Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: delfix hat ESET-Quarantäne nicht gelöscht

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 05.04.2013, 12:47   #1
Achim1975
 
delfix hat ESET-Quarantäne nicht gelöscht - Standard

delfix hat ESET-Quarantäne nicht gelöscht



Ich habe hier im Board Hilfe bekommen, nachdem Norton bei mir einen Trojaner entdeckt hat. Einer der letzten Schritte dieser Hilfe war es, dass ESET das gesamte System gescannt hat. Hierbei wurde noch einmal drei infizierte Dateien gefunden, die eigentlich durch delfix gelöscht werden sollten.

Ich habe alles so ausgeführt wie vorgeschrieben, allerdings findet ESET diese drei infizierten Dateien wieder, wenn ich mein System scanne.

Ich hänge u.a. das ESET-Log an.

OTL:

Code:
ATTFilter
OTL logfile created on: 05.04.2013 13:20:08 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Lupus\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16521)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 6,32 Gb Available Physical Memory | 79,18% Memory free
15,95 Gb Paging File | 14,28 Gb Available in Paging File | 89,49% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,79 Gb Total Space | 26,39 Gb Free Space | 23,60% Space Free | Partition Type: NTFS
Drive D: | 48,83 Gb Total Space | 19,63 Gb Free Space | 40,20% Space Free | Partition Type: NTFS
Drive E: | 465,71 Gb Total Space | 463,49 Gb Free Space | 99,52% Space Free | Partition Type: NTFS
Drive F: | 465,71 Gb Total Space | 11,46 Gb Free Space | 2,46% Space Free | Partition Type: NTFS
Drive G: | 48,83 Gb Total Space | 43,12 Gb Free Space | 88,30% Space Free | Partition Type: NTFS
Drive H: | 146,48 Gb Total Space | 125,23 Gb Free Space | 85,49% Space Free | Partition Type: NTFS
Drive I: | 128,47 Gb Total Space | 128,38 Gb Free Space | 99,93% Space Free | Partition Type: NTFS
Drive J: | 3,90 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: LPC | User Name: Lupus | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.04.05 13:19:37 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Lupus\Desktop\OTL.exe
PRC - [2013.02.07 14:31:22 | 001,223,704 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe
PRC - [2013.02.07 14:31:20 | 000,660,504 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\sua.exe
PRC - [2012.12.24 05:33:29 | 000,144,520 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton Internet Security\Engine\20.3.0.36\ccSvcHst.exe
PRC - [2012.12.18 21:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.10.10 22:23:42 | 001,258,856 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.10.02 14:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2010.11.05 23:54:22 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.11.05 23:54:20 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.03.02 19:52:00 | 000,140,640 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
PRC - [2009.10.26 13:16:00 | 000,223,464 | ---- | M] (DeviceVM, Inc.) -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.02.13 19:54:10 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\cb562e2e4f74ae607f1186f6ec50cec7\System.Windows.Forms.ni.dll
MOD - [2013.01.11 19:58:49 | 000,475,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\ab54c04b3df40416205883b4049fe273\IAStorUtil.ni.dll
MOD - [2013.01.11 19:58:49 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\4d6518ef6ae8d6f005c49ab1c86de7fe\IAStorCommon.ni.dll
MOD - [2013.01.11 14:42:13 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll
MOD - [2013.01.11 14:41:56 | 001,592,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll
MOD - [2013.01.11 14:41:49 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf827fe7bc99d9bcf0ba3621054ef527\WindowsBase.ni.dll
MOD - [2013.01.11 14:41:46 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll
MOD - [2013.01.11 14:41:45 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll
MOD - [2013.01.11 14:41:44 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll
MOD - [2013.01.11 14:41:41 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll
MOD - [2012.05.30 08:51:08 | 000,699,280 | R--- | M] () -- C:\PROGRAM FILES (X86)\NORTON INTERNET SECURITY\ENGINE\20.3.0.36\wincfi39.dll
MOD - [2010.11.13 01:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
         
Extras:

Code:
ATTFilter
OTL Extras logfile created on: 05.04.2013 13:20:08 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Lupus\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16521)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 6,32 Gb Available Physical Memory | 79,18% Memory free
15,95 Gb Paging File | 14,28 Gb Available in Paging File | 89,49% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,79 Gb Total Space | 26,39 Gb Free Space | 23,60% Space Free | Partition Type: NTFS
Drive D: | 48,83 Gb Total Space | 19,63 Gb Free Space | 40,20% Space Free | Partition Type: NTFS
Drive E: | 465,71 Gb Total Space | 463,49 Gb Free Space | 99,52% Space Free | Partition Type: NTFS
Drive F: | 465,71 Gb Total Space | 11,46 Gb Free Space | 2,46% Space Free | Partition Type: NTFS
Drive G: | 48,83 Gb Total Space | 43,12 Gb Free Space | 88,30% Space Free | Partition Type: NTFS
Drive H: | 146,48 Gb Total Space | 125,23 Gb Free Space | 85,49% Space Free | Partition Type: NTFS
Drive I: | 128,47 Gb Total Space | 128,38 Gb Free Space | 99,93% Space Free | Partition Type: NTFS
Drive J: | 3,90 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: LPC | User Name: Lupus | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistApplianMP] -- "C:\Program Files (x86)\Applian Technologies\Applian FLV and Media Player\amp.exe" -I skins2 --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Directory [PlayWithApplianMP] -- "C:\Program Files (x86)\Applian Technologies\Applian FLV and Media Player\amp.exe" -I skins2 --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistApplianMP] -- "C:\Program Files (x86)\Applian Technologies\Applian FLV and Media Player\amp.exe" -I skins2 --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Directory [PlayWithApplianMP] -- "C:\Program Files (x86)\Applian Technologies\Applian FLV and Media Player\amp.exe" -I skins2 --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04F42B11-F11F-48B9-8DEE-9451E6566B2D}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{0509AFE0-8850-47D2-B54D-0A99B1FF4A85}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1199\agent.exe | 
"{063007B3-7A35-49B3-B23C-FD87B6C35103}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe | 
"{0FB5D2DA-2C3F-4029-B981-882E5F9D7A07}" = protocol=17 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe | 
"{159EADCE-93AB-4CDC-88E5-7F95A0C01684}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.524\agent.exe | 
"{1BC49579-4F1B-471A-9916-3B180DEFE218}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 
"{1D6A5437-1B1D-45A1-9EB6-048CA5250004}" = dir=in | app=c:\users\lupus\appdata\roaming\allmyapps\allmyapps.exe | 
"{21ADC497-0D79-493E-8CE2-E3105823D4C5}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe | 
"{2559D81F-10D1-4752-8030-1767365FD653}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe | 
"{2B5E958D-7F8B-4547-B176-CB033A928D9C}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{320D3157-AA22-4A28-AC18-920DB229DBBA}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\legend of grimrock\grimrock.exe | 
"{3D0EA668-754B-41C8-A337-F6AAF44775CA}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe | 
"{4CFFFCB7-FF0A-4651-B263-DD2F7FE22039}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe | 
"{5396EADC-4F6A-48EA-B689-5A53C8770F5E}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"{5CB054AA-230D-4947-B60F-61DF1EA8DB85}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe | 
"{6007612C-2235-4320-BCCA-D06C294E8CE7}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1199\agent.exe | 
"{629FA4DF-FC15-468B-B5EE-ACEC9F664761}" = protocol=6 | dir=in | app=d:\program files (x86)\pinnacle\studio 12\programs\umi.exe | 
"{7061859E-2EC7-4D73-8A79-33151C989DF6}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{716AB1B2-10EF-4961-A939-A7E0B6675985}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe | 
"{7777EB73-205B-463E-96D7-93A27F2A110F}" = protocol=6 | dir=in | app=d:\program files (x86)\pinnacle\studio 12\programs\rm.exe | 
"{9011108E-E8C2-4BA0-B5D3-0E3FB008B16F}" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"{9696D5E9-9E3C-499D-8029-6C422187B60B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\orcs must die!\build\release\orcsmustdie.exe | 
"{9DCD32D7-59A4-46B8-A388-D9B5329FAEF0}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe | 
"{A0FDF7A9-D551-43A6-91F7-20985C3D6C22}" = protocol=17 | dir=in | app=d:\program files (x86)\pinnacle\studio 12\programs\umi.exe | 
"{A41BB95A-D869-48AA-9091-8468628940A2}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\orcs must die!\build\release\orcsmustdie.exe | 
"{A8B62E71-A5DF-41F7-B486-AEB25CA29714}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"{B193C872-938D-4931-863C-894E24CAACBA}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dear esther\dearesther.exe | 
"{B77F109D-787C-4211-99CD-C2CF9F5A8B8D}" = protocol=6 | dir=in | app=d:\program files (x86)\pinnacle\studio 12\programs\studio.exe | 
"{B8A34D5E-BB46-4E1E-B9E5-21A670066A98}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{BC9E6853-2A7D-4C80-8D04-4CA7D5E5A867}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\legend of grimrock\grimrock.exe | 
"{BE965B46-0752-44E2-8216-7C336FB46FDA}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 
"{C756E9EE-33FF-42F0-8EAB-D18BEDCADE92}" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"{CD57808F-6B6F-4F7E-B9D9-F60A8168B90E}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe | 
"{D35CE453-D226-4902-92BC-993730B6A3ED}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe | 
"{D5288018-6D02-4BFD-AAE1-8810E5329BE6}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{D6D10818-DEDE-43A4-9908-120122D1E3BD}" = protocol=17 | dir=in | app=d:\program files (x86)\pinnacle\studio 12\programs\studio.exe | 
"{D8163290-CF69-43EF-9F19-7FFC4591F95C}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe | 
"{DC891C6D-016C-4F4F-9724-5BE81FE74506}" = protocol=17 | dir=in | app=d:\program files (x86)\pinnacle\studio 12\programs\rm.exe | 
"{EFE0ACB4-79C4-48C9-93A4-6B6487C4DAEF}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.524\agent.exe | 
"{F741631A-423D-4783-A079-9805F40720F3}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dear esther\dearesther.exe | 
"{F7D753A0-2EDE-4780-BCF3-FCD7414AE713}" = protocol=6 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe | 
"{FA5E6A3F-F80C-498C-8912-BCE32511A875}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe | 
"TCP Query User{03772620-52C6-48A7-B027-34FE819887B1}D:\program files (x86)\tmunitedforever\tmforever.exe" = protocol=6 | dir=in | app=d:\program files (x86)\tmunitedforever\tmforever.exe | 
"TCP Query User{B2D495BF-290A-43A8-A8CB-765CE3E8566E}C:\program files (x86)\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\winamp\winamp.exe | 
"TCP Query User{E4CD0165-5595-4B6A-89E1-1CC60EFF48EB}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"TCP Query User{FD06704E-0C04-421C-B073-A532E69D8648}C:\programdata\battle.net\agent\agent.976\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe | 
"UDP Query User{06343FD1-D856-4B49-A32B-42A50F0916E5}C:\programdata\battle.net\agent\agent.976\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe | 
"UDP Query User{48844CD4-2007-40BC-9F0E-8BFC196EBB82}D:\program files (x86)\tmunitedforever\tmforever.exe" = protocol=17 | dir=in | app=d:\program files (x86)\tmunitedforever\tmforever.exe | 
"UDP Query User{53AD8C0E-05FB-4725-A495-E6329E6CE3CC}C:\program files (x86)\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\winamp\winamp.exe | 
"UDP Query User{C4EAC46A-67D2-4BF7-8620-4FF7DC3B5BA8}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5200_series" = Canon MG5200 series MP Drivers
"{230D1595-57DA-4933-8C4E-375797EBB7E1}" = Bluetooth Win7 Suite (64)
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5EB90C06-964F-4195-B83E-BD7E55C88415}" = Pinnacle Video Treiber
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.12.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"6af12c54-643b-4752-87d0-8335503010de_is1" = Nexus Mod Manager
"GIMP-2_is1" = GIMP 2.8.4
"Totalcmd64" = Total Commander 64-bit (Remove or Repair)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1A15507A-8551-4626-915D-3D5FA095CC1B}" = Corel Paint Shop Pro X
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{262BF2CD-601D-4F43-919C-4B00B1D1F338}" = Boris Graffiti
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 17
"{37F79692-6F8A-487E-BF5A-A1E3227D9830}" = HFX Volume 2
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{468B359F-BAEF-466F-BB82-5EDEA1D8B2FB}" = HFX Volume 1
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{55F7D521-17CA-454D-9D4D-975EF2E10708}_is1" = Torchlight II
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9FE67144-F235-4FAB-8E0E-1C04D724B2CE}" = Studio Premium Pack 1
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.02) - Deutsch
"{CA9B76C4-4E1F-4946-80B1-9E5E8886D7AE}" = Studio Premium Pack 2
"{D041EB9E-890A-4098-8F94-51DA194AC72A}" = Pinnacle Studio 12
"{D1860E6E-520E-4380-8433-E58E8F88B473}" = Pinnacle Studio 12 Ultimate Plugins
"{D793423B-FF18-4A54-B9C9-75B3396BAAC4}" = Browser Configuration Utility
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}" = Asmedia ASM104x USB 3.0 Host Controller Driver
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FA89C3ED-8EC5-457F-A31C-AE208C1CF024}" = ACD Product-Security-Vulnerability Update
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Applian FLV and Media Player" = Applian FLV and Media Player 3.1.1.12
"Audiograbber" = Audiograbber 1.83 SE 
"Audiograbber-Lame" = Audiograbber MP3-Plugin
"AVMFBox" = AVM FRITZ!Box Dokumentation
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"Black Mirror 2_is1" = Black Mirror 2
"Canon MG5200 series Benutzerregistrierung" = Canon MG5200 series Benutzerregistrierung
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CanonMyPrinter" = Canon My Printer
"Diablo III" = Diablo III
"Dream Pinball 3D" = Dream Pinball 3D
"ESET Online Scanner" = ESET Online Scanner v3
"FLV Player" = FLV Player 2.0 (build 25)
"FolderVisualizer_is1" = FolderVisualizer
"Free Download Manager_is1" = Free Download Manager 3.9
"Free FLV Converter_is1" = Free FLV Converter V 7.3.0
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"Magic Bullet Looks Studio" = Magic Bullet Looks Studio
"MagniDriver" = marvell 91xx driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"ManiaPlanet_is1" = ManiaPlanet
"Mozilla Firefox 20.0 (x86 de)" = Mozilla Firefox 20.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MPE" = MyPhoneExplorer
"Nero - Burning Rom!UninstallKey" = Nero 6 Demo
"NIS" = Norton Internet Security
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"proDAD-Vitascene-1.0" = proDAD Vitascene 1.0
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"Secunia PSI" = Secunia PSI (3.0.0.6005)
"Steam App 102600" = Orcs Must Die!
"Steam App 203810" = Dear Esther
"Steam App 207170" = Legend of Grimrock
"Steam App 550" = Left 4 Dead 2
"TmUnited_is1" = TrackMania United 0.2.0.8
"TmUnitedForever_is1" = TmUnitedForever Update 2010-03-15
"TrueCrypt" = TrueCrypt
"Winamp" = Winamp
"X2TheThreat_is1" = X2 The Threat v1.5
"X3Reunion_is1" = X3 Reunion v2.5
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Winamp Detect" = Winamp Erkennungs-Plug-in
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 21.11.2012 13:57:45 | Computer Name = LPC | Source = WinMgmt | ID = 10
Description = 
 
Error - 21.11.2012 16:36:42 | Computer Name = LPC | Source = WinMgmt | ID = 10
Description = 
 
Error - 22.11.2012 02:07:29 | Computer Name = LPC | Source = WinMgmt | ID = 10
Description = 
 
Error - 22.11.2012 15:19:18 | Computer Name = LPC | Source = WinMgmt | ID = 10
Description = 
 
Error - 23.11.2012 02:09:41 | Computer Name = LPC | Source = WinMgmt | ID = 10
Description = 
 
Error - 23.11.2012 03:08:48 | Computer Name = LPC | Source = WinMgmt | ID = 10
Description = 
 
Error - 23.11.2012 08:33:18 | Computer Name = LPC | Source = WinMgmt | ID = 10
Description = 
 
Error - 23.11.2012 15:18:48 | Computer Name = LPC | Source = WinMgmt | ID = 10
Description = 
 
Error - 23.11.2012 16:44:22 | Computer Name = LPC | Source = WinMgmt | ID = 10
Description = 
 
Error - 24.11.2012 03:57:42 | Computer Name = LPC | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 04.04.2013 16:14:14 | Computer Name = LPC | Source = DCOM | ID = 10005
Description = 
 
Error - 04.04.2013 16:14:15 | Computer Name = LPC | Source = DCOM | ID = 10005
Description = 
 
Error - 04.04.2013 16:14:14 | Computer Name = LPC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 04.04.2013 16:14:14 | Computer Name = LPC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 04.04.2013 16:14:15 | Computer Name = LPC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 04.04.2013 16:14:15 | Computer Name = LPC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 04.04.2013 16:14:15 | Computer Name = LPC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 04.04.2013 16:14:15 | Computer Name = LPC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 04.04.2013 16:14:15 | Computer Name = LPC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 04.04.2013 16:14:15 | Computer Name = LPC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
 
< End of report >
         
GMER:

Code:
ATTFilter
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-04-05 13:38:00
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 OCZ-VERT rev.2.11 111,79GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Lupus\AppData\Local\Temp\pxldapow.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                    0000000077e3fc90 5 bytes JMP 000000010027091c
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                                  0000000077e3fdf4 5 bytes JMP 0000000100270048
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                           0000000077e3fe88 5 bytes JMP 00000001002702ee
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                        0000000077e3ffe4 5 bytes JMP 00000001002704b2
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                0000000077e40018 5 bytes JMP 00000001002709fe
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                        0000000077e40048 5 bytes JMP 0000000100270ae0
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread                                     0000000077e40064 5 bytes JMP 000000010002004c
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                        0000000077e4077c 5 bytes JMP 000000010027012a
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject                            0000000077e4086c 5 bytes JMP 0000000100270758
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                      0000000077e40884 5 bytes JMP 0000000100270676
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                          0000000077e40dd4 5 bytes JMP 00000001002703d0
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                    0000000077e41900 5 bytes JMP 0000000100270594
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                                0000000077e41bc4 5 bytes JMP 000000010027083a
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                       0000000077e41d50 5 bytes JMP 000000010027020c
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206                      000000007747524f 7 bytes JMP 0000000100270f52
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380                          00000000774753d0 7 bytes JMP 0000000100280210
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149                         0000000077475677 1 byte JMP 0000000100280048
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151                         0000000077475679 5 bytes {JMP 0xffffffff88e0a9d1}
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542                                000000007747589a 7 bytes JMP 0000000100270ca6
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382                                0000000077475a1d 7 bytes JMP 00000001002803d8
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370                           0000000077475c9b 7 bytes JMP 000000010028012c
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231                             0000000077475d87 7 bytes JMP 00000001002802f4
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123            0000000077477240 7 bytes JMP 0000000100270e6e
.text  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[152] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882                           00000000774f1492 7 bytes JMP 00000001002804bc
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                          0000000077e3fc90 5 bytes JMP 00000001000e091c
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                                        0000000077e3fdf4 5 bytes JMP 00000001000e0048
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                                 0000000077e3fe88 5 bytes JMP 00000001000e02ee
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                              0000000077e3ffe4 5 bytes JMP 00000001000e04b2
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                      0000000077e40018 5 bytes JMP 00000001000e09fe
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                              0000000077e40048 5 bytes JMP 00000001000e0ae0
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread                                           0000000077e40064 5 bytes JMP 000000010002004c
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                              0000000077e4077c 5 bytes JMP 00000001000e012a
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject                                  0000000077e4086c 5 bytes JMP 00000001000e0758
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                            0000000077e40884 5 bytes JMP 00000001000e0676
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                                0000000077e40dd4 5 bytes JMP 00000001000e03d0
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                          0000000077e41900 5 bytes JMP 00000001000e0594
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                                      0000000077e41bc4 5 bytes JMP 00000001000e083a
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                             0000000077e41d50 5 bytes JMP 00000001000e020c
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882                                 00000000774f1492 7 bytes JMP 00000001000f059e
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206                            000000007747524f 7 bytes JMP 00000001000e0f52
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380                                00000000774753d0 7 bytes JMP 00000001000f0210
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149                               0000000077475677 1 byte JMP 00000001000f0048
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151                               0000000077475679 5 bytes {JMP 0xffffffff88c7a9d1}
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542                                      000000007747589a 7 bytes JMP 00000001000e0ca6
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382                                      0000000077475a1d 7 bytes JMP 00000001000f03d8
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370                                 0000000077475c9b 7 bytes JMP 00000001000f012c
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231                                   0000000077475d87 7 bytes JMP 00000001000f02f4
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1880] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123                  0000000077477240 7 bytes JMP 00000001000e0e6e
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                          0000000077e3fc90 5 bytes JMP 000000010029091c
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                        0000000077e3fdf4 5 bytes JMP 0000000100290048
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                 0000000077e3fe88 5 bytes JMP 00000001002902ee
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                              0000000077e3ffe4 5 bytes JMP 00000001002904b2
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                      0000000077e40018 5 bytes JMP 00000001002909fe
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                              0000000077e40048 5 bytes JMP 0000000100290ae0
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread                           0000000077e40064 5 bytes JMP 000000010003004c
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                              0000000077e4077c 5 bytes JMP 000000010029012a
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject                  0000000077e4086c 5 bytes JMP 0000000100290758
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                            0000000077e40884 5 bytes JMP 0000000100290676
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                0000000077e40dd4 5 bytes JMP 00000001002903d0
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                          0000000077e41900 5 bytes JMP 0000000100290594
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                      0000000077e41bc4 5 bytes JMP 000000010029083a
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                             0000000077e41d50 5 bytes JMP 000000010029020c
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882                 00000000774f1492 7 bytes JMP 00000001002a04bc
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206            000000007747524f 7 bytes JMP 0000000100290f52
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380                00000000774753d0 7 bytes JMP 00000001002a0210
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149               0000000077475677 1 byte JMP 00000001002a0048
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151               0000000077475679 5 bytes {JMP 0xffffffff88e2a9d1}
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542                      000000007747589a 7 bytes JMP 0000000100290ca6
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382                      0000000077475a1d 7 bytes JMP 00000001002a03d8
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370                 0000000077475c9b 7 bytes JMP 00000001002a012c
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231                   0000000077475d87 7 bytes JMP 00000001002a02f4
.text  C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe[1936] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123  0000000077477240 7 bytes JMP 0000000100290e6e
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                           0000000077e3fc90 5 bytes JMP 000000010010091c
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                                                         0000000077e3fdf4 5 bytes JMP 0000000100100048
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                                                  0000000077e3fe88 5 bytes JMP 00000001001002ee
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                                               0000000077e3ffe4 5 bytes JMP 00000001001004b2
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                       0000000077e40018 5 bytes JMP 00000001001009fe
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                                               0000000077e40048 5 bytes JMP 0000000100100ae0
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread                                                            0000000077e40064 5 bytes JMP 000000010002004c
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                                               0000000077e4077c 5 bytes JMP 000000010010012a
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject                                                   0000000077e4086c 5 bytes JMP 0000000100100758
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                                             0000000077e40884 5 bytes JMP 0000000100100676
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                                                 0000000077e40dd4 5 bytes JMP 00000001001003d0
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                           0000000077e41900 5 bytes JMP 0000000100100594
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                                                       0000000077e41bc4 5 bytes JMP 000000010010083a
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                                              0000000077e41d50 5 bytes JMP 000000010010020c
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882                                                  00000000774f1492 7 bytes JMP 000000010011059e
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206                                             000000007747524f 7 bytes JMP 0000000100100f52
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380                                                 00000000774753d0 7 bytes JMP 0000000100110210
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149                                                0000000077475677 1 byte JMP 0000000100110048
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151                                                0000000077475679 5 bytes {JMP 0xffffffff88c9a9d1}
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542                                                       000000007747589a 7 bytes JMP 0000000100100ca6
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382                                                       0000000077475a1d 7 bytes JMP 00000001001103d8
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370                                                  0000000077475c9b 7 bytes JMP 000000010011012c
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231                                                    0000000077475d87 7 bytes JMP 00000001001102f4
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123                                   0000000077477240 7 bytes JMP 0000000100100e6e
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                    0000000076181465 2 bytes [18, 76]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1140] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                   00000000761814bb 2 bytes [18, 76]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                            0000000077e3fc90 5 bytes JMP 00000001000a091c
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                                                          0000000077e3fdf4 5 bytes JMP 00000001000a0048
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                                                   0000000077e3fe88 5 bytes JMP 00000001000a02ee
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                                                0000000077e3ffe4 5 bytes JMP 00000001000a04b2
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                        0000000077e40018 5 bytes JMP 00000001000a09fe
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                                                0000000077e40048 5 bytes JMP 00000001000a0ae0
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread                                                             0000000077e40064 5 bytes JMP 000000010002004c
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                                                0000000077e4077c 5 bytes JMP 00000001000a012a
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject                                                    0000000077e4086c 5 bytes JMP 00000001000a0758
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                                              0000000077e40884 5 bytes JMP 00000001000a0676
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                                                  0000000077e40dd4 5 bytes JMP 00000001000a03d0
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                            0000000077e41900 5 bytes JMP 00000001000a0594
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                                                        0000000077e41bc4 5 bytes JMP 00000001000a083a
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                                               0000000077e41d50 5 bytes JMP 00000001000a020c
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206                                              000000007747524f 7 bytes JMP 00000001000a0f52
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380                                                  00000000774753d0 7 bytes JMP 0000000100160210
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149                                                 0000000077475677 1 byte JMP 0000000100160048
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151                                                 0000000077475679 5 bytes {JMP 0xffffffff88cea9d1}
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542                                                        000000007747589a 7 bytes JMP 00000001000a0ca6
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382                                                        0000000077475a1d 7 bytes JMP 00000001001603d8
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370                                                   0000000077475c9b 7 bytes JMP 000000010016012c
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231                                                     0000000077475d87 7 bytes JMP 00000001001602f4
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123                                    0000000077477240 7 bytes JMP 00000001000a0e6e
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                     0000000076181465 2 bytes [18, 76]
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[2944] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                    00000000761814bb 2 bytes [18, 76]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                              0000000077e3fc90 5 bytes JMP 000000010010091c
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                            0000000077e3fdf4 5 bytes JMP 0000000100100048
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                     0000000077e3fe88 5 bytes JMP 00000001001002ee
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                  0000000077e3ffe4 5 bytes JMP 00000001001004b2
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                          0000000077e40018 5 bytes JMP 00000001001009fe
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                  0000000077e40048 5 bytes JMP 0000000100100ae0
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread                               0000000077e40064 5 bytes JMP 000000010002004c
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                  0000000077e4077c 5 bytes JMP 000000010010012a
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject                      0000000077e4086c 5 bytes JMP 0000000100100758
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                0000000077e40884 5 bytes JMP 0000000100100676
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                    0000000077e40dd4 5 bytes JMP 00000001001003d0
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                              0000000077e41900 5 bytes JMP 0000000100100594
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                          0000000077e41bc4 5 bytes JMP 000000010010083a
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                 0000000077e41d50 5 bytes JMP 000000010010020c
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                       0000000076181465 2 bytes [18, 76]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                      00000000761814bb 2 bytes [18, 76]
.text  ...                                                                                                                                                          * 2
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882                     00000000774f1492 7 bytes JMP 0000000100110762
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206                000000007747524f 7 bytes JMP 0000000100100f52
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380                    00000000774753d0 7 bytes JMP 0000000100110210
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149                   0000000077475677 1 byte JMP 0000000100110048
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151                   0000000077475679 5 bytes {JMP 0xffffffff88c9a9d1}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542                          000000007747589a 7 bytes JMP 0000000100100ca6
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382                          0000000077475a1d 7 bytes JMP 00000001001103d8
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370                     0000000077475c9b 7 bytes JMP 000000010011012c
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231                       0000000077475d87 7 bytes JMP 00000001001102f4
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4032] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123      0000000077477240 7 bytes JMP 0000000100100e6e
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                0000000077e3fc90 5 bytes JMP 00000001001d091c
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                              0000000077e3fdf4 5 bytes JMP 00000001001d0048
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                       0000000077e3fe88 5 bytes JMP 00000001001d02ee
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                    0000000077e3ffe4 5 bytes JMP 00000001001d04b2
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                            0000000077e40018 5 bytes JMP 00000001001d09fe
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                    0000000077e40048 5 bytes JMP 00000001001d0ae0
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread                                 0000000077e40064 5 bytes JMP 000000010002004c
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                    0000000077e4077c 5 bytes JMP 00000001001d012a
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject                        0000000077e4086c 5 bytes JMP 00000001001d0758
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                  0000000077e40884 5 bytes JMP 00000001001d0676
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                      0000000077e40dd4 5 bytes JMP 00000001001d03d0
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                0000000077e41900 5 bytes JMP 00000001001d0594
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                            0000000077e41bc4 5 bytes JMP 00000001001d083a
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                   0000000077e41d50 5 bytes JMP 00000001001d020c
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882                       00000000774f1492 7 bytes JMP 00000001001e059e
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206                  000000007747524f 7 bytes JMP 00000001001d0f52
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380                      00000000774753d0 7 bytes JMP 00000001001e0210
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149                     0000000077475677 1 byte JMP 00000001001e0048
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151                     0000000077475679 5 bytes {JMP 0xffffffff88d6a9d1}
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542                            000000007747589a 7 bytes JMP 00000001001d0ca6
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382                            0000000077475a1d 7 bytes JMP 00000001001e03d8
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370                       0000000077475c9b 7 bytes JMP 00000001001e012c
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231                         0000000077475d87 7 bytes JMP 00000001001e02f4
.text  C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe[2856] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123        0000000077477240 7 bytes JMP 00000001001d0e6e
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                      0000000077e3fc90 5 bytes JMP 00000001001e091c
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                                    0000000077e3fdf4 5 bytes JMP 00000001001e0048
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                             0000000077e3fe88 5 bytes JMP 00000001001e02ee
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                          0000000077e3ffe4 5 bytes JMP 00000001001e04b2
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                  0000000077e40018 5 bytes JMP 00000001001e09fe
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                          0000000077e40048 5 bytes JMP 00000001001e0ae0
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread                                       0000000077e40064 5 bytes JMP 000000010002004c
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                          0000000077e4077c 5 bytes JMP 00000001001e012a
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject                              0000000077e4086c 5 bytes JMP 00000001001e0758
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                        0000000077e40884 5 bytes JMP 00000001001e0676
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                            0000000077e40dd4 5 bytes JMP 00000001001e03d0
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                      0000000077e41900 5 bytes JMP 00000001001e0594
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                                  0000000077e41bc4 5 bytes JMP 00000001001e083a
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                         0000000077e41d50 5 bytes JMP 00000001001e020c
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206                        000000007747524f 7 bytes JMP 00000001001e0f52
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380                            00000000774753d0 7 bytes JMP 0000000100270210
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149                           0000000077475677 1 byte JMP 0000000100270048
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151                           0000000077475679 5 bytes {JMP 0xffffffff88dfa9d1}
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542                                  000000007747589a 7 bytes JMP 00000001001e0ca6
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382                                  0000000077475a1d 7 bytes JMP 00000001002703d8
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370                             0000000077475c9b 7 bytes JMP 000000010027012c
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231                               0000000077475d87 7 bytes JMP 00000001002702f4
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123              0000000077477240 7 bytes JMP 00000001001e0e6e
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3760] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882                             00000000774f1492 7 bytes JMP 000000010027059e
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                             0000000077e3fc90 5 bytes JMP 00000001001d091c
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                                                           0000000077e3fdf4 5 bytes JMP 00000001001d0048
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\ntdll.dll!NtOpenEvent                                                                    0000000077e3fe88 5 bytes JMP 00000001001d02ee
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                                                 0000000077e3ffe4 5 bytes JMP 00000001001d04b2
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                         0000000077e40018 5 bytes JMP 00000001001d09fe
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                                                 0000000077e40048 5 bytes JMP 00000001001d0ae0
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\ntdll.dll!NtTerminateThread                                                              0000000077e40064 5 bytes JMP 000000010002004c
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                                                 0000000077e4077c 5 bytes JMP 00000001001d012a
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\ntdll.dll!NtCreateSymbolicLinkObject                                                     0000000077e4086c 5 bytes JMP 00000001001d0758
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                                               0000000077e40884 5 bytes JMP 00000001001d0676
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                                                   0000000077e40dd4 5 bytes JMP 00000001001d03d0
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                             0000000077e41900 5 bytes JMP 00000001001d0594
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                                                         0000000077e41bc4 5 bytes JMP 00000001001d083a
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\ntdll.dll!NtSuspendThread                                                                0000000077e41d50 5 bytes JMP 00000001001d020c
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity + 206                                               000000007747524f 7 bytes JMP 00000001001d0f52
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA + 380                                                   00000000774753d0 7 bytes JMP 00000001001e0210
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 149                                                  0000000077475677 1 byte JMP 00000001001e0048
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W + 151                                                  0000000077475679 5 bytes {JMP 0xffffffff88d6a9d1}
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\sechost.dll!CreateServiceA + 542                                                         000000007747589a 7 bytes JMP 00000001001d0ca6
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\sechost.dll!CreateServiceW + 382                                                         0000000077475a1d 7 bytes JMP 00000001001e03d8
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW + 370                                                    0000000077475c9b 7 bytes JMP 00000001001e012c
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA + 231                                                      0000000077475d87 7 bytes JMP 00000001001e02f4
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\SysWOW64\sechost.dll!I_ScBroadcastServiceControlMessage + 123                                     0000000077477240 7 bytes JMP 00000001001d0e6e
.text  C:\Users\Lupus\Desktop\gmer_2.1.19163.exe[4484] C:\Windows\syswow64\USER32.dll!RecordShutdownReason + 882                                                    00000000774f1492 7 bytes JMP 00000001001e04bc

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026832e1ff1                                                                                  
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026832e1ff1 (not active ControlSet)                                                              

---- EOF - GMER 2.1 ----
         
ESET-Log von heute Morgen:

Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=4e38495dfc54cd4689cc1d5b4a8bf5a4
# engine=13553
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-04-04 10:26:00
# local_time=2013-04-05 12:26:00 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=3591 16777213 100 91 235446 127710945 0 0
# compatibility_mode=5893 16776574 100 94 62520137 116744210 0 0
# scanned=480539
# found=3
# cleaned=0
# scan_time=4529
sh=273CD77673CBB1D99A18780AC77A962A589AA1AA ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Lupus\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\430db750-4db312f1"
sh=C96B6FB0A3C22CD228E7C56760326E0F505E2335 ft=0 fh=0000000000000000 vn="Java/Exploit.CVE-2011-3544.BA trojan" ac=I fn="C:\Users\Lupus\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\5b6cf6dd-5c7d4615"
sh=A804A276D9352A76162B26D6E61F47257801F993 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.Agent.NPJ trojan" ac=I fn="C:\Users\Lupus\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\1cb0b870-54d39f25"
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=4e38495dfc54cd4689cc1d5b4a8bf5a4
# engine=13553
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-04-05 06:11:17
# local_time=2013-04-05 08:11:17 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=3591 16777213 100 91 263363 127738862 0 0
# compatibility_mode=5893 16776574 100 94 62548054 116772127 0 0
# scanned=172926
# found=3
# cleaned=0
# scan_time=1461
sh=273CD77673CBB1D99A18780AC77A962A589AA1AA ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Lupus\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\430db750-4db312f1"
sh=C96B6FB0A3C22CD228E7C56760326E0F505E2335 ft=0 fh=0000000000000000 vn="Java/Exploit.CVE-2011-3544.BA trojan" ac=I fn="C:\Users\Lupus\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\5b6cf6dd-5c7d4615"
sh=A804A276D9352A76162B26D6E61F47257801F993 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.Agent.NPJ trojan" ac=I fn="C:\Users\Lupus\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\1cb0b870-54d39f25"
         
Schon einmal vorab vielen Dank für die Hilfe.

Gruß, Achim

Alt 05.04.2013, 13:19   #2
aharonov
/// TB-Ausbilder
 
delfix hat ESET-Quarantäne nicht gelöscht - Standard

delfix hat ESET-Quarantäne nicht gelöscht



Hi Achim,

das sind nur Funde im Cache und nicht mehr aktiv, kein Grund zur Aufregung.
Versuch sie mal so zu löschen:

  • Starte bitte die OTL.exe.
  • Kopiere nun den folgenden Inhalt aus der Codebox in die Textbox.
    Wichtig: Falls du deinen Benutzernamen im Log unkenntlich gemacht hast (z.B. durch ***), dann mach das hier wieder rückgängig.
Code:
ATTFilter
:commands
[emptytemp]
         
  • Schliesse nun bitte alle anderen Programme.
  • Klicke jetzt auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Diesen bitte zulassen.
  • Nach dem Neustart findest du ein Textdokument auf deinem Desktop.
    (Auch zu finden unter C:\_OTL\MovedFiles\<date_time>.log)
  • Kopiere nun dessen Inhalt hier in deinen Thread.
__________________

__________________

Alt 06.04.2013, 01:23   #3
Achim1975
 
delfix hat ESET-Quarantäne nicht gelöscht - Standard

delfix hat ESET-Quarantäne nicht gelöscht



Hi Leo,

danke für die Hilfe, anbei der OTL-Text:

Code:
ATTFilter
All processes killed
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Lupus
->Temp folder emptied: 15668211 bytes
->Temporary Internet Files folder emptied: 59721659 bytes
->Java cache emptied: 18319802 bytes
->FireFox cache emptied: 73584180 bytes
->Flash cache emptied: 3411 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 200704 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 8243352 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 78140 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 168,00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 04062013_021825

Files\Folders moved on Reboot...
C:\Users\Lupus\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
         

Gruß, Achim
__________________

Alt 06.04.2013, 02:47   #4
aharonov
/// TB-Ausbilder
 
delfix hat ESET-Quarantäne nicht gelöscht - Standard

delfix hat ESET-Quarantäne nicht gelöscht



Hallo Achim,

und findet ESET immer noch was?
__________________
cheers,
Leo

Alt 06.04.2013, 15:59   #5
Achim1975
 
delfix hat ESET-Quarantäne nicht gelöscht - Standard

delfix hat ESET-Quarantäne nicht gelöscht



Nein, ich habe noch einmal mit ESET gescannt und es wurde nichts mehr gefunden!

Viele Grüße

Achim


Alt 06.04.2013, 16:19   #6
aharonov
/// TB-Ausbilder
 
delfix hat ESET-Quarantäne nicht gelöscht - Standard

delfix hat ESET-Quarantäne nicht gelöscht



Prima. Die Bereinigung in deinem anderen Thread war ja beendet.
Noch einmal delfix laufen lassen und dann ist die Sache erledigt.


Downloade dir bitte delfix auf deinen Desktop.
  • Schliesse alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.
  • DelFix entfernt u.a. alle von uns verwendeten Programme und löscht sich anschliessend selbst.
    Sollte denoch etwas übrig bleiben, kannst du es manuell löschen.
__________________
--> delfix hat ESET-Quarantäne nicht gelöscht

Alt 09.04.2013, 00:47   #7
aharonov
/// TB-Ausbilder
 
delfix hat ESET-Quarantäne nicht gelöscht - Standard

delfix hat ESET-Quarantäne nicht gelöscht



Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Ich bekomme somit keine Benachrichtigung mehr über neue Antworten.
Solltest du das Thema erneut brauchen, schicke mir bitte eine PM und wir machen hier weiter.

Jeder andere bitte diese Anleitung lesen und einen eigenen Thread erstellen.
__________________
cheers,
Leo

Antwort

Themen zu delfix hat ESET-Quarantäne nicht gelöscht
7-zip, adobe, adobe reader xi, audiograbber, battle.net, black, browser, converter, downloader, error, eset-log, excel, flash player, format, free download, homepage, iexplore.exe, infizierte, install.exe, logfile, mozilla, nexus, ntdll.dll, realtek, registry, rundll, secunia psi, security, software, symantec, system, tcp, trojaner, udp, windows



Ähnliche Themen: delfix hat ESET-Quarantäne nicht gelöscht


  1. Windows 10: "JS/Iframe.MA Trojaner" von ESET erkannt & in Quarantäne verschoben
    Log-Analyse und Auswertung - 29.09.2015 (7)
  2. Kaspersky hatte vor einiger Zeit den ADW-Cleaner und Delfix als Virus erkannt
    Log-Analyse und Auswertung - 08.09.2015 (22)
  3. Laptop startet 5 Min.+, Audio startet nicht automatisch, ESET kann nicht alles in Quarantäne schieben, AdwareBytes findet Bedrohungen
    Log-Analyse und Auswertung - 05.07.2015 (12)
  4. Als Trojaner identifizierte Datei aus Quarantäne gelöscht. Ist noch etwas auf meinem System?
    Log-Analyse und Auswertung - 17.03.2015 (3)
  5. Avira findet seit Tagen db29.exe, In Quarantäne verschieben funktioniert nicht, Programm lässt sich nicht löschen
    Log-Analyse und Auswertung - 20.02.2015 (12)
  6. Frage bach Anwendung von delfix
    Alles rund um Windows - 18.02.2015 (3)
  7. Mobogenie nicht entfernt, Eset löscht Dateien nicht
    Log-Analyse und Auswertung - 15.03.2014 (4)
  8. Win7-64: Eltern-PC infiziert; ESET startet nicht, Malwarebytes updatet nicht
    Plagegeister aller Art und deren Bekämpfung - 31.12.2013 (11)
  9. ESET Bootsektor Prüfung nicht durführbar
    Log-Analyse und Auswertung - 26.09.2013 (3)
  10. virus/wurm entdeckt durch eset und gelöscht, aber bin mir nicht sicher ob das system sauber ist
    Plagegeister aller Art und deren Bekämpfung - 22.11.2012 (11)
  11. Exploit-QtPICT Trojaner aus McAfee Quarantäne gelöscht - immer noch da
    Plagegeister aller Art und deren Bekämpfung - 07.11.2011 (13)
  12. ESET Smart Security oder ESET NOD32 Antivirus?
    Antiviren-, Firewall- und andere Schutzprogramme - 18.10.2010 (1)
  13. Bei AV Security Suite dummerweise Avira Quarantäne gelöscht
    Plagegeister aller Art und deren Bekämpfung - 01.09.2010 (1)
  14. Datei gelöscht, Papierkorb geleert und sollte nicht gelöscht werden.
    Alles rund um Windows - 17.05.2005 (2)

Zum Thema delfix hat ESET-Quarantäne nicht gelöscht - Ich habe hier im Board Hilfe bekommen, nachdem Norton bei mir einen Trojaner entdeckt hat. Einer der letzten Schritte dieser Hilfe war es, dass ESET das gesamte System gescannt hat. - delfix hat ESET-Quarantäne nicht gelöscht...
Archiv
Du betrachtest: delfix hat ESET-Quarantäne nicht gelöscht auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.