![]() |
Rechner scheint infiziert, Probleme mit Programmen Ungewöhnliches Verhalten meines Rechners Seit einigen Tagen spielt mein Rechner verrückt. Ich muss mir etwas eingefangen haben. Ich bin völliger Laie, reiner PC-Nutzer. Ich hoffe, dass mir jemand helfen kann. Scans mit FreeAvira, Malwarebyte und Avira PC Cleaner zeigten keine Infizierung (kein Fund). Auf Anraten erfahrener PC-Nutzer habe ich auch AdwCleaner und OTL ausgeführt. Der Rechner wird langsamer, er scheint ständig zu arbeiten (blauer Kreis neben dem Curser dreht ständig), Icons verschwinden, zugehörige Anwendungen (Programme) können nicht gestartet werden bzw. sind deinstalliert. Nach Neuinstallierung von Free Avira meldet dieser "Ihr Computer ist nicht sicher! Ein Dienst arbeitet nicht korrekt". Updates sind nicht mehr möglich, ebenfalls keine Deinstallierung mehr möglich (Meldungen: keine Berechtigung bzw. Setup nicht ausgeführt, Updater läuft, Errorcode 16). Im Voraus besten Dank für baldige Hilfe. |
Hi, Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. ![]() Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: ![]() (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
|
Vielen Dank für die rasche Reaktion. Nachfolgend zunächst die Logfiles der Scans Defogger, FRST und FRST Addition, weitere folgen: Code: defogger_disable by jpshortstuff (23.02.10.1) |
Weitere Logfiles der Scans Gmer, AdwCleaner (R1) u. (S1): [CODE]GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-01-29 18:04:17 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.JE4O 698,64GB Running: Gmer-19357.exe; Driver: C:\Users\JORDAN\AppData\Local\Temp\kgtcipoc.sys ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002ff9000 45 bytes [00, 00, 0C, 02, 53, 65, 4F, ...] INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 574 fffff80002ff902e 17 bytes [5C, 00, 48, 00, 61, 00, 72, ...] ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[1056] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[1056] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[1056] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[1056] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076dd1465 2 bytes [DD, 76] .text C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[1056] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076dd14bb 2 bytes [DD, 76] .text ... * 2 .text C:\Windows\system32\svchost.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\system32\svchost.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\system32\svchost.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\system32\svchost.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Windows\system32\WLANExt.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\system32\WLANExt.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\system32\WLANExt.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\system32\WLANExt.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Windows\system32\Dwm.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\system32\Dwm.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\system32\Dwm.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\system32\Dwm.exe[1404] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Windows\system32\conhost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\system32\conhost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\system32\conhost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\system32\conhost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Windows\Explorer.EXE[1476] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\Explorer.EXE[1476] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\Explorer.EXE[1476] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\Explorer.EXE[1476] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Windows\System32\spoolsv.exe[1584] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\System32\spoolsv.exe[1584] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\System32\spoolsv.exe[1584] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\System32\spoolsv.exe[1584] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Windows\system32\taskhost.exe[1592] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\system32\taskhost.exe[1592] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\system32\taskhost.exe[1592] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\system32\taskhost.exe[1592] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1864] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1864] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1864] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1864] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1880] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1880] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1880] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1880] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1888] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1888] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1888] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1888] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[1900] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[1900] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[1900] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[1900] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Windows\System32\rundll32.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\System32\rundll32.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\System32\rundll32.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\System32\rundll32.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Windows\System32\igfxtray.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\System32\igfxtray.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\System32\igfxtray.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\System32\igfxtray.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Windows\System32\hkcmd.exe[1948] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\System32\hkcmd.exe[1948] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\System32\hkcmd.exe[1948] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\System32\hkcmd.exe[1948] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Windows\System32\igfxpers.exe[1956] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\System32\igfxpers.exe[1956] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\System32\igfxpers.exe[1956] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\System32\igfxpers.exe[1956] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe[2316] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe[2316] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe[2316] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Windows\system32\svchost.exe[2360] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\system32\svchost.exe[2360] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\system32\svchost.exe[2360] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\system32\svchost.exe[2360] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe[2488] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe[2488] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe[2488] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2520] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2520] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2520] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2560] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2560] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2560] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe[2592] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe[2592] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe[2592] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe[2592] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076dd1465 2 bytes [DD, 76] .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe[2592] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076dd14bb 2 bytes [DD, 76] .text ... * 2 .text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2620] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2620] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2620] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files\Windows Sidebar\sidebar.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Program Files\Windows Sidebar\sidebar.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Program Files\Windows Sidebar\sidebar.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Program Files\Windows Sidebar\sidebar.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2980] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2980] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2980] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Launch Manager\HotkeyApp.exe[3040] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Launch Manager\HotkeyApp.exe[3040] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Launch Manager\HotkeyApp.exe[3040] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Launch Manager\OSD.exe[3056] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Launch Manager\OSD.exe[3056] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Launch Manager\OSD.exe[3056] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Launch Manager\WButton.exe[3068] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Launch Manager\WButton.exe[3068] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Launch Manager\WButton.exe[3068] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[980] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[980] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[980] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files\Bonjour\mDNSResponder.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Program Files\Bonjour\mDNSResponder.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Program Files\Bonjour\mDNSResponder.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Program Files\Bonjour\mDNSResponder.exe[3100] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Windows\system32\svchost.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\system32\svchost.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\system32\svchost.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\system32\svchost.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Windows\SysWOW64\svchost.exe[3308] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Windows\SysWOW64\svchost.exe[3308] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Windows\SysWOW64\svchost.exe[3308] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Windows\System32\svchost.exe[3340] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\System32\svchost.exe[3340] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\System32\svchost.exe[3340] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\System32\svchost.exe[3340] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Windows\System32\svchost.exe[3456] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\System32\svchost.exe[3456] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\System32\svchost.exe[3456] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\System32\svchost.exe[3456] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[3488] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[3488] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[3488] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[3536] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[3536] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[3536] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[3536] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[3580] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[3580] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[3580] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[3640] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[3640] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[3640] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[3640] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076dd1465 2 bytes [DD, 76] .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[3640] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076dd14bb 2 bytes [DD, 76] .text ... * 2 .text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[3800] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[3800] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[3800] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[3800] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076dd1465 2 bytes [DD, 76] .text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[3800] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076dd14bb 2 bytes [DD, 76] .text ... * 2 .text C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3836] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3836] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3836] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3836] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076dd1465 2 bytes [DD, 76] .text C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3836] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076dd14bb 2 bytes [DD, 76] .text ... * 2 .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3852] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3852] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3852] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\FreePDF_XP\fpassist.exe[3900] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\FreePDF_XP\fpassist.exe[3900] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\FreePDF_XP\fpassist.exe[3900] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[4020] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[4020] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[4020] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\watchmi\TvdTray.exe[1048] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Program Files (x86)\watchmi\TvdTray.exe[1048] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Program Files (x86)\watchmi\TvdTray.exe[1048] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Program Files (x86)\watchmi\TvdTray.exe[1048] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files (x86)\Verbatim GREEN BUTTON\GREEN BUTTON.exe[1064] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Verbatim GREEN BUTTON\GREEN BUTTON.exe[1064] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Verbatim GREEN BUTTON\GREEN BUTTON.exe[1064] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4192] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4192] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4192] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[4312] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[4312] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[4312] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[4312] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076dd1465 2 bytes [DD, 76] .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[4312] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076dd14bb 2 bytes [DD, 76] .text ... * 2 .text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[4668] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[4668] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[4668] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe[4720] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe[4720] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe[4720] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Windows\system32\svchost.exe[4964] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\system32\svchost.exe[4964] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\system32\svchost.exe[4964] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\system32\svchost.exe[4964] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe[5020] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe[5020] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe[5020] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe[5020] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files (x86)\watchmi\TvdService.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Program Files (x86)\watchmi\TvdService.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Program Files (x86)\watchmi\TvdService.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Program Files (x86)\watchmi\TvdService.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesApp64.exe[4404] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesApp64.exe[4404] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesApp64.exe[4404] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesApp64.exe[4404] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4460] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4460] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4460] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4460] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe[1700] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe[1700] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe[1700] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[1268] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[1268] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[1268] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Windows\system32\wbem\unsecapp.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\system32\wbem\unsecapp.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\system32\wbem\unsecapp.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\system32\wbem\unsecapp.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Windows\system32\wbem\unsecapp.exe[5244] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\system32\wbem\unsecapp.exe[5244] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\system32\wbem\unsecapp.exe[5244] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\system32\wbem\unsecapp.exe[5244] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Windows\system32\wbem\wmiprvse.exe[5380] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\system32\wbem\wmiprvse.exe[5380] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\system32\wbem\wmiprvse.exe[5380] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\system32\wbem\wmiprvse.exe[5380] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[5720] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[5720] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[5720] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[5720] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076dd1465 2 bytes [DD, 76] .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[5720] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076dd14bb 2 bytes [DD, 76] .text ... * 2 .text C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe[5352] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe[5352] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe[5352] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe[5352] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076dd1465 2 bytes [DD, 76] .text C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe[5352] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076dd14bb 2 bytes [DD, 76] .text ... * 2 .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1204] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1204] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1204] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1204] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076dd1465 2 bytes [DD, 76] .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1204] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076dd14bb 2 bytes [DD, 76] .text ... * 2 .text C:\Program Files (x86)\Launch Manager\WisLMSvc.exe[6060] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Launch Manager\WisLMSvc.exe[6060] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Launch Manager\WisLMSvc.exe[6060] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Launch Manager\WisLMSvc.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076dd1465 2 bytes [DD, 76] .text C:\Program Files (x86)\Launch Manager\WisLMSvc.exe[6060] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076dd14bb 2 bytes [DD, 76] .text ... * 2 .text C:\Windows\system32\SearchIndexer.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\system32\SearchIndexer.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\system32\SearchIndexer.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\system32\SearchIndexer.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Windows\system32\svchost.exe[6256] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\system32\svchost.exe[6256] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\system32\svchost.exe[6256] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\system32\svchost.exe[6256] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[6296] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[6296] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[6296] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[6296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076dd1465 2 bytes [DD, 76] .text C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[6296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076dd14bb 2 bytes [DD, 76] .text ... * 2 .text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[6556] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[6556] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[6556] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[6556] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6908] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6908] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6908] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076dd1465 2 bytes [DD, 76] .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076dd14bb 2 bytes [DD, 76] .text ... * 2 .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[6964] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[6964] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[6964] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[6964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076dd1465 2 bytes [DD, 76] .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[6964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076dd14bb 2 bytes [DD, 76] .text ... * 2 .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7012] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7012] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7012] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076dd1465 2 bytes [DD, 76] .text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076dd14bb 2 bytes [DD, 76] .text ... * 2 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6812] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6812] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6812] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6812] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076dd1465 2 bytes [DD, 76] .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6812] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076dd14bb 2 bytes [DD, 76] .text ... * 2 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6844] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6844] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6844] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076dd1465 2 bytes [DD, 76] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076dd14bb 2 bytes [DD, 76] .text ... * 2 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[552] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[552] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[552] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[552] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076dd1465 2 bytes [DD, 76] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[552] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076dd14bb 2 bytes [DD, 76] .text ... * 2 .text C:\Windows\system32\svchost.exe[3120] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\system32\svchost.exe[3120] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\system32\svchost.exe[3120] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\system32\svchost.exe[3120] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Windows\System32\svchost.exe[12816] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\System32\svchost.exe[12816] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\System32\svchost.exe[12816] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\System32\svchost.exe[12816] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Windows\system32\DllHost.exe[14976] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\system32\DllHost.exe[14976] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\system32\DllHost.exe[14976] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\system32\DllHost.exe[14976] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Program Files (x86)\Secunia\PSI\sua.exe[21464] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Program Files (x86)\Secunia\PSI\sua.exe[21464] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Program Files (x86)\Secunia\PSI\sua.exe[21464] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Program Files (x86)\Secunia\PSI\sua.exe[21464] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076dd1465 2 bytes [DD, 76] .text C:\Program Files (x86)\Secunia\PSI\sua.exe[21464] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076dd14bb 2 bytes [DD, 76] .text ... * 2 .text C:\Windows\system32\taskeng.exe[112684] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 00000000774e1430 5 bytes JMP 0000000077640010 .text C:\Windows\system32\taskeng.exe[112684] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000774e1490 5 bytes JMP 0000000077640028 .text C:\Windows\system32\taskeng.exe[112684] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000774e17b0 1 byte JMP 0000000077640040 .text C:\Windows\system32\taskeng.exe[112684] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000774e17b2 3 bytes {JMP 0x15e890} .text C:\Users\JORDAN\Desktop\Gmer-19357.exe[87296] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007768fac0 5 bytes JMP 0000000174ccf6f0 .text C:\Users\JORDAN\Desktop\Gmer-19357.exe[87296] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007768fb58 5 bytes JMP 0000000174ccf830 .text C:\Users\JORDAN\Desktop\Gmer-19357.exe[87296] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077690038 5 bytes JMP 0000000174ccf750 .text C:\Users\JORDAN\Desktop\Gmer-19357.exe[87296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076dd1465 2 bytes [DD, 76] .text C:\Users\JORDAN\Desktop\Gmer-19357.exe[87296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076dd14bb 2 bytes [DD, 76] .text ... * 2 ---- Threads - GMER 2.1 ---- Thread C:\Windows\system32\svchost.exe [692:1088] 000007fefaff8274 Thread C:\Windows\system32\svchost.exe [692:1336] 000007fefaff8274 Thread C:\Windows\system32\conhost.exe [1420:1436] 000007fefa8f93d0 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{465856D0-10D7-4327-92A3-A6EC52BA8FCB}\Connection@Name isatap.{A869A7CF-81C6-4BF1-BE8C-9187D11667AE} Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind \Device\{95B7A090-F33A-4FE4-AA12-FA61A8B4CBE8}?\Device\{1CCE4CB3-5019-4ADA-9A9A-49453D41B614}?\Device\{2F1D6504-5AFC-43E7-B52E-19EF6D159905}??Device\{2F1D6504-5AFC-43E7-B52E-19EF6D159905}? Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route "{95B7A090-F33A-4FE4-AA12-FA61A8B4CBE8}"?"{1CCE4CB3-5019-4ADA-9A9A-49453D41B614}"?"{2F1D6504-5AFC-43E7-B52E-19EF6D159905}"??{2F1D6504-5AFC-43E7-B52E-19EF6D159905}"? Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export \Device\TCPIP6TUNNEL_{95B7A090-F33A-4FE4-AA12-FA61A8B4CBE8}?\Device\TCPIP6TUNNEL_{1CCE4CB3-5019-4ADA-9A9A-49453D41B614}?\Device\TCPIP6TUNNEL_{2F1D6504-5AFC-43E7-B52E-19EF6D159905}??Device\TCPIP6TUNNEL_{2F1D6504-5AFC-43E7-B52E-19EF6D159905}? Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\bc77370eec45 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\bc77379206f2 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\bc77370eec45 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\bc77379206f2 (not active ControlSet) ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ---- AdwCleaner Logfile: Code: # AdwCleaner v3.017 - Bericht erstellt am 27/01/2014 um 17:18:32 AdwCleaner Logfile: Code: # AdwCleaner v3.017 - Bericht erstellt am 27/01/2014 um 17:21:48 |
Und nun die zwei letzten Logfiles (OTL u. OTL Extra): Code: OTL logfile created on: 27.01.2014 17:58:36 - Run 1 |
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
|
Hallo Schrauber, mein Virenscanner (Free Avira) lässt sich bekanntlich z. Zt. weder updaten noch deinstallieren, er lässt sich aber auch nicht deaktivieren. Soll ich Combofix dennoch ausführen? Nachdem Gefahrenmeldungen kamen, habe ich Combofix abgebrochen. Dank und Gruß DiJayK42 |
Versuch mal den Prozess vom AV Programm abzuschiessen, ansonsten einfach Combofix laufen lassen :) |
Wie kann ich den Antivir-Prozess"abschießen"? Gruß |
Taskmanager öffnen, jeden Prozess von Avira anklicken und Task beenden. |
:confused:Hallo Schrauber, danke für die Hilfestellung. Bitte bei Anweisungen immer berücksichtigen: Ich bin bekanntlich totaler Laie und auch nicht mehr der Jüngste (über 70)! Nachfolgend der erste Teil des Scanergebnisses von Combofix, der Rest folgt in einem weitere Code-Tag. Bei einem gestrigen Update-Versuch meines E-Mail-Programms (eM Client) erhielt ich folgende Fehlermeldung: "Beim Herunterladen der Dateien ist der folgende Fehler aufgetreten: Der Remoteserver hat einen Fehler zurückgegeben: (404) Nicht gefunden." Avira Update usw. ebenfalls weiterhin nicht möglich: "Zugriff verweigert." Gruß DiJayK42 Code: ComboFix 14-01-29.01 - JORDAN 01.02.2014 11:10:10.1.4 - x64 |
Nun der restliche Logfile von Combofix: Code: [HKEY_USERS\S-1-5-21-2934081096-936170642-240777201-1000_Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}] |
Nun der restliche Logfile von Combofix: Code: [HKEY_USERS\S-1-5-21-2934081096-936170642-240777201-1000_Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}] |
Downloade Dir bitte ![]()
Downloade Dir bitte ![]()
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte. |
Code: Malwarebytes Anti-Malware 1.75.0.1300 Code: Malwarebytes Anti-Malware 1.75.0.1300 # Updated 28/01/2014 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : JORDAN - JORDAN-NOTEBOOK # Gestartet von : C:\Users\JORDAN\Desktop\adwcleaner.exe # Option : Löschen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** ***** [ Browser ] ***** -\\ Internet Explorer v11.0.9600.16428 -\\ Mozilla Firefox v26.0 (de) [ Datei : C:\Users\JORDAN\AppData\Roaming\Mozilla\Firefox\Profiles\mpuotvc5.default\prefs.js ] Zeile gelöscht : user_pref("extensions.TrafficLightSettings.ph_white", "thecrims.com\nhattrick.org\nraiffeisenonline.ro\nbrd-net.ro\ningonline.ro\nbancpost.ro\nbtrl.ro\ncrediteurope.ro\nalphabank.ro\nromexterra.ro\not[...] -\\ Google Chrome v [ Datei : C:\Users\JORDAN\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [60594 octets] - [31/10/2013 10:47:14] AdwCleaner[R1].txt - [1773 octets] - [27/01/2014 17:18:32] AdwCleaner[R2].txt - [1170 octets] - [27/01/2014 17:48:24] AdwCleaner[R3].txt - [1450 octets] - [02/02/2014 20:50:51] AdwCleaner[S0].txt - [60243 octets] - [31/10/2013 10:49:57] AdwCleaner[S1].txt - [1790 octets] - [27/01/2014 17:21:48] AdwCleaner[S2].txt - [1371 octets] - [02/02/2014 20:52:37] ########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1431 octets] ##########[CODE] Code: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ DiJayK42 FRST Logfile: FRST Logfile: FRST Logfile: Code: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2014 04 --- --- --- --- --- --- |
Alle Zeitangaben in WEZ +1. Es ist jetzt 20:42 Uhr. |
Copyright ©2000-2025, Trojaner-Board