Virus/Spyware Troj/JSRedir-HP
 

Hallo zusammen,

der Virenscanner meiner Eltern zeigt mir folgenden Virus:

Virus/Spyware Troj/JSRedir-HP

Ich habe die vorgegebenen Programme durchlaufen lassen, hier die log-Datein.


defogger_disable.log:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:12 on 28/07/2012 (Admin)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed

Checking for services/drivers...
Unable to read sptd.sys
SPTD -> Disabled (Service running -> reboot required)


-=E.O.F=-




OTL.Txt:

OTL logfile created on: 28.07.2012 17:52:51 - Run 1
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Dokumente und Einstellungen\Admin\Desktop\Trojaner
Windows XP Professional Edition Service Pack 2, v.2149 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2149)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1,99 Gb Total Physical Memory | 1,45 Gb Available Physical Memory | 73,08% Memory free
3,84 Gb Paging File | 3,45 Gb Available in Paging File | 89,96% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 232,88 Gb Total Space | 218,92 Gb Free Space | 94,01% Space Free | Partition Type: NTFS
Drive D: | 38,28 Gb Total Space | 9,07 Gb Free Space | 23,68% Space Free | Partition Type: NTFS

Computer Name: PRIVAT | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.07.28 17:24:50 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Admin\Desktop\Trojaner\OTL.exe
PRC - [2012.07.28 14:18:48 | 000,357,400 | ---- | M] (Sophos Limited) -- C:\Programme\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe
PRC - [2012.07.28 14:18:08 | 002,862,656 | ---- | M] (Sophos Limited) -- C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
PRC - [2012.07.28 14:02:36 | 000,216,600 | ---- | M] (Sophos Limited) -- C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe
PRC - [2012.07.28 13:55:08 | 000,139,840 | ---- | M] (Sophos Limited) -- C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe
PRC - [2012.07.28 13:06:22 | 000,232,472 | ---- | M] (Sophos Limited) -- C:\Programme\Sophos\AutoUpdate\ALsvc.exe
PRC - [2012.07.28 12:58:11 | 000,900,120 | ---- | M] (Sophos Limited) -- C:\Programme\Sophos\AutoUpdate\ALMon.exe
PRC - [2012.05.30 13:56:52 | 003,048,136 | ---- | M] (Skype Technologies S.A.) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2007.03.02 16:48:00 | 000,098,304 | ---- | M] (Brother Industries, Ltd.) -- C:\Programme\Brother\Brmfcmon\BrMfcMon.exe
PRC - [2004.06.11 16:42:14 | 001,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2002.03.19 17:30:00 | 000,045,632 | ---- | M] () -- C:\WINDOWS\system32\TaskSwitch.exe


========== Modules (No Company Name) ==========

MOD - [2006.05.03 17:44:32 | 000,036,864 | ---- | M] () -- C:\WINDOWS\system32\RtlGina2.dll
MOD - [2002.03.19 17:30:00 | 000,045,632 | ---- | M] () -- C:\WINDOWS\system32\TaskSwitch.exe


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2012.07.28 14:26:46 | 001,465,920 | ---- | M] (Sophos Limited) [Auto | Stopped] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos\Web Intelligence\swi_update.exe -- (swi_update)
SRV - [2012.07.28 14:18:48 | 000,357,400 | ---- | M] (Sophos Limited) [Auto | Running] -- C:\Programme\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe -- (Sophos Web Control Service)
SRV - [2012.07.28 14:18:08 | 002,862,656 | ---- | M] (Sophos Limited) [Auto | Running] -- C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe -- (swi_service)
SRV - [2012.07.28 14:02:36 | 000,216,600 | ---- | M] (Sophos Limited) [Auto | Running] -- C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe -- (SAVAdminService)
SRV - [2012.07.28 13:55:08 | 000,139,840 | ---- | M] (Sophos Limited) [Auto | Running] -- C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe -- (SAVService)
SRV - [2012.07.28 13:06:22 | 000,232,472 | ---- | M] (Sophos Limited) [Auto | Running] -- C:\Programme\Sophos\AutoUpdate\ALsvc.exe -- (Sophos AutoUpdate Service)
SRV - [2012.06.03 10:01:56 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.05.30 13:56:52 | 003,048,136 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.02.15 14:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2006.10.26 19:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2004.10.22 03:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2012.07.28 14:33:17 | 000,033,696 | ---- | M] (Sophos Limited) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sdcfilter.sys -- (sdcfilter)
DRV - [2012.07.28 14:12:44 | 000,024,832 | ---- | M] (Sophos Limited) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\savonaccessfilter.sys -- (SAVOnAccessFilter)
DRV - [2012.07.28 14:07:01 | 000,155,392 | ---- | M] (Sophos Limited) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\savonaccesscontrol.sys -- (SAVOnAccessControl)
DRV - [2011.09.21 18:34:33 | 000,014,976 | ---- | M] (Sophos Plc) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\SophosBootDriver.sys -- (SophosBootDriver)
DRV - [2011.09.21 18:28:08 | 000,031,736 | ---- | M] (Sophos Plc) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\skmscan.sys -- (SKMScan)
DRV - [2011.08.05 17:17:55 | 000,721,904 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2006.06.28 16:25:24 | 004,304,384 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService)
DRV - [2006.05.10 15:00:16 | 000,156,160 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2006.03.27 17:53:28 | 000,167,808 | ---- | M] (NETGEAR Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wg111v2.sys -- (RTLWUSB)
DRV - [2001.08.17 14:04:46 | 000,223,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\camdrv21.sys -- (camvid20)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com/?crg=3.1010000&st=10
IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&crg=3.1010000&st=10&q={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com/?crg=3.1010000&st=10
IE - HKCU\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKCU\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&crg=3.1010000&st=10&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "google.de"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.06.03 10:01:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins

[2011.08.01 17:03:08 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Extensions
[2012.05.13 15:46:10 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\aal2ek4g.default\extensions
[2011.08.05 17:20:02 | 000,002,395 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\aal2ek4g.default\searchplugins\daemon-search.xml
[2012.02.04 21:15:09 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.06.10 12:01:04 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.06.03 10:01:55 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.01.29 16:02:49 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.29 15:50:55 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.01.29 16:02:49 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.29 16:02:49 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.29 16:02:49 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.29 16:02:49 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2001.08.23 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [ControlCenter3] C:\Programme\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [CoolSwitch] C:\WINDOWS\system32\TaskSwitch.exe ()
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [LanguageShortcut] C:\Programme\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Programme\Sophos\AutoUpdate\ALMon.exe (Sophos Limited)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe" File not found
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\NETGEAR WG111v2 Smart Wizard.lnk = C:\Programme\NETGEAR\WG111v2\WG111v2.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: UseDesktopIniCache = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1329576840781 (WUWebControl Class)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL) - C:\Programme\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Limited)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (RtlGina2.dll) - C:\WINDOWS\System32\RtlGina2.dll ()
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.08.01 16:33:47 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012.07.28 17:49:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Startmenü\Programme\CyberLink PowerDVD
[2012.07.28 17:10:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Desktop\Trojaner
[2012.07.28 16:57:46 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2012.07.28 14:59:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Sophos
[2012.07.28 14:58:43 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Cisco Systems
[2012.07.28 14:58:29 | 000,030,744 | ---- | C] (Sophos Limited) -- C:\WINDOWS\System32\SophosBootTasks.exe
[2012.07.28 13:33:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Sophos
[2012.07.07 09:03:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Desktop\Neuer Ordner
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012.07.28 17:53:10 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.28 17:49:40 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.28 17:49:26 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.07.28 17:28:03 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.07.28 17:12:55 | 000,000,168 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\defogger_reenable
[2012.07.28 14:33:17 | 000,033,696 | ---- | M] (Sophos Limited) -- C:\WINDOWS\System32\drivers\sdcfilter.sys
[2012.07.28 14:29:00 | 000,030,744 | ---- | M] (Sophos Limited) -- C:\WINDOWS\System32\SophosBootTasks.exe
[2012.07.28 14:12:44 | 000,024,832 | ---- | M] (Sophos Limited) -- C:\WINDOWS\System32\drivers\savonaccessfilter.sys
[2012.07.28 14:07:01 | 000,155,392 | ---- | M] (Sophos Limited) -- C:\WINDOWS\System32\drivers\savonaccesscontrol.sys
[2012.07.15 14:14:08 | 000,002,243 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk
[2012.07.15 13:41:11 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2012.07.15 13:17:59 | 000,030,208 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.07.28 17:12:26 | 000,000,168 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\defogger_reenable
[2012.03.11 17:00:02 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2011.12.17 17:48:25 | 000,036,734 | ---- | C] () -- C:\WINDOWS\System32\OggDSuninst.exe
[2011.12.17 17:46:48 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2011.12.17 15:28:58 | 000,000,064 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\default.pls
[2011.12.17 15:08:29 | 000,000,034 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2011.08.24 19:29:11 | 000,000,425 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2011.08.24 19:29:11 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2011.08.24 19:28:06 | 000,000,000 | ---- | C] () -- C:\WINDOWS\brdfxspd.dat
[2011.08.24 19:26:07 | 000,000,208 | ---- | C] () -- C:\WINDOWS\Brpfx04a.ini
[2011.08.24 19:26:07 | 000,000,093 | ---- | C] () -- C:\WINDOWS\brpcfx.ini
[2011.08.24 19:26:07 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\bridf07a.dat
[2011.08.01 17:25:48 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011.08.01 17:23:22 | 000,263,024 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.08.01 17:03:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2011.08.01 17:01:55 | 000,030,208 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.08.01 16:42:18 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2011.08.01 16:42:18 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2011.08.01 16:39:24 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4704.dll
[2011.08.01 16:35:39 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011.08.01 16:31:03 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

========== LOP Check ==========

[2011.08.05 17:22:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\DAEMON Tools Lite
[2011.08.01 16:37:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BF8051E7-626F-4a11-AF7A-625A7B555862
[2012.02.18 16:15:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Cached Installations
[2011.08.05 17:20:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2012.07.28 15:01:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos

========== Purity Check ==========



< End of report >





Extras.Txt:

OTL Extras logfile created on: 28.07.2012 17:52:52 - Run 1
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Dokumente und Einstellungen\Admin\Desktop\Trojaner
Windows XP Professional Edition Service Pack 2, v.2149 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2149)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1,99 Gb Total Physical Memory | 1,45 Gb Available Physical Memory | 73,08% Memory free
3,84 Gb Paging File | 3,45 Gb Available in Paging File | 89,96% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 232,88 Gb Total Space | 218,92 Gb Free Space | 94,01% Space Free | Partition Type: NTFS
Drive D: | 38,28 Gb Total Space | 9,07 Gb Free Space | 23,68% Space Free | Partition Type: NTFS

Computer Name: PRIVAT | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /k "cd %L" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
"" =
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\CyberLink\PowerDVD\PowerDVD.exe" = C:\Programme\CyberLink\PowerDVD\PowerDVD.exe:*:Enabled:CyberLink PowerDVD -- (CyberLink Corp.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{15C418EB-7675-42be-B2B3-281952DA014D}" = Sophos AutoUpdate
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{9ACB414D-9347-40B6-A453-5EFB2DB59DFA}" = Sophos Anti-Virus
"{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}" = Brother MFL-Pro Suite
"{A7050037-F0EA-4BAB-BCD5-FC05507D6147}" = Alt-Tab Task Switcher Powertoy for Windows XP
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{E0F252A6-DE85-4E93-A93B-DFC3537B3965}" = NETGEAR WG111v2 wireless USB 2.0 adapter
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Audiograbber" = Audiograbber 1.83 SE
"ENTERPRISE" = Microsoft Office Enterprise 2007
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"InstallShield_{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"InstallShield_{E0F252A6-DE85-4E93-A93B-DFC3537B3965}" = NETGEAR WG111v2 wireless USB 2.0 adapter
"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NeroMultiInstaller!UninstallKey" = Nero Suite
"OggDS" = Direct Show Ogg Vorbis Filter (remove only)
"Picasa 3" = Picasa 3
"Windows Media Format Runtime" = Windows Media Format Runtime

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 12.05.2012 05:32:02 | Computer Name = PRIVAT | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 6.0.2900.2149, fehlgeschlagenes
Modul mshtml.dll, Version 6.0.2900.2149, Fehleradresse 0x000673de.

Error - 12.05.2012 06:38:27 | Computer Name = PRIVAT | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung IEXPLORE.EXE, Version 6.0.2900.2149, fehlgeschlagenes
Modul unknown, Version 0.0.0.0, Fehleradresse 0x01ec6100.

Error - 12.05.2012 06:39:03 | Computer Name = PRIVAT | Source = Sophos Anti-Virus | ID = 131073
Description = Es sind keine Versionen der Komponente 'MessageResDSFactory' registriert.
MessageResDSFactory kann nicht ausgegeben werden.

Error - 12.05.2012 06:39:03 | Computer Name = PRIVAT | Source = Sophos Anti-Virus | ID = 131073
Description = Es sind keine Versionen der Komponente 'MessageResDSFactory' registriert.
MessageResDSFactory kann nicht ausgegeben werden.

Error - 13.05.2012 09:36:58 | Computer Name = PRIVAT | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung skype.exe, Version 5.8.0.158, fehlgeschlagenes
Modul jscript.dll, Version 5.6.0.8820, Fehleradresse 0x0001632b.

Error - 13.05.2012 11:49:18 | Computer Name = PRIVAT | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung skype.exe, Version 5.8.0.158, fehlgeschlagenes
Modul jscript.dll, Version 5.6.0.8820, Fehleradresse 0x0001632b.

Error - 07.06.2012 05:40:35 | Computer Name = PRIVAT | Source = Microsoft Office 12 | ID = 5000
Description = EventType officelifeboathang, P1 excel.exe, P2 12.0.4518.1014, P3
ntdll.dll, P4 5.1.2600.2149, P5 NIL, P6 NIL, P7 NIL, P8 NIL, P9 NIL, P10 NIL.

Error - 07.06.2012 14:12:50 | Computer Name = PRIVAT | Source = Microsoft Office 12 | ID = 5000
Description = EventType officelifeboathang, P1 excel.exe, P2 12.0.4518.1014, P3
ntdll.dll, P4 5.1.2600.2149, P5 NIL, P6 NIL, P7 NIL, P8 NIL, P9 NIL, P10 NIL.

Error - 10.06.2012 12:32:16 | Computer Name = PRIVAT | Source = Microsoft Office 12 | ID = 5000
Description = EventType officelifeboathang, P1 excel.exe, P2 12.0.4518.1014, P3
ntdll.dll, P4 5.1.2600.2149, P5 NIL, P6 NIL, P7 NIL, P8 NIL, P9 NIL, P10 NIL.

Error - 28.07.2012 08:54:02 | Computer Name = PRIVAT | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung savprogress.exe, Version 9.7.0.9556, fehlgeschlagenes
Modul savprogress.exe, Version 9.7.0.9556, Fehleradresse 0x0000dd8e.

[ System Events ]
Error - 28.07.2012 07:55:08 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.

Error - 28.07.2012 07:55:27 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.

Error - 28.07.2012 07:57:00 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.

Error - 28.07.2012 07:57:24 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.

Error - 28.07.2012 07:57:44 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.

Error - 28.07.2012 07:58:01 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.

Error - 28.07.2012 07:59:04 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.

Error - 28.07.2012 08:00:48 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.

Error - 28.07.2012 08:02:02 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.

Error - 28.07.2012 08:02:36 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.


< End of report >




gmer.log:

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-07-28 19:36:43
Windows 5.1.2600 Service Pack 2, v.2149 Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T0L0-17 SAMSUNG_SP2504C rev.VT100-49
Running: dp34528c.exe; Driver: C:\DOKUME~1\Admin\LOKALE~1\Temp\ugtdapob.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\system32\DRIVERS\savonaccesscontrol.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Limited) ZwCreateKey [0xA9433640]
SSDT \SystemRoot\system32\DRIVERS\savonaccesscontrol.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Limited) ZwCreateThread [0xA9433B2A]
SSDT \SystemRoot\system32\DRIVERS\savonaccesscontrol.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Limited) ZwDeleteKey [0xA9433796]
SSDT \SystemRoot\system32\DRIVERS\savonaccesscontrol.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Limited) ZwSetSystemInformation [0xA9433E5A]
SSDT \SystemRoot\system32\DRIVERS\savonaccesscontrol.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Limited) ZwSetValueKey [0xA94337FC]

---- Kernel code sections - GMER 1.0.15 ----

.rsrc C:\WINDOWS\system32\DRIVERS\update.sys entry point in ".rsrc" section [0xB9AE2848]

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\svchost.exe[480] ntdll.dll!KiUserExceptionDispatcher 7C92139C 7 Bytes JMP 6FA0A370 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] ntdll.dll!LdrLoadDll 7C92FA67 5 Bytes JMP 6FA0E860 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!CreateFileA 7C801A04 5 Bytes JMP 6FA0E5E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!VirtualProtectEx 7C801A3D 5 Bytes JMP 6FA0E7C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!VirtualProtect 7C801AB0 5 Bytes JMP 6FA0E7A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!LoadLibraryExW 7C801AD1 7 Bytes JMP 6FA0E720 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!LoadLibraryExA 7C801D34 5 Bytes JMP 6FA0E700 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!LoadLibraryA 7C801D5C 5 Bytes JMP 6FA0E6E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!WriteProcessMemory 7C8021FA 5 Bytes JMP 6FA0E840 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!CreateProcessA 7C802328 5 Bytes JMP 6FA0E600 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!FreeLibrary 7C80C640 5 Bytes JMP 6FA0F440 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!GetProcAddress 7C80C7F7 5 Bytes JMP 6FA0E680 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!LoadLibraryW 7C80DCE4 5 Bytes JMP 6FA0E740 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!WriteFile 7C80F02C 7 Bytes JMP 6FA0E800 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!ExitThread 7C80FE54 7 Bytes JMP 6FA0E660 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!ExitProcess 7C815DFF 5 Bytes JMP 6FA0E640 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!CreateProcessInternalA 7C81E5B0 2 Bytes JMP 6FA0E620 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!CreateProcessInternalA + 3 7C81E5B3 2 Bytes [1F, F3]
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!GlobalAlloc 7C825837 7 Bytes JMP 6FA0E6C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!ResumeThread 7C8276F8 5 Bytes JMP 6FA0E760 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!WriteFileEx 7C85AB71 5 Bytes JMP 6FA0E820 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!WinExec 7C85F2B6 5 Bytes JMP 6FA0E7E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!GetThreadContext 7C860A99 5 Bytes JMP 6FA0E6A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!SetThreadContext 7C860AC4 5 Bytes JMP 6FA0E780 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] ntdll.dll!KiUserExceptionDispatcher 7C92139C 7 Bytes JMP 6FA0A370 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] ntdll.dll!LdrLoadDll 7C92FA67 5 Bytes JMP 6FA0E860 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!CreateFileA 7C801A04 5 Bytes JMP 6FA0E5E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!VirtualProtectEx 7C801A3D 5 Bytes JMP 6FA0E7C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!VirtualProtect 7C801AB0 5 Bytes JMP 6FA0E7A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!LoadLibraryExW 7C801AD1 7 Bytes JMP 6FA0E720 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!LoadLibraryExA 7C801D34 5 Bytes JMP 6FA0E700 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!LoadLibraryA 7C801D5C 5 Bytes JMP 6FA0E6E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!WriteProcessMemory 7C8021FA 5 Bytes JMP 6FA0E840 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!CreateProcessA 7C802328 5 Bytes JMP 6FA0E600 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!FreeLibrary 7C80C640 5 Bytes JMP 6FA0F440 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!GetProcAddress 7C80C7F7 5 Bytes JMP 6FA0E680 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!LoadLibraryW 7C80DCE4 5 Bytes JMP 6FA0E740 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!WriteFile 7C80F02C 7 Bytes JMP 6FA0E800 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!ExitThread 7C80FE54 7 Bytes JMP 6FA0E660 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!ExitProcess 7C815DFF 5 Bytes JMP 6FA0E640 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!CreateProcessInternalA 7C81E5B0 2 Bytes JMP 6FA0E620 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!CreateProcessInternalA + 3 7C81E5B3 2 Bytes [1F, F3]
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!GlobalAlloc 7C825837 7 Bytes JMP 6FA0E6C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!ResumeThread 7C8276F8 5 Bytes JMP 6FA0E760 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!WriteFileEx 7C85AB71 5 Bytes JMP 6FA0E820 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!WinExec 7C85F2B6 5 Bytes JMP 6FA0E7E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!GetThreadContext 7C860A99 5 Bytes JMP 6FA0E6A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!SetThreadContext 7C860AC4 5 Bytes JMP 6FA0E780 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!send 71A12974 5 Bytes JMP 6FA0EA20 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!recv 71A12AC5 5 Bytes JMP 6FA0EA00 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!closesocket 71A12F24 5 Bytes JMP 6FA0E980 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!bind 71A132CB 5 Bytes JMP 6FA0E960 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!connect 71A1362F 5 Bytes JMP 6FA0E9A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!WSAStartup 71A15AD9 7 Bytes JMP 6FA0E920 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!WSASocketA 71A17FF3 5 Bytes JMP 6FA0E900 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!listen 71A19910 5 Bytes JMP 6FA0E9E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!accept 71A19A02 5 Bytes JMP 6FA0E940 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!getpeername 71A20DCD 5 Bytes JMP 6FA0E9C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] ntdll.dll!KiUserExceptionDispatcher 7C92139C 7 Bytes JMP 6FA0A370 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] ntdll.dll!LdrLoadDll 7C92FA67 5 Bytes JMP 6FA0E860 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!CreateFileA 7C801A04 5 Bytes JMP 6FA0E5E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!VirtualProtectEx 7C801A3D 5 Bytes JMP 6FA0E7C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!VirtualProtect 7C801AB0 5 Bytes JMP 6FA0E7A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!LoadLibraryExW 7C801AD1 7 Bytes JMP 6FA0E720 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!LoadLibraryExA 7C801D34 5 Bytes JMP 6FA0E700 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!LoadLibraryA 7C801D5C 5 Bytes JMP 6FA0E6E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!WriteProcessMemory 7C8021FA 5 Bytes JMP 6FA0E840 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!CreateProcessA 7C802328 5 Bytes JMP 6FA0E600 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!FreeLibrary 7C80C640 5 Bytes JMP 6FA0F440 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!GetProcAddress 7C80C7F7 5 Bytes JMP 6FA0E680 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!LoadLibraryW 7C80DCE4 5 Bytes JMP 6FA0E740 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!WriteFile 7C80F02C 7 Bytes JMP 6FA0E800 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!ExitThread 7C80FE54 7 Bytes JMP 6FA0E660 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!ExitProcess 7C815DFF 5 Bytes JMP 6FA0E640 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!CreateProcessInternalA 7C81E5B0 2 Bytes JMP 6FA0E620 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!CreateProcessInternalA + 3 7C81E5B3 2 Bytes [1F, F3]
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!GlobalAlloc 7C825837 7 Bytes JMP 6FA0E6C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!ResumeThread 7C8276F8 5 Bytes JMP 6FA0E760 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!WriteFileEx 7C85AB71 5 Bytes JMP 6FA0E820 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!WinExec 7C85F2B6 5 Bytes JMP 6FA0E7E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!GetThreadContext 7C860A99 5 Bytes JMP 6FA0E6A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!SetThreadContext 7C860AC4 5 Bytes JMP 6FA0E780 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!send 71A12974 5 Bytes JMP 6FA0EA20 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!recv 71A12AC5 5 Bytes JMP 6FA0EA00 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!closesocket 71A12F24 5 Bytes JMP 6FA0E980 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!bind 71A132CB 5 Bytes JMP 6FA0E960 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!connect 71A1362F 5 Bytes JMP 6FA0E9A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!WSAStartup 71A15AD9 7 Bytes JMP 6FA0E920 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!WSASocketA 71A17FF3 5 Bytes JMP 6FA0E900 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!listen 71A19910 5 Bytes JMP 6FA0E9E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!accept 71A19A02 5 Bytes JMP 6FA0E940 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!getpeername 71A20DCD 5 Bytes JMP 6FA0E9C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!KiUserExceptionDispatcher 7C92139C 7 Bytes JMP 6FA0A370 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!LdrLoadDll 7C92FA67 5 Bytes JMP 6FA0E860 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateFileA 7C801A04 5 Bytes JMP 6FA0E5E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!VirtualProtectEx 7C801A3D 5 Bytes JMP 6FA0E7C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!VirtualProtect 7C801AB0 5 Bytes JMP 6FA0E7A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!LoadLibraryExW 7C801AD1 7 Bytes JMP 6FA0E720 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!LoadLibraryExA 7C801D34 5 Bytes JMP 6FA0E700 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!LoadLibraryA 7C801D5C 5 Bytes JMP 6FA0E6E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!WriteProcessMemory 7C8021FA 5 Bytes JMP 6FA0E840 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateProcessA 7C802328 5 Bytes JMP 6FA0E600 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!FreeLibrary 7C80C640 5 Bytes JMP 6FA0F440 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!GetProcAddress 7C80C7F7 5 Bytes JMP 6FA0E680 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!LoadLibraryW 7C80DCE4 5 Bytes JMP 6FA0E740 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!WriteFile 7C80F02C 7 Bytes JMP 6FA0E800 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!ExitThread 7C80FE54 7 Bytes JMP 6FA0E660 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!ExitProcess 7C815DFF 5 Bytes JMP 6FA0E640 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateProcessInternalA 7C81E5B0 2 Bytes JMP 6FA0E620 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateProcessInternalA + 3 7C81E5B3 2 Bytes [1F, F3]
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!GlobalAlloc 7C825837 7 Bytes JMP 6FA0E6C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!ResumeThread 7C8276F8 5 Bytes JMP 6FA0E760 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!WriteFileEx 7C85AB71 5 Bytes JMP 6FA0E820 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!WinExec 7C85F2B6 5 Bytes JMP 6FA0E7E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!GetThreadContext 7C860A99 5 Bytes JMP 6FA0E6A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!SetThreadContext 7C860AC4 5 Bytes JMP 6FA0E780 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!send 71A12974 5 Bytes JMP 6FA0EA20 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!recv 71A12AC5 5 Bytes JMP 6FA0EA00 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!closesocket 71A12F24 5 Bytes JMP 6FA0E980 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!bind 71A132CB 5 Bytes JMP 6FA0E960 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!connect 71A1362F 5 Bytes JMP 6FA0E9A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!WSAStartup 71A15AD9 7 Bytes JMP 6FA0E920 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!WSASocketA 71A17FF3 5 Bytes JMP 6FA0E900 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!listen 71A19910 5 Bytes JMP 6FA0E9E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!accept 71A19A02 5 Bytes JMP 6FA0E940 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!getpeername 71A20DCD 5 Bytes JMP 6FA0E9C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] ntdll.dll!KiUserExceptionDispatcher 7C92139C 7 Bytes JMP 6FA0A370 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] ntdll.dll!LdrLoadDll 7C92FA67 5 Bytes JMP 6FA0E860 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!CreateFileA 7C801A04 5 Bytes JMP 6FA0E5E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!VirtualProtectEx 7C801A3D 5 Bytes JMP 6FA0E7C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!VirtualProtect 7C801AB0 5 Bytes JMP 6FA0E7A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!LoadLibraryExW 7C801AD1 7 Bytes JMP 6FA0E720 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!LoadLibraryExA 7C801D34 5 Bytes JMP 6FA0E700 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!LoadLibraryA 7C801D5C 5 Bytes JMP 6FA0E6E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!WriteProcessMemory 7C8021FA 5 Bytes JMP 6FA0E840 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!CreateProcessA 7C802328 5 Bytes JMP 6FA0E600 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!FreeLibrary 7C80C640 5 Bytes JMP 6FA0F440 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!GetProcAddress 7C80C7F7 5 Bytes JMP 6FA0E680 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!LoadLibraryW 7C80DCE4 5 Bytes JMP 6FA0E740 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!WriteFile 7C80F02C 7 Bytes JMP 6FA0E800 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!ExitThread 7C80FE54 7 Bytes JMP 6FA0E660 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!ExitProcess 7C815DFF 5 Bytes JMP 6FA0E640 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!CreateProcessInternalA 7C81E5B0 2 Bytes JMP 6FA0E620 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!CreateProcessInternalA + 3 7C81E5B3 2 Bytes [1F, F3]
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!GlobalAlloc 7C825837 7 Bytes JMP 6FA0E6C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!ResumeThread 7C8276F8 5 Bytes JMP 6FA0E760 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!WriteFileEx 7C85AB71 5 Bytes JMP 6FA0E820 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!WinExec 7C85F2B6 5 Bytes JMP 6FA0E7E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!GetThreadContext 7C860A99 5 Bytes JMP 6FA0E6A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!SetThreadContext 7C860AC4 5 Bytes JMP 6FA0E780 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!send 71A12974 5 Bytes JMP 6FA0EA20 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!recv 71A12AC5 5 Bytes JMP 6FA0EA00 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!closesocket 71A12F24 5 Bytes JMP 6FA0E980 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!bind 71A132CB 5 Bytes JMP 6FA0E960 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!connect 71A1362F 5 Bytes JMP 6FA0E9A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!WSAStartup 71A15AD9 7 Bytes JMP 6FA0E920 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!WSASocketA 71A17FF3 5 Bytes JMP 6FA0E900 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!listen 71A19910 5 Bytes JMP 6FA0E9E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!accept 71A19A02 5 Bytes JMP 6FA0E940 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!getpeername 71A20DCD 5 Bytes JMP 6FA0E9C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WININET.dll!InternetReadFile 75A1B163 5 Bytes JMP 6FA0E8E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WININET.dll!InternetOpenUrlA 75A2C075 7 Bytes JMP 6FA0E8A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WININET.dll!InternetOpenA 75A2DD05 5 Bytes JMP 6FA0E880 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WININET.dll!InternetQueryDataAvailable 75A506E8 5 Bytes JMP 6FA0E8C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] ntdll.dll!KiUserExceptionDispatcher 7C92139C 7 Bytes JMP 6FA0A370 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] ntdll.dll!LdrLoadDll 7C92FA67 5 Bytes JMP 6FA0E860 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!CreateFileA 7C801A04 5 Bytes JMP 6FA0E5E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!VirtualProtectEx 7C801A3D 5 Bytes JMP 6FA0E7C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!VirtualProtect 7C801AB0 5 Bytes JMP 6FA0E7A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!LoadLibraryExW 7C801AD1 7 Bytes JMP 6FA0E720 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!LoadLibraryExA 7C801D34 5 Bytes JMP 6FA0E700 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!LoadLibraryA 7C801D5C 5 Bytes JMP 6FA0E6E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!WriteProcessMemory 7C8021FA 5 Bytes JMP 6FA0E840 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!CreateProcessA 7C802328 5 Bytes JMP 6FA0E600 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!FreeLibrary 7C80C640 5 Bytes JMP 6FA0F440 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!GetProcAddress 7C80C7F7 5 Bytes JMP 6FA0E680 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!LoadLibraryW 7C80DCE4 5 Bytes JMP 6FA0E740 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!WriteFile 7C80F02C 7 Bytes JMP 6FA0E800 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!ExitThread 7C80FE54 7 Bytes JMP 6FA0E660 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!ExitProcess 7C815DFF 5 Bytes JMP 6FA0E640 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!CreateProcessInternalA 7C81E5B0 2 Bytes JMP 6FA0E620 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!CreateProcessInternalA + 3 7C81E5B3 2 Bytes [1F, F3]
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!GlobalAlloc 7C825837 7 Bytes JMP 6FA0E6C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!ResumeThread 7C8276F8 5 Bytes JMP 6FA0E760 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!WriteFileEx 7C85AB71 5 Bytes JMP 6FA0E820 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!WinExec 7C85F2B6 5 Bytes JMP 6FA0E7E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!GetThreadContext 7C860A99 5 Bytes JMP 6FA0E6A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!SetThreadContext 7C860AC4 5 Bytes JMP 6FA0E780 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!send 71A12974 5 Bytes JMP 6FA0EA20 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!recv 71A12AC5 5 Bytes JMP 6FA0EA00 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!closesocket 71A12F24 5 Bytes JMP 6FA0E980 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!bind 71A132CB 5 Bytes JMP 6FA0E960 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!connect 71A1362F 5 Bytes JMP 6FA0E9A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!WSAStartup 71A15AD9 7 Bytes JMP 6FA0E920 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!WSASocketA 71A17FF3 5 Bytes JMP 6FA0E900 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!listen 71A19910 5 Bytes JMP 6FA0E9E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!accept 71A19A02 5 Bytes JMP 6FA0E940 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!getpeername 71A20DCD 5 Bytes JMP 6FA0E9C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] ntdll.dll!KiUserExceptionDispatcher 7C92139C 7 Bytes JMP 6FA0A370 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] ntdll.dll!LdrLoadDll 7C92FA67 5 Bytes JMP 6FA0E860 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!CreateFileA 7C801A04 5 Bytes JMP 6FA0E5E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!VirtualProtectEx 7C801A3D 5 Bytes JMP 6FA0E7C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!VirtualProtect 7C801AB0 5 Bytes JMP 6FA0E7A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!LoadLibraryExW 7C801AD1 7 Bytes JMP 6FA0E720 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!LoadLibraryExA 7C801D34 5 Bytes JMP 6FA0E700 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!LoadLibraryA 7C801D5C 5 Bytes JMP 6FA0E6E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!WriteProcessMemory 7C8021FA 5 Bytes JMP 6FA0E840 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!CreateProcessA 7C802328 5 Bytes JMP 6FA0E600 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!FreeLibrary 7C80C640 5 Bytes JMP 6FA0F440 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!GetProcAddress 7C80C7F7 5 Bytes JMP 6FA0E680 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!LoadLibraryW 7C80DCE4 5 Bytes JMP 6FA0E740 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!WriteFile 7C80F02C 7 Bytes JMP 6FA0E800 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!ExitThread 7C80FE54 7 Bytes JMP 6FA0E660 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!ExitProcess 7C815DFF 5 Bytes JMP 6FA0E640 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!CreateProcessInternalA 7C81E5B0 2 Bytes JMP 6FA0E620 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!CreateProcessInternalA + 3 7C81E5B3 2 Bytes [1F, F3]
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!GlobalAlloc 7C825837 7 Bytes JMP 6FA0E6C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!ResumeThread 7C8276F8 5 Bytes JMP 6FA0E760 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!WriteFileEx 7C85AB71 5 Bytes JMP 6FA0E820 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!WinExec 7C85F2B6 5 Bytes JMP 6FA0E7E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!GetThreadContext 7C860A99 5 Bytes JMP 6FA0E6A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!SetThreadContext 7C860AC4 5 Bytes JMP 6FA0E780 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!send 71A12974 5 Bytes JMP 6FA0EA20 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!recv 71A12AC5 5 Bytes JMP 6FA0EA00 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!closesocket 71A12F24 5 Bytes JMP 6FA0E980 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!bind 71A132CB 5 Bytes JMP 6FA0E960 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!connect 71A1362F 5 Bytes JMP 6FA0E9A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!WSAStartup 71A15AD9 7 Bytes JMP 6FA0E920 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!WSASocketA 71A17FF3 5 Bytes JMP 6FA0E900 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!listen 71A19910 5 Bytes JMP 6FA0E9E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!accept 71A19A02 5 Bytes JMP 6FA0E940 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!getpeername 71A20DCD 5 Bytes JMP 6FA0E9C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WININET.dll!InternetReadFile 75A1B163 5 Bytes JMP 6FA0E8E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WININET.dll!InternetOpenUrlA 75A2C075 7 Bytes JMP 6FA0E8A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WININET.dll!InternetOpenA 75A2DD05 5 Bytes JMP 6FA0E880 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WININET.dll!InternetQueryDataAvailable 75A506E8 5 Bytes JMP 6FA0E8C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] ntdll.dll!KiUserExceptionDispatcher 7C92139C 7 Bytes JMP 6FA0A370 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] ntdll.dll!LdrLoadDll 7C92FA67 5 Bytes JMP 6FA0E860 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!CreateFileA 7C801A04 5 Bytes JMP 6FA0E5E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!VirtualProtectEx 7C801A3D 5 Bytes JMP 6FA0E7C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!VirtualProtect 7C801AB0 5 Bytes JMP 6FA0E7A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!LoadLibraryExW 7C801AD1 7 Bytes JMP 6FA0E720 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!LoadLibraryExA 7C801D34 5 Bytes JMP 6FA0E700 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!LoadLibraryA 7C801D5C 5 Bytes JMP 6FA0E6E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!WriteProcessMemory 7C8021FA 5 Bytes JMP 6FA0E840 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!CreateProcessA 7C802328 5 Bytes JMP 6FA0E600 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!FreeLibrary 7C80C640 5 Bytes JMP 6FA0F440 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!GetProcAddress 7C80C7F7 5 Bytes JMP 6FA0E680 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!LoadLibraryW 7C80DCE4 5 Bytes JMP 6FA0E740 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!WriteFile 7C80F02C 7 Bytes JMP 6FA0E800 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!ExitThread 7C80FE54 7 Bytes JMP 6FA0E660 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!ExitProcess 7C815DFF 5 Bytes JMP 6FA0E640 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!CreateProcessInternalA 7C81E5B0 2 Bytes JMP 6FA0E620 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!CreateProcessInternalA + 3 7C81E5B3 2 Bytes [1F, F3]
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!GlobalAlloc 7C825837 7 Bytes JMP 6FA0E6C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!ResumeThread 7C8276F8 5 Bytes JMP 6FA0E760 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!CopyFileExW 7C833A25 7 Bytes JMP 6FA076F0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!MoveFileWithProgressW 7C833FFD 5 Bytes JMP 6FA07590 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!WriteFileEx 7C85AB71 5 Bytes JMP 6FA0E820 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!WinExec 7C85F2B6 5 Bytes JMP 6FA0E7E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!GetThreadContext 7C860A99 5 Bytes JMP 6FA0E6A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!SetThreadContext 7C860AC4 5 Bytes JMP 6FA0E780 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] ole32.dll!CoCreateInstance 779B50CE 8 Bytes JMP 6FA079D0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WININET.dll!InternetReadFile 75A1B163 5 Bytes JMP 6FA0E8E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WININET.dll!InternetOpenUrlA 75A2C075 7 Bytes JMP 6FA0E8A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WININET.dll!InternetOpenA 75A2DD05 5 Bytes JMP 6FA0E880 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WININET.dll!InternetQueryDataAvailable 75A506E8 5 Bytes JMP 6FA0E8C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!send 71A12974 5 Bytes JMP 6FA0EA20 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!recv 71A12AC5 5 Bytes JMP 6FA0EA00 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!closesocket 71A12F24 5 Bytes JMP 6FA0E980 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!bind 71A132CB 5 Bytes JMP 6FA0E960 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!connect 71A1362F 5 Bytes JMP 6FA0E9A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!WSAStartup 71A15AD9 7 Bytes JMP 6FA0E920 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!WSASocketA 71A17FF3 5 Bytes JMP 6FA0E900 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!listen 71A19910 5 Bytes JMP 6FA0E9E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!accept 71A19A02 5 Bytes JMP 6FA0E940 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!getpeername 71A20DCD 5 Bytes JMP 6FA0E9C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs savonaccessfilter.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Limited)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x9C 0x7F 0x20 0x0B ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x1B 0xAD 0x8F 0xE7 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xD6 0xBC 0xB5 0x66 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x9C 0x7F 0x20 0x0B ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x1B 0xAD 0x8F 0xE7 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xD6 0xBC 0xB5 0x66 ...

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\DRIVERS\update.sys suspicious modification

---- EOF - GMER 1.0.15 ----



So jetzt hoffe ich auf weitere Unterstützung von euch.

LG Isa

P.S. Der Sophos Virenscanner hat ein Button "Bereinigen"; wenn ich diesen drücke ist der Trojaner dann wirklich vom Computer entfernt?

Schön und wo sind die Logs dazu? http://cosgan.de/images/midi/boese/a040.gif

Solche Angaben reichen nicht, bitte poste die vollständigen Angaben/Logs der Virenscanner.

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus: