUrlA 408DF3A4 5 Bytes JMP 00130E3C
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] WININET.dll!InternetOpenUrlW 40926DDF 5 Bytes JMP 00130EC8
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] ws2_32.dll!socket 71A14211 5 Bytes JMP 001308C4
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] ws2_32.dll!bind 71A14480 5 Bytes JMP 00130838
.text C:\Programme\DivX\DivX Update\DivXUpdate.exe[2156] ws2_32.dll!connect 71A14A07 5 Bytes JMP 00130950
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2164] KERNEL32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2164] KERNEL32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2164] KERNEL32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2164] KERNEL32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2164] KERNEL32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2164] KERNEL32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2164] KERNEL32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2164] KERNEL32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2164] KERNEL32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2164] KERNEL32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2164] KERNEL32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2164] KERNEL32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2164] KERNEL32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2164] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2164] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2168] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2168] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2168] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2168] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2168] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2168] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2168] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2168] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2168] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2168] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2168] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2168] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2168] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2168] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2168] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2168] WS2_32.dll!socket 71A14211 5 Bytes JMP 001308C4
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2168] WS2_32.dll!bind 71A14480 5 Bytes JMP 00130838
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2168] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00130950
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2212] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2212] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2212] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2212] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2212] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2212] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2212] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2212] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2212] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2212] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2212] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2212] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2212] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2212] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2212] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2212] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2212] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2212] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\WINDOWS\system32\ctfmon.exe[2232] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\ctfmon.exe[2232] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\ctfmon.exe[2232] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\ctfmon.exe[2232] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\ctfmon.exe[2232] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\ctfmon.exe[2232] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\ctfmon.exe[2232] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\ctfmon.exe[2232] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\ctfmon.exe[2232] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\ctfmon.exe[2232] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\ctfmon.exe[2232] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\ctfmon.exe[2232] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\ctfmon.exe[2232] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\ctfmon.exe[2232] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\ctfmon.exe[2232] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\Programme\AVG\AVG9\avgemc.exe[2264] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\AVG\AVG9\avgemc.exe[2264] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\AVG\AVG9\avgemc.exe[2264] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\AVG\AVG9\avgemc.exe[2264] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\AVG\AVG9\avgemc.exe[2264] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\AVG\AVG9\avgemc.exe[2264] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\AVG\AVG9\avgemc.exe[2264] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\AVG\AVG9\avgemc.exe[2264] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\AVG\AVG9\avgemc.exe[2264] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\AVG\AVG9\avgemc.exe[2264] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\AVG\AVG9\avgemc.exe[2264] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\AVG\AVG9\avgemc.exe[2264] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\AVG\AVG9\avgemc.exe[2264] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\AVG\AVG9\avgemc.exe[2264] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\AVG\AVG9\avgemc.exe[2264] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\AVG\AVG9\avgemc.exe[2264] WS2_32.dll!socket 71A14211 5 Bytes JMP 001308C4
.text C:\Programme\AVG\AVG9\avgemc.exe[2264] WS2_32.dll!bind 71A14480 5 Bytes JMP 00130838
.text C:\Programme\AVG\AVG9\avgemc.exe[2264] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00130950
.text C:\Programme\AVG\AVG9\avgnsx.exe[2348] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\AVG\AVG9\avgnsx.exe[2348] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\AVG\AVG9\avgnsx.exe[2348] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\AVG\AVG9\avgnsx.exe[2348] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\AVG\AVG9\avgnsx.exe[2348] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\AVG\AVG9\avgnsx.exe[2348] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\AVG\AVG9\avgnsx.exe[2348] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\AVG\AVG9\avgnsx.exe[2348] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\AVG\AVG9\avgnsx.exe[2348] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\AVG\AVG9\avgnsx.exe[2348] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\AVG\AVG9\avgnsx.exe[2348] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\AVG\AVG9\avgnsx.exe[2348] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\AVG\AVG9\avgnsx.exe[2348] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\AVG\AVG9\avgnsx.exe[2348] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\AVG\AVG9\avgnsx.exe[2348] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[2508] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[2508] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[2508] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[2508] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[2508] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[2508] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[2508] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[2508] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[2508] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[2508] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[2508] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[2508] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[2508] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\WINDOWS\System32\alg.exe[3132] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\System32\alg.exe[3132] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\System32\alg.exe[3132] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\System32\alg.exe[3132] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\System32\alg.exe[3132] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\System32\alg.exe[3132] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\System32\alg.exe[3132] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\System32\alg.exe[3132] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\System32\alg.exe[3132] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\System32\alg.exe[3132] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\System32\alg.exe[3132] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\System32\alg.exe[3132] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\System32\alg.exe[3132] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\System32\alg.exe[3132] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\System32\alg.exe[3132] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\System32\alg.exe[3132] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\System32\alg.exe[3132] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\System32\alg.exe[3132] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[3240] KERNEL32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[3240] KERNEL32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[3240] KERNEL32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[3240] KERNEL32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[3240] KERNEL32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[3240] KERNEL32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[3240] KERNEL32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[3240] KERNEL32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[3240] KERNEL32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[3240] KERNEL32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[3240] KERNEL32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[3240] KERNEL32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[3240] KERNEL32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[3240] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe[3240] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3356] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3356] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3356] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3356] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3356] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3356] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3356] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3356] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3356] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3356] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3356] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3356] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3356] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3356] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3356] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3356] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3356] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3356] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[3416] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[3416] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[3416] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[3416] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[3416] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[3416] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[3416] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[3416] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[3416] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[3416] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[3416] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[3416] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[3416] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[3416] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[3416] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[3416] WS2_32.dll!socket 71A14211 5 Bytes JMP 001308C4
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[3416] WS2_32.dll!bind 71A14480 5 Bytes JMP 00130838
.text C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe[3416] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00130950
.text C:\WINDOWS\system32\wscntfy.exe[3668] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000701A8
.text C:\WINDOWS\system32\wscntfy.exe[3668] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00070090
.text C:\WINDOWS\system32\wscntfy.exe[3668] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00070694
.text C:\WINDOWS\system32\wscntfy.exe[3668] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000702C0
.text C:\WINDOWS\system32\wscntfy.exe[3668] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00070234
.text C:\WINDOWS\system32\wscntfy.exe[3668] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00070004
.text C:\WINDOWS\system32\wscntfy.exe[3668] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0007011C
.text C:\WINDOWS\system32\wscntfy.exe[3668] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000704F0
.text C:\WINDOWS\system32\wscntfy.exe[3668] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0007057C
.text C:\WINDOWS\system32\wscntfy.exe[3668] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000703D8
.text C:\WINDOWS\system32\wscntfy.exe[3668] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0007034C
.text C:\WINDOWS\system32\wscntfy.exe[3668] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00070464
.text C:\WINDOWS\system32\wscntfy.exe[3668] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00070608
.text C:\WINDOWS\system32\wscntfy.exe[3668] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000707AC
.text C:\WINDOWS\system32\wscntfy.exe[3668] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00070720
 
---- Kernel IAT/EAT - GMER 1.0.15 ----
 
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [ACC64040] \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [ACC6405B] \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [ACC640DF] \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [ACC64102] \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [ACC640DF] \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [ACC6405B] \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [ACC64040] \SystemRoot\system32\drivers\fwdrv.sys (Kerio Technologies)
 
---- Devices - GMER 1.0.15 ----
 
AttachedDevice \Driver\Tcpip \Device\Ip fwdrv.sys (Kerio Technologies)
AttachedDevice \Driver\Tcpip \Device\Ip ntkrnlpa.exe (NT-Kernel und -System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp fwdrv.sys (Kerio Technologies)
AttachedDevice \Driver\Tcpip \Device\Tcp ntkrnlpa.exe (NT-Kernel und -System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp fwdrv.sys (Kerio Technologies)
AttachedDevice \Driver\Tcpip \Device\Udp ntkrnlpa.exe (NT-Kernel und -System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp fwdrv.sys (Kerio Technologies)
AttachedDevice \Driver\Tcpip \Device\RawIp ntkrnlpa.exe (NT-Kernel und -System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
 
---- Registry - GMER 1.0.15 ----
 
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xBE 0x36 0x0B 0x19 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 D:\Programme\DAEMON Tools\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x79 0xD6 0x0F 0xA3 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x72 0x65 0xAF 0x50 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xBE 0x36 0x0B 0x19 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 D:\Programme\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x79 0xD6 0x0F 0xA3 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x72 0x65 0xAF 0x50 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xBE 0x36 0x0B 0x19 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 D:\Programme\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x79 0xD6 0x0F 0xA3 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x72 0x65 0xAF 0x50 ...
 
---- EOF - GMER 1.0.15 ----
--- --- ---

markusg 14.06.2010 11:03
download malwarebytes:
Malwarebytes
instalieren, öffnen, registerkarte aktualisierung, updaten.
registerkarte scanner, komplett scan, funde löschen, log posten.

chicken87 14.06.2010 13:01
So hier nun die Log datei von Malewarebytes

Malwarebytes' Anti-Malware 1.46
Malwarebytes

Datenbank Version: 4196

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

14.06.2010 13:58:14
mbam-log-2010-06-14 (13-58-14).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|I:\|)
Durchsuchte Objekte: 275924
Laufzeit: 1 Stunde(n), 3 Minute(n), 36 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 3

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\_OTL\MovedFiles\06112010_124216\C_WINDOWS\system32\fgpipe.dll (Trojan.Agent) -> No action taken.
E:\Programme\LAN CoD 4\***\rzr-cd4f\rzr-cod4.exe (Trojan.Agent.CK) -> No action taken.
C:\WINDOWS\system32\h@tkeysh@@k.dll (Trojan.Agent) -> No action taken.


soweit so gut aber kann ich die dll ausm Windows Ordner bedenkenlos löschen??

markusg 14.06.2010 13:56
ja, kannst sie löschen.

chicken87 14.06.2010 16:10
wars das nun? :applaus:
oder soll ich sonst noch was durchlaufen lassen?
AVG meldet sich auch nicht mehr.
dann möchte ich mich nochmals bedanken für die schnelle und kompetente Hilfe hier. Wirklich ein großes Lob ohne die Hilfe hier wäre ich wirklich aufgeschmissen gewesen:dankeschoen::dankeschoen::dankeschoen:

markusg 14.06.2010 16:15
reinige mit otcleanit:
http://oldtimer.geekstogo.com/OTM.exe
Klicke cleanup!
dein pc wird evtl. neu starten
programm löscht sich selbst, + die verwendeten tools
die Systemwiederherstellung de- und reaktivieren:
Windows XP - Die Systemwiederherstellung komplett abschalten
um deine software aktuell zu halten, solltest du secunia nutzen:
http://www.trojaner-board.de/83959-s...ector-psi.html
abschließend noch den eset online scanner ausführen:
Free ESET Online Antivirus Scanner
funde löschen, log posten.
außer deine internetverbindung ist wirklich zu langsam dafür weis ja nicht genau, welche anbindung du hast.


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:34 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131