Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Virus/Spyware Troj/JSRedir-HP

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 29.07.2012, 09:52   #1
isabella19
 
Virus/Spyware Troj/JSRedir-HP - Standard

Virus/Spyware Troj/JSRedir-HP



Hallo zusammen,

der Virenscanner meiner Eltern zeigt mir folgenden Virus:

Virus/Spyware Troj/JSRedir-HP

Ich habe die vorgegebenen Programme durchlaufen lassen, hier die log-Datein.


defogger_disable.log:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:12 on 28/07/2012 (Admin)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCUAEMON Tools Lite -> Removed

Checking for services/drivers...
Unable to read sptd.sys
SPTD -> Disabled (Service running -> reboot required)


-=E.O.F=-




OTL.Txt:

OTL logfile created on: 28.07.2012 17:52:51 - Run 1
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Dokumente und Einstellungen\Admin\Desktop\Trojaner
Windows XP Professional Edition Service Pack 2, v.2149 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2149)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1,99 Gb Total Physical Memory | 1,45 Gb Available Physical Memory | 73,08% Memory free
3,84 Gb Paging File | 3,45 Gb Available in Paging File | 89,96% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 232,88 Gb Total Space | 218,92 Gb Free Space | 94,01% Space Free | Partition Type: NTFS
Drive D: | 38,28 Gb Total Space | 9,07 Gb Free Space | 23,68% Space Free | Partition Type: NTFS

Computer Name: PRIVAT | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.07.28 17:24:50 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Admin\Desktop\Trojaner\OTL.exe
PRC - [2012.07.28 14:18:48 | 000,357,400 | ---- | M] (Sophos Limited) -- C:\Programme\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe
PRC - [2012.07.28 14:18:08 | 002,862,656 | ---- | M] (Sophos Limited) -- C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
PRC - [2012.07.28 14:02:36 | 000,216,600 | ---- | M] (Sophos Limited) -- C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe
PRC - [2012.07.28 13:55:08 | 000,139,840 | ---- | M] (Sophos Limited) -- C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe
PRC - [2012.07.28 13:06:22 | 000,232,472 | ---- | M] (Sophos Limited) -- C:\Programme\Sophos\AutoUpdate\ALsvc.exe
PRC - [2012.07.28 12:58:11 | 000,900,120 | ---- | M] (Sophos Limited) -- C:\Programme\Sophos\AutoUpdate\ALMon.exe
PRC - [2012.05.30 13:56:52 | 003,048,136 | ---- | M] (Skype Technologies S.A.) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2007.03.02 16:48:00 | 000,098,304 | ---- | M] (Brother Industries, Ltd.) -- C:\Programme\Brother\Brmfcmon\BrMfcMon.exe
PRC - [2004.06.11 16:42:14 | 001,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2002.03.19 17:30:00 | 000,045,632 | ---- | M] () -- C:\WINDOWS\system32\TaskSwitch.exe


========== Modules (No Company Name) ==========

MOD - [2006.05.03 17:44:32 | 000,036,864 | ---- | M] () -- C:\WINDOWS\system32\RtlGina2.dll
MOD - [2002.03.19 17:30:00 | 000,045,632 | ---- | M] () -- C:\WINDOWS\system32\TaskSwitch.exe


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2012.07.28 14:26:46 | 001,465,920 | ---- | M] (Sophos Limited) [Auto | Stopped] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos\Web Intelligence\swi_update.exe -- (swi_update)
SRV - [2012.07.28 14:18:48 | 000,357,400 | ---- | M] (Sophos Limited) [Auto | Running] -- C:\Programme\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe -- (Sophos Web Control Service)
SRV - [2012.07.28 14:18:08 | 002,862,656 | ---- | M] (Sophos Limited) [Auto | Running] -- C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe -- (swi_service)
SRV - [2012.07.28 14:02:36 | 000,216,600 | ---- | M] (Sophos Limited) [Auto | Running] -- C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe -- (SAVAdminService)
SRV - [2012.07.28 13:55:08 | 000,139,840 | ---- | M] (Sophos Limited) [Auto | Running] -- C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe -- (SAVService)
SRV - [2012.07.28 13:06:22 | 000,232,472 | ---- | M] (Sophos Limited) [Auto | Running] -- C:\Programme\Sophos\AutoUpdate\ALsvc.exe -- (Sophos AutoUpdate Service)
SRV - [2012.06.03 10:01:56 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.05.30 13:56:52 | 003,048,136 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.02.15 14:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2006.10.26 19:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2004.10.22 03:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2012.07.28 14:33:17 | 000,033,696 | ---- | M] (Sophos Limited) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sdcfilter.sys -- (sdcfilter)
DRV - [2012.07.28 14:12:44 | 000,024,832 | ---- | M] (Sophos Limited) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\savonaccessfilter.sys -- (SAVOnAccessFilter)
DRV - [2012.07.28 14:07:01 | 000,155,392 | ---- | M] (Sophos Limited) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\savonaccesscontrol.sys -- (SAVOnAccessControl)
DRV - [2011.09.21 18:34:33 | 000,014,976 | ---- | M] (Sophos Plc) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\SophosBootDriver.sys -- (SophosBootDriver)
DRV - [2011.09.21 18:28:08 | 000,031,736 | ---- | M] (Sophos Plc) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\skmscan.sys -- (SKMScan)
DRV - [2011.08.05 17:17:55 | 000,721,904 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2006.06.28 16:25:24 | 004,304,384 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService)
DRV - [2006.05.10 15:00:16 | 000,156,160 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2006.03.27 17:53:28 | 000,167,808 | ---- | M] (NETGEAR Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wg111v2.sys -- (RTLWUSB)
DRV - [2001.08.17 14:04:46 | 000,223,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\camdrv21.sys -- (camvid20)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com/?crg=3.1010000&st=10
IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&crg=3.1010000&st=10&q={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com/?crg=3.1010000&st=10
IE - HKCU\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKCU\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&crg=3.1010000&st=10&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "google.de"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.06.03 10:01:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins

[2011.08.01 17:03:08 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Extensions
[2012.05.13 15:46:10 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\aal2ek4g.default\extensions
[2011.08.05 17:20:02 | 000,002,395 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\aal2ek4g.default\searchplugins\daemon-search.xml
[2012.02.04 21:15:09 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.06.10 12:01:04 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.06.03 10:01:55 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.01.29 16:02:49 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.29 15:50:55 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.01.29 16:02:49 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.29 16:02:49 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.29 16:02:49 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.29 16:02:49 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2001.08.23 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [ControlCenter3] C:\Programme\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [CoolSwitch] C:\WINDOWS\system32\TaskSwitch.exe ()
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [LanguageShortcut] C:\Programme\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Programme\Sophos\AutoUpdate\ALMon.exe (Sophos Limited)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe" File not found
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\NETGEAR WG111v2 Smart Wizard.lnk = C:\Programme\NETGEAR\WG111v2\WG111v2.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: UseDesktopIniCache = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos\Web Intelligence\swi_ifslsp.dll (Sophos Limited)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1329576840781 (WUWebControl Class)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL) - C:\Programme\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Limited)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (RtlGina2.dll) - C:\WINDOWS\System32\RtlGina2.dll ()
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.08.01 16:33:47 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012.07.28 17:49:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Startmenü\Programme\CyberLink PowerDVD
[2012.07.28 17:10:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Desktop\Trojaner
[2012.07.28 16:57:46 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2012.07.28 14:59:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Sophos
[2012.07.28 14:58:43 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Cisco Systems
[2012.07.28 14:58:29 | 000,030,744 | ---- | C] (Sophos Limited) -- C:\WINDOWS\System32\SophosBootTasks.exe
[2012.07.28 13:33:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Sophos
[2012.07.07 09:03:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Desktop\Neuer Ordner
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012.07.28 17:53:10 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.28 17:49:40 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.28 17:49:26 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.07.28 17:28:03 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.07.28 17:12:55 | 000,000,168 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\defogger_reenable
[2012.07.28 14:33:17 | 000,033,696 | ---- | M] (Sophos Limited) -- C:\WINDOWS\System32\drivers\sdcfilter.sys
[2012.07.28 14:29:00 | 000,030,744 | ---- | M] (Sophos Limited) -- C:\WINDOWS\System32\SophosBootTasks.exe
[2012.07.28 14:12:44 | 000,024,832 | ---- | M] (Sophos Limited) -- C:\WINDOWS\System32\drivers\savonaccessfilter.sys
[2012.07.28 14:07:01 | 000,155,392 | ---- | M] (Sophos Limited) -- C:\WINDOWS\System32\drivers\savonaccesscontrol.sys
[2012.07.15 14:14:08 | 000,002,243 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk
[2012.07.15 13:41:11 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2012.07.15 13:17:59 | 000,030,208 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.07.28 17:12:26 | 000,000,168 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\defogger_reenable
[2012.03.11 17:00:02 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2011.12.17 17:48:25 | 000,036,734 | ---- | C] () -- C:\WINDOWS\System32\OggDSuninst.exe
[2011.12.17 17:46:48 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2011.12.17 15:28:58 | 000,000,064 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\default.pls
[2011.12.17 15:08:29 | 000,000,034 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2011.08.24 19:29:11 | 000,000,425 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2011.08.24 19:29:11 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2011.08.24 19:28:06 | 000,000,000 | ---- | C] () -- C:\WINDOWS\brdfxspd.dat
[2011.08.24 19:26:07 | 000,000,208 | ---- | C] () -- C:\WINDOWS\Brpfx04a.ini
[2011.08.24 19:26:07 | 000,000,093 | ---- | C] () -- C:\WINDOWS\brpcfx.ini
[2011.08.24 19:26:07 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\bridf07a.dat
[2011.08.01 17:25:48 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011.08.01 17:23:22 | 000,263,024 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.08.01 17:03:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2011.08.01 17:01:55 | 000,030,208 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.08.01 16:42:18 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2011.08.01 16:42:18 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2011.08.01 16:39:24 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4704.dll
[2011.08.01 16:35:39 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011.08.01 16:31:03 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

========== LOP Check ==========

[2011.08.05 17:22:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\DAEMON Tools Lite
[2011.08.01 16:37:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BF8051E7-626F-4a11-AF7A-625A7B555862
[2012.02.18 16:15:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Cached Installations
[2011.08.05 17:20:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2012.07.28 15:01:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos

========== Purity Check ==========



< End of report >





Extras.Txt:

OTL Extras logfile created on: 28.07.2012 17:52:52 - Run 1
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Dokumente und Einstellungen\Admin\Desktop\Trojaner
Windows XP Professional Edition Service Pack 2, v.2149 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2149)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1,99 Gb Total Physical Memory | 1,45 Gb Available Physical Memory | 73,08% Memory free
3,84 Gb Paging File | 3,45 Gb Available in Paging File | 89,96% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 232,88 Gb Total Space | 218,92 Gb Free Space | 94,01% Space Free | Partition Type: NTFS
Drive D: | 38,28 Gb Total Space | 9,07 Gb Free Space | 23,68% Space Free | Partition Type: NTFS

Computer Name: PRIVAT | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /k "cd %L" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
"" =
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\CyberLink\PowerDVD\PowerDVD.exe" = C:\Programme\CyberLink\PowerDVD\PowerDVD.exe:*:Enabled:CyberLink PowerDVD -- (CyberLink Corp.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{15C418EB-7675-42be-B2B3-281952DA014D}" = Sophos AutoUpdate
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{9ACB414D-9347-40B6-A453-5EFB2DB59DFA}" = Sophos Anti-Virus
"{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}" = Brother MFL-Pro Suite
"{A7050037-F0EA-4BAB-BCD5-FC05507D6147}" = Alt-Tab Task Switcher Powertoy for Windows XP
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{E0F252A6-DE85-4E93-A93B-DFC3537B3965}" = NETGEAR WG111v2 wireless USB 2.0 adapter
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Audiograbber" = Audiograbber 1.83 SE
"ENTERPRISE" = Microsoft Office Enterprise 2007
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"InstallShield_{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"InstallShield_{E0F252A6-DE85-4E93-A93B-DFC3537B3965}" = NETGEAR WG111v2 wireless USB 2.0 adapter
"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NeroMultiInstaller!UninstallKey" = Nero Suite
"OggDS" = Direct Show Ogg Vorbis Filter (remove only)
"Picasa 3" = Picasa 3
"Windows Media Format Runtime" = Windows Media Format Runtime

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 12.05.2012 05:32:02 | Computer Name = PRIVAT | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 6.0.2900.2149, fehlgeschlagenes
Modul mshtml.dll, Version 6.0.2900.2149, Fehleradresse 0x000673de.

Error - 12.05.2012 06:38:27 | Computer Name = PRIVAT | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung IEXPLORE.EXE, Version 6.0.2900.2149, fehlgeschlagenes
Modul unknown, Version 0.0.0.0, Fehleradresse 0x01ec6100.

Error - 12.05.2012 06:39:03 | Computer Name = PRIVAT | Source = Sophos Anti-Virus | ID = 131073
Description = Es sind keine Versionen der Komponente 'MessageResDSFactory' registriert.
MessageResDSFactory kann nicht ausgegeben werden.

Error - 12.05.2012 06:39:03 | Computer Name = PRIVAT | Source = Sophos Anti-Virus | ID = 131073
Description = Es sind keine Versionen der Komponente 'MessageResDSFactory' registriert.
MessageResDSFactory kann nicht ausgegeben werden.

Error - 13.05.2012 09:36:58 | Computer Name = PRIVAT | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung skype.exe, Version 5.8.0.158, fehlgeschlagenes
Modul jscript.dll, Version 5.6.0.8820, Fehleradresse 0x0001632b.

Error - 13.05.2012 11:49:18 | Computer Name = PRIVAT | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung skype.exe, Version 5.8.0.158, fehlgeschlagenes
Modul jscript.dll, Version 5.6.0.8820, Fehleradresse 0x0001632b.

Error - 07.06.2012 05:40:35 | Computer Name = PRIVAT | Source = Microsoft Office 12 | ID = 5000
Description = EventType officelifeboathang, P1 excel.exe, P2 12.0.4518.1014, P3
ntdll.dll, P4 5.1.2600.2149, P5 NIL, P6 NIL, P7 NIL, P8 NIL, P9 NIL, P10 NIL.

Error - 07.06.2012 14:12:50 | Computer Name = PRIVAT | Source = Microsoft Office 12 | ID = 5000
Description = EventType officelifeboathang, P1 excel.exe, P2 12.0.4518.1014, P3
ntdll.dll, P4 5.1.2600.2149, P5 NIL, P6 NIL, P7 NIL, P8 NIL, P9 NIL, P10 NIL.

Error - 10.06.2012 12:32:16 | Computer Name = PRIVAT | Source = Microsoft Office 12 | ID = 5000
Description = EventType officelifeboathang, P1 excel.exe, P2 12.0.4518.1014, P3
ntdll.dll, P4 5.1.2600.2149, P5 NIL, P6 NIL, P7 NIL, P8 NIL, P9 NIL, P10 NIL.

Error - 28.07.2012 08:54:02 | Computer Name = PRIVAT | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung savprogress.exe, Version 9.7.0.9556, fehlgeschlagenes
Modul savprogress.exe, Version 9.7.0.9556, Fehleradresse 0x0000dd8e.

[ System Events ]
Error - 28.07.2012 07:55:08 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.

Error - 28.07.2012 07:55:27 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.

Error - 28.07.2012 07:57:00 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.

Error - 28.07.2012 07:57:24 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.

Error - 28.07.2012 07:57:44 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.

Error - 28.07.2012 07:58:01 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.

Error - 28.07.2012 07:59:04 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.

Error - 28.07.2012 08:00:48 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.

Error - 28.07.2012 08:02:02 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.

Error - 28.07.2012 08:02:36 | Computer Name = PRIVAT | Source = atapi | ID = 262153
Description = Das Gerät \Device\Ide\IdePort1 hat innerhalb der Fehlerwartezeit nicht
geantwortet.


< End of report >




gmer.log:

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-07-28 19:36:43
Windows 5.1.2600 Service Pack 2, v.2149 Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T0L0-17 SAMSUNG_SP2504C rev.VT100-49
Running: dp34528c.exe; Driver: C:\DOKUME~1\Admin\LOKALE~1\Temp\ugtdapob.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\system32\DRIVERS\savonaccesscontrol.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Limited) ZwCreateKey [0xA9433640]
SSDT \SystemRoot\system32\DRIVERS\savonaccesscontrol.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Limited) ZwCreateThread [0xA9433B2A]
SSDT \SystemRoot\system32\DRIVERS\savonaccesscontrol.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Limited) ZwDeleteKey [0xA9433796]
SSDT \SystemRoot\system32\DRIVERS\savonaccesscontrol.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Limited) ZwSetSystemInformation [0xA9433E5A]
SSDT \SystemRoot\system32\DRIVERS\savonaccesscontrol.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Limited) ZwSetValueKey [0xA94337FC]

---- Kernel code sections - GMER 1.0.15 ----

.rsrc C:\WINDOWS\system32\DRIVERS\update.sys entry point in ".rsrc" section [0xB9AE2848]

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\svchost.exe[480] ntdll.dll!KiUserExceptionDispatcher 7C92139C 7 Bytes JMP 6FA0A370 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] ntdll.dll!LdrLoadDll 7C92FA67 5 Bytes JMP 6FA0E860 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!CreateFileA 7C801A04 5 Bytes JMP 6FA0E5E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!VirtualProtectEx 7C801A3D 5 Bytes JMP 6FA0E7C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!VirtualProtect 7C801AB0 5 Bytes JMP 6FA0E7A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!LoadLibraryExW 7C801AD1 7 Bytes JMP 6FA0E720 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!LoadLibraryExA 7C801D34 5 Bytes JMP 6FA0E700 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!LoadLibraryA 7C801D5C 5 Bytes JMP 6FA0E6E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!WriteProcessMemory 7C8021FA 5 Bytes JMP 6FA0E840 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!CreateProcessA 7C802328 5 Bytes JMP 6FA0E600 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!FreeLibrary 7C80C640 5 Bytes JMP 6FA0F440 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!GetProcAddress 7C80C7F7 5 Bytes JMP 6FA0E680 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!LoadLibraryW 7C80DCE4 5 Bytes JMP 6FA0E740 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!WriteFile 7C80F02C 7 Bytes JMP 6FA0E800 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!ExitThread 7C80FE54 7 Bytes JMP 6FA0E660 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!ExitProcess 7C815DFF 5 Bytes JMP 6FA0E640 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!CreateProcessInternalA 7C81E5B0 2 Bytes JMP 6FA0E620 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!CreateProcessInternalA + 3 7C81E5B3 2 Bytes [1F, F3]
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!GlobalAlloc 7C825837 7 Bytes JMP 6FA0E6C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!ResumeThread 7C8276F8 5 Bytes JMP 6FA0E760 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!WriteFileEx 7C85AB71 5 Bytes JMP 6FA0E820 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!WinExec 7C85F2B6 5 Bytes JMP 6FA0E7E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!GetThreadContext 7C860A99 5 Bytes JMP 6FA0E6A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[480] kernel32.dll!SetThreadContext 7C860AC4 5 Bytes JMP 6FA0E780 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] ntdll.dll!KiUserExceptionDispatcher 7C92139C 7 Bytes JMP 6FA0A370 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] ntdll.dll!LdrLoadDll 7C92FA67 5 Bytes JMP 6FA0E860 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!CreateFileA 7C801A04 5 Bytes JMP 6FA0E5E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!VirtualProtectEx 7C801A3D 5 Bytes JMP 6FA0E7C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!VirtualProtect 7C801AB0 5 Bytes JMP 6FA0E7A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!LoadLibraryExW 7C801AD1 7 Bytes JMP 6FA0E720 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!LoadLibraryExA 7C801D34 5 Bytes JMP 6FA0E700 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!LoadLibraryA 7C801D5C 5 Bytes JMP 6FA0E6E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!WriteProcessMemory 7C8021FA 5 Bytes JMP 6FA0E840 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!CreateProcessA 7C802328 5 Bytes JMP 6FA0E600 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!FreeLibrary 7C80C640 5 Bytes JMP 6FA0F440 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!GetProcAddress 7C80C7F7 5 Bytes JMP 6FA0E680 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!LoadLibraryW 7C80DCE4 5 Bytes JMP 6FA0E740 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!WriteFile 7C80F02C 7 Bytes JMP 6FA0E800 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!ExitThread 7C80FE54 7 Bytes JMP 6FA0E660 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!ExitProcess 7C815DFF 5 Bytes JMP 6FA0E640 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!CreateProcessInternalA 7C81E5B0 2 Bytes JMP 6FA0E620 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!CreateProcessInternalA + 3 7C81E5B3 2 Bytes [1F, F3]
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!GlobalAlloc 7C825837 7 Bytes JMP 6FA0E6C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!ResumeThread 7C8276F8 5 Bytes JMP 6FA0E760 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!WriteFileEx 7C85AB71 5 Bytes JMP 6FA0E820 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!WinExec 7C85F2B6 5 Bytes JMP 6FA0E7E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!GetThreadContext 7C860A99 5 Bytes JMP 6FA0E6A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!SetThreadContext 7C860AC4 5 Bytes JMP 6FA0E780 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!send 71A12974 5 Bytes JMP 6FA0EA20 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!recv 71A12AC5 5 Bytes JMP 6FA0EA00 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!closesocket 71A12F24 5 Bytes JMP 6FA0E980 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!bind 71A132CB 5 Bytes JMP 6FA0E960 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!connect 71A1362F 5 Bytes JMP 6FA0E9A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!WSAStartup 71A15AD9 7 Bytes JMP 6FA0E920 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!WSASocketA 71A17FF3 5 Bytes JMP 6FA0E900 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!listen 71A19910 5 Bytes JMP 6FA0E9E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!accept 71A19A02 5 Bytes JMP 6FA0E940 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\lsass.exe[948] WS2_32.dll!getpeername 71A20DCD 5 Bytes JMP 6FA0E9C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] ntdll.dll!KiUserExceptionDispatcher 7C92139C 7 Bytes JMP 6FA0A370 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] ntdll.dll!LdrLoadDll 7C92FA67 5 Bytes JMP 6FA0E860 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!CreateFileA 7C801A04 5 Bytes JMP 6FA0E5E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!VirtualProtectEx 7C801A3D 5 Bytes JMP 6FA0E7C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!VirtualProtect 7C801AB0 5 Bytes JMP 6FA0E7A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!LoadLibraryExW 7C801AD1 7 Bytes JMP 6FA0E720 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!LoadLibraryExA 7C801D34 5 Bytes JMP 6FA0E700 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!LoadLibraryA 7C801D5C 5 Bytes JMP 6FA0E6E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!WriteProcessMemory 7C8021FA 5 Bytes JMP 6FA0E840 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!CreateProcessA 7C802328 5 Bytes JMP 6FA0E600 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!FreeLibrary 7C80C640 5 Bytes JMP 6FA0F440 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!GetProcAddress 7C80C7F7 5 Bytes JMP 6FA0E680 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!LoadLibraryW 7C80DCE4 5 Bytes JMP 6FA0E740 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!WriteFile 7C80F02C 7 Bytes JMP 6FA0E800 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!ExitThread 7C80FE54 7 Bytes JMP 6FA0E660 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!ExitProcess 7C815DFF 5 Bytes JMP 6FA0E640 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!CreateProcessInternalA 7C81E5B0 2 Bytes JMP 6FA0E620 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!CreateProcessInternalA + 3 7C81E5B3 2 Bytes [1F, F3]
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!GlobalAlloc 7C825837 7 Bytes JMP 6FA0E6C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!ResumeThread 7C8276F8 5 Bytes JMP 6FA0E760 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!WriteFileEx 7C85AB71 5 Bytes JMP 6FA0E820 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!WinExec 7C85F2B6 5 Bytes JMP 6FA0E7E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!GetThreadContext 7C860A99 5 Bytes JMP 6FA0E6A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] kernel32.dll!SetThreadContext 7C860AC4 5 Bytes JMP 6FA0E780 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!send 71A12974 5 Bytes JMP 6FA0EA20 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!recv 71A12AC5 5 Bytes JMP 6FA0EA00 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!closesocket 71A12F24 5 Bytes JMP 6FA0E980 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!bind 71A132CB 5 Bytes JMP 6FA0E960 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!connect 71A1362F 5 Bytes JMP 6FA0E9A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!WSAStartup 71A15AD9 7 Bytes JMP 6FA0E920 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!WSASocketA 71A17FF3 5 Bytes JMP 6FA0E900 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!listen 71A19910 5 Bytes JMP 6FA0E9E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!accept 71A19A02 5 Bytes JMP 6FA0E940 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1112] WS2_32.dll!getpeername 71A20DCD 5 Bytes JMP 6FA0E9C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!KiUserExceptionDispatcher 7C92139C 7 Bytes JMP 6FA0A370 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!LdrLoadDll 7C92FA67 5 Bytes JMP 6FA0E860 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateFileA 7C801A04 5 Bytes JMP 6FA0E5E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!VirtualProtectEx 7C801A3D 5 Bytes JMP 6FA0E7C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!VirtualProtect 7C801AB0 5 Bytes JMP 6FA0E7A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!LoadLibraryExW 7C801AD1 7 Bytes JMP 6FA0E720 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!LoadLibraryExA 7C801D34 5 Bytes JMP 6FA0E700 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!LoadLibraryA 7C801D5C 5 Bytes JMP 6FA0E6E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!WriteProcessMemory 7C8021FA 5 Bytes JMP 6FA0E840 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateProcessA 7C802328 5 Bytes JMP 6FA0E600 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!FreeLibrary 7C80C640 5 Bytes JMP 6FA0F440 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!GetProcAddress 7C80C7F7 5 Bytes JMP 6FA0E680 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!LoadLibraryW 7C80DCE4 5 Bytes JMP 6FA0E740 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!WriteFile 7C80F02C 7 Bytes JMP 6FA0E800 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!ExitThread 7C80FE54 7 Bytes JMP 6FA0E660 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!ExitProcess 7C815DFF 5 Bytes JMP 6FA0E640 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateProcessInternalA 7C81E5B0 2 Bytes JMP 6FA0E620 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateProcessInternalA + 3 7C81E5B3 2 Bytes [1F, F3]
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!GlobalAlloc 7C825837 7 Bytes JMP 6FA0E6C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!ResumeThread 7C8276F8 5 Bytes JMP 6FA0E760 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!WriteFileEx 7C85AB71 5 Bytes JMP 6FA0E820 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!WinExec 7C85F2B6 5 Bytes JMP 6FA0E7E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!GetThreadContext 7C860A99 5 Bytes JMP 6FA0E6A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!SetThreadContext 7C860AC4 5 Bytes JMP 6FA0E780 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!send 71A12974 5 Bytes JMP 6FA0EA20 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!recv 71A12AC5 5 Bytes JMP 6FA0EA00 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!closesocket 71A12F24 5 Bytes JMP 6FA0E980 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!bind 71A132CB 5 Bytes JMP 6FA0E960 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!connect 71A1362F 5 Bytes JMP 6FA0E9A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!WSAStartup 71A15AD9 7 Bytes JMP 6FA0E920 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!WSASocketA 71A17FF3 5 Bytes JMP 6FA0E900 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!listen 71A19910 5 Bytes JMP 6FA0E9E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!accept 71A19A02 5 Bytes JMP 6FA0E940 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!getpeername 71A20DCD 5 Bytes JMP 6FA0E9C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] ntdll.dll!KiUserExceptionDispatcher 7C92139C 7 Bytes JMP 6FA0A370 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] ntdll.dll!LdrLoadDll 7C92FA67 5 Bytes JMP 6FA0E860 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!CreateFileA 7C801A04 5 Bytes JMP 6FA0E5E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!VirtualProtectEx 7C801A3D 5 Bytes JMP 6FA0E7C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!VirtualProtect 7C801AB0 5 Bytes JMP 6FA0E7A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!LoadLibraryExW 7C801AD1 7 Bytes JMP 6FA0E720 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!LoadLibraryExA 7C801D34 5 Bytes JMP 6FA0E700 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!LoadLibraryA 7C801D5C 5 Bytes JMP 6FA0E6E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!WriteProcessMemory 7C8021FA 5 Bytes JMP 6FA0E840 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!CreateProcessA 7C802328 5 Bytes JMP 6FA0E600 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!FreeLibrary 7C80C640 5 Bytes JMP 6FA0F440 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!GetProcAddress 7C80C7F7 5 Bytes JMP 6FA0E680 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!LoadLibraryW 7C80DCE4 5 Bytes JMP 6FA0E740 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!WriteFile 7C80F02C 7 Bytes JMP 6FA0E800 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!ExitThread 7C80FE54 7 Bytes JMP 6FA0E660 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!ExitProcess 7C815DFF 5 Bytes JMP 6FA0E640 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!CreateProcessInternalA 7C81E5B0 2 Bytes JMP 6FA0E620 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!CreateProcessInternalA + 3 7C81E5B3 2 Bytes [1F, F3]
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!GlobalAlloc 7C825837 7 Bytes JMP 6FA0E6C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!ResumeThread 7C8276F8 5 Bytes JMP 6FA0E760 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!WriteFileEx 7C85AB71 5 Bytes JMP 6FA0E820 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!WinExec 7C85F2B6 5 Bytes JMP 6FA0E7E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!GetThreadContext 7C860A99 5 Bytes JMP 6FA0E6A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] kernel32.dll!SetThreadContext 7C860AC4 5 Bytes JMP 6FA0E780 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!send 71A12974 5 Bytes JMP 6FA0EA20 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!recv 71A12AC5 5 Bytes JMP 6FA0EA00 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!closesocket 71A12F24 5 Bytes JMP 6FA0E980 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!bind 71A132CB 5 Bytes JMP 6FA0E960 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!connect 71A1362F 5 Bytes JMP 6FA0E9A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!WSAStartup 71A15AD9 7 Bytes JMP 6FA0E920 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!WSASocketA 71A17FF3 5 Bytes JMP 6FA0E900 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!listen 71A19910 5 Bytes JMP 6FA0E9E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!accept 71A19A02 5 Bytes JMP 6FA0E940 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WS2_32.dll!getpeername 71A20DCD 5 Bytes JMP 6FA0E9C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WININET.dll!InternetReadFile 75A1B163 5 Bytes JMP 6FA0E8E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WININET.dll!InternetOpenUrlA 75A2C075 7 Bytes JMP 6FA0E8A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WININET.dll!InternetOpenA 75A2DD05 5 Bytes JMP 6FA0E880 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\System32\svchost.exe[1216] WININET.dll!InternetQueryDataAvailable 75A506E8 5 Bytes JMP 6FA0E8C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] ntdll.dll!KiUserExceptionDispatcher 7C92139C 7 Bytes JMP 6FA0A370 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] ntdll.dll!LdrLoadDll 7C92FA67 5 Bytes JMP 6FA0E860 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!CreateFileA 7C801A04 5 Bytes JMP 6FA0E5E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!VirtualProtectEx 7C801A3D 5 Bytes JMP 6FA0E7C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!VirtualProtect 7C801AB0 5 Bytes JMP 6FA0E7A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!LoadLibraryExW 7C801AD1 7 Bytes JMP 6FA0E720 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!LoadLibraryExA 7C801D34 5 Bytes JMP 6FA0E700 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!LoadLibraryA 7C801D5C 5 Bytes JMP 6FA0E6E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!WriteProcessMemory 7C8021FA 5 Bytes JMP 6FA0E840 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!CreateProcessA 7C802328 5 Bytes JMP 6FA0E600 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!FreeLibrary 7C80C640 5 Bytes JMP 6FA0F440 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!GetProcAddress 7C80C7F7 5 Bytes JMP 6FA0E680 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!LoadLibraryW 7C80DCE4 5 Bytes JMP 6FA0E740 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!WriteFile 7C80F02C 7 Bytes JMP 6FA0E800 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!ExitThread 7C80FE54 7 Bytes JMP 6FA0E660 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!ExitProcess 7C815DFF 5 Bytes JMP 6FA0E640 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!CreateProcessInternalA 7C81E5B0 2 Bytes JMP 6FA0E620 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!CreateProcessInternalA + 3 7C81E5B3 2 Bytes [1F, F3]
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!GlobalAlloc 7C825837 7 Bytes JMP 6FA0E6C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!ResumeThread 7C8276F8 5 Bytes JMP 6FA0E760 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!WriteFileEx 7C85AB71 5 Bytes JMP 6FA0E820 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!WinExec 7C85F2B6 5 Bytes JMP 6FA0E7E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!GetThreadContext 7C860A99 5 Bytes JMP 6FA0E6A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] kernel32.dll!SetThreadContext 7C860AC4 5 Bytes JMP 6FA0E780 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!send 71A12974 5 Bytes JMP 6FA0EA20 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!recv 71A12AC5 5 Bytes JMP 6FA0EA00 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!closesocket 71A12F24 5 Bytes JMP 6FA0E980 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!bind 71A132CB 5 Bytes JMP 6FA0E960 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!connect 71A1362F 5 Bytes JMP 6FA0E9A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!WSAStartup 71A15AD9 7 Bytes JMP 6FA0E920 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!WSASocketA 71A17FF3 5 Bytes JMP 6FA0E900 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!listen 71A19910 5 Bytes JMP 6FA0E9E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!accept 71A19A02 5 Bytes JMP 6FA0E940 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1572] WS2_32.dll!getpeername 71A20DCD 5 Bytes JMP 6FA0E9C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] ntdll.dll!KiUserExceptionDispatcher 7C92139C 7 Bytes JMP 6FA0A370 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] ntdll.dll!LdrLoadDll 7C92FA67 5 Bytes JMP 6FA0E860 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!CreateFileA 7C801A04 5 Bytes JMP 6FA0E5E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!VirtualProtectEx 7C801A3D 5 Bytes JMP 6FA0E7C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!VirtualProtect 7C801AB0 5 Bytes JMP 6FA0E7A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!LoadLibraryExW 7C801AD1 7 Bytes JMP 6FA0E720 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!LoadLibraryExA 7C801D34 5 Bytes JMP 6FA0E700 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!LoadLibraryA 7C801D5C 5 Bytes JMP 6FA0E6E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!WriteProcessMemory 7C8021FA 5 Bytes JMP 6FA0E840 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!CreateProcessA 7C802328 5 Bytes JMP 6FA0E600 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!FreeLibrary 7C80C640 5 Bytes JMP 6FA0F440 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!GetProcAddress 7C80C7F7 5 Bytes JMP 6FA0E680 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!LoadLibraryW 7C80DCE4 5 Bytes JMP 6FA0E740 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!WriteFile 7C80F02C 7 Bytes JMP 6FA0E800 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!ExitThread 7C80FE54 7 Bytes JMP 6FA0E660 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!ExitProcess 7C815DFF 5 Bytes JMP 6FA0E640 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!CreateProcessInternalA 7C81E5B0 2 Bytes JMP 6FA0E620 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!CreateProcessInternalA + 3 7C81E5B3 2 Bytes [1F, F3]
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!GlobalAlloc 7C825837 7 Bytes JMP 6FA0E6C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!ResumeThread 7C8276F8 5 Bytes JMP 6FA0E760 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!WriteFileEx 7C85AB71 5 Bytes JMP 6FA0E820 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!WinExec 7C85F2B6 5 Bytes JMP 6FA0E7E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!GetThreadContext 7C860A99 5 Bytes JMP 6FA0E6A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] kernel32.dll!SetThreadContext 7C860AC4 5 Bytes JMP 6FA0E780 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!send 71A12974 5 Bytes JMP 6FA0EA20 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!recv 71A12AC5 5 Bytes JMP 6FA0EA00 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!closesocket 71A12F24 5 Bytes JMP 6FA0E980 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!bind 71A132CB 5 Bytes JMP 6FA0E960 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!connect 71A1362F 5 Bytes JMP 6FA0E9A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!WSAStartup 71A15AD9 7 Bytes JMP 6FA0E920 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!WSASocketA 71A17FF3 5 Bytes JMP 6FA0E900 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!listen 71A19910 5 Bytes JMP 6FA0E9E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!accept 71A19A02 5 Bytes JMP 6FA0E940 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WS2_32.dll!getpeername 71A20DCD 5 Bytes JMP 6FA0E9C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WININET.dll!InternetReadFile 75A1B163 5 Bytes JMP 6FA0E8E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WININET.dll!InternetOpenUrlA 75A2C075 7 Bytes JMP 6FA0E8A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WININET.dll!InternetOpenA 75A2DD05 5 Bytes JMP 6FA0E880 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\system32\svchost.exe[1600] WININET.dll!InternetQueryDataAvailable 75A506E8 5 Bytes JMP 6FA0E8C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] ntdll.dll!KiUserExceptionDispatcher 7C92139C 7 Bytes JMP 6FA0A370 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] ntdll.dll!LdrLoadDll 7C92FA67 5 Bytes JMP 6FA0E860 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!CreateFileA 7C801A04 5 Bytes JMP 6FA0E5E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!VirtualProtectEx 7C801A3D 5 Bytes JMP 6FA0E7C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!VirtualProtect 7C801AB0 5 Bytes JMP 6FA0E7A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!LoadLibraryExW 7C801AD1 7 Bytes JMP 6FA0E720 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!LoadLibraryExA 7C801D34 5 Bytes JMP 6FA0E700 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!LoadLibraryA 7C801D5C 5 Bytes JMP 6FA0E6E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!WriteProcessMemory 7C8021FA 5 Bytes JMP 6FA0E840 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!CreateProcessA 7C802328 5 Bytes JMP 6FA0E600 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!FreeLibrary 7C80C640 5 Bytes JMP 6FA0F440 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!GetProcAddress 7C80C7F7 5 Bytes JMP 6FA0E680 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!LoadLibraryW 7C80DCE4 5 Bytes JMP 6FA0E740 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!WriteFile 7C80F02C 7 Bytes JMP 6FA0E800 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!ExitThread 7C80FE54 7 Bytes JMP 6FA0E660 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!ExitProcess 7C815DFF 5 Bytes JMP 6FA0E640 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!CreateProcessInternalA 7C81E5B0 2 Bytes JMP 6FA0E620 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!CreateProcessInternalA + 3 7C81E5B3 2 Bytes [1F, F3]
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!GlobalAlloc 7C825837 7 Bytes JMP 6FA0E6C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!ResumeThread 7C8276F8 5 Bytes JMP 6FA0E760 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!CopyFileExW 7C833A25 7 Bytes JMP 6FA076F0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!MoveFileWithProgressW 7C833FFD 5 Bytes JMP 6FA07590 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!WriteFileEx 7C85AB71 5 Bytes JMP 6FA0E820 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!WinExec 7C85F2B6 5 Bytes JMP 6FA0E7E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!GetThreadContext 7C860A99 5 Bytes JMP 6FA0E6A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] kernel32.dll!SetThreadContext 7C860AC4 5 Bytes JMP 6FA0E780 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] ole32.dll!CoCreateInstance 779B50CE 8 Bytes JMP 6FA079D0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WININET.dll!InternetReadFile 75A1B163 5 Bytes JMP 6FA0E8E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WININET.dll!InternetOpenUrlA 75A2C075 7 Bytes JMP 6FA0E8A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WININET.dll!InternetOpenA 75A2DD05 5 Bytes JMP 6FA0E880 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WININET.dll!InternetQueryDataAvailable 75A506E8 5 Bytes JMP 6FA0E8C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!send 71A12974 5 Bytes JMP 6FA0EA20 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!recv 71A12AC5 5 Bytes JMP 6FA0EA00 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!closesocket 71A12F24 5 Bytes JMP 6FA0E980 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!bind 71A132CB 5 Bytes JMP 6FA0E960 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!connect 71A1362F 5 Bytes JMP 6FA0E9A0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!WSAStartup 71A15AD9 7 Bytes JMP 6FA0E920 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!WSASocketA 71A17FF3 5 Bytes JMP 6FA0E900 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!listen 71A19910 5 Bytes JMP 6FA0E9E0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!accept 71A19A02 5 Bytes JMP 6FA0E940 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)
.text C:\WINDOWS\Explorer.EXE[1728] WS2_32.dll!getpeername 71A20DCD 5 Bytes JMP 6FA0E9C0 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL (Sophos Buffer Overrun Protection/Sophos Limited)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs savonaccessfilter.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Limited)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x9C 0x7F 0x20 0x0B ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x1B 0xAD 0x8F 0xE7 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xD6 0xBC 0xB5 0x66 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x9C 0x7F 0x20 0x0B ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x1B 0xAD 0x8F 0xE7 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xD6 0xBC 0xB5 0x66 ...

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\DRIVERS\update.sys suspicious modification

---- EOF - GMER 1.0.15 ----



So jetzt hoffe ich auf weitere Unterstützung von euch.

LG Isa

P.S. Der Sophos Virenscanner hat ein Button "Bereinigen"; wenn ich diesen drücke ist der Trojaner dann wirklich vom Computer entfernt?

Alt 30.07.2012, 14:42   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Virus/Spyware Troj/JSRedir-HP - Standard

Virus/Spyware Troj/JSRedir-HP



Zitat:
Virus/Spyware Troj/JSRedir-HP
Schön und wo sind die Logs dazu?

Solche Angaben reichen nicht, bitte poste die vollständigen Angaben/Logs der Virenscanner.

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
ATTFilter
 hier steht das Log
         
__________________

__________________

Antwort

Themen zu Virus/Spyware Troj/JSRedir-HP
audiograbber, bho, buffer overrun, desktop, einstellungen, entfernt?, error, excel, explorer, firefox, flash player, format, google earth, iexplore.exe, log-datei, logfile, monitor, mozilla, netgear, programme, realtek, registry, required, rundll, scan, searchscopes, security, software, svchost.exe, temp, usb 2.0, virus



Ähnliche Themen: Virus/Spyware Troj/JSRedir-HP


  1. Troj.TR/Crypt.Zpack.151493+Troj.TR/Crypt.Xpack.138980 entfernen+daten entschlüsseln
    Log-Analyse und Auswertung - 27.08.2015 (27)
  2. Windows XP, Interpol Virus/Troj. Sperre
    Log-Analyse und Auswertung - 19.06.2014 (7)
  3. Nach BKA Virus jeden Tag neuer Parasit und ESIT zeigt "mögl. Variante von Win32/Ponmocup.AA Troj."
    Plagegeister aller Art und deren Bekämpfung - 11.05.2013 (20)
  4. Bekomme Meldung "Troj/JSRedir-HZ" und "MW:JS:JJ677"
    Plagegeister aller Art und deren Bekämpfung - 15.10.2012 (42)
  5. Troj/ExpJS-EG / Troj/ZbotMem-B / Trojan.Phex.THAGen6 - BA-BA-BA-BA-BANKÜBERFALL 2012
    Plagegeister aller Art und deren Bekämpfung - 19.08.2012 (19)
  6. Virus: Win32-Spyware-gen [Trj]
    Plagegeister aller Art und deren Bekämpfung - 15.08.2012 (1)
  7. Spyware: Wie lösche ich Troj/ZAccess-AH? Erscheint immer wieder!
    Plagegeister aller Art und deren Bekämpfung - 22.02.2012 (1)
  8. OjL.exe Virus(SPYWARE)?
    Plagegeister aller Art und deren Bekämpfung - 28.06.2011 (16)
  9. Spyware Virus???
    Log-Analyse und Auswertung - 17.06.2008 (1)
  10. Virus ? Spyware ?
    Log-Analyse und Auswertung - 21.03.2008 (0)
  11. Laut Spyware Doctor Troj. Auf Laptop HiJackThis LogFile inside
    Log-Analyse und Auswertung - 10.10.2006 (9)
  12. Spyware, Virus?
    Log-Analyse und Auswertung - 08.02.2006 (1)
  13. Virus Troj/Orse-Gen
    Plagegeister aller Art und deren Bekämpfung - 08.02.2006 (7)
  14. Virus Troj/ServU-AS
    Plagegeister aller Art und deren Bekämpfung - 11.08.2005 (1)
  15. mIRC wurm und Troj LADDER.A /Troj RAS.DLDR
    Plagegeister aller Art und deren Bekämpfung - 24.12.2004 (1)
  16. TROJ PROCKILLA / TROJ TARNO.A
    Plagegeister aller Art und deren Bekämpfung - 06.01.2004 (3)
  17. Virus/Trojaner schließt Anti Troj + 100% Systemauslastung
    Plagegeister aller Art und deren Bekämpfung - 10.11.2003 (3)

Zum Thema Virus/Spyware Troj/JSRedir-HP - Hallo zusammen, der Virenscanner meiner Eltern zeigt mir folgenden Virus: Virus/Spyware Troj/JSRedir-HP Ich habe die vorgegebenen Programme durchlaufen lassen, hier die log-Datein. defogger_disable.log: defogger_disable by jpshortstuff (23.02.10.1) Log created at - Virus/Spyware Troj/JSRedir-HP...
Archiv
Du betrachtest: Virus/Spyware Troj/JSRedir-HP auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.