Code:
Alles auswählen Aufklappen ATTFilter
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-17 21:58:31
Windows 6.2.9200 \Device\Harddisk0\DR0 -> \Device\00000034 ST9250827AS rev.3.AAA 232,89GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Lib!\AppData\Local\Temp\kxtdapog.sys
---- System - GMER 2.1 ----
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwWriteVirtualMemory [0x8E19776E]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwVdmControl [0x8C02E80E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwUnloadDriver [0x8E195C42]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwTerminateThread [0x8C02FCF6]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwTerminateProcess [0x8E1978EA]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSystemDebugControl [0x8C02E556]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSuspendThread [0x8C0301C8]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSuspendProcess [0x8C030066]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwShutdownSystem [0x8C02E45C]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemPowerState [0x8C02E4CE]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemInformation [0x8C02E2F8]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetContextThread [0x8C02FD16]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootOptions [0x8C02E7A8]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootEntryOrder [0x8C02E742]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwReplyWaitReceivePortEx [0x8C03122A]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwReplyWaitReceivePort [0x8C0358B4]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueueApcThreadEx [0x8C030506]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryObject [0x8C0307F8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwProtectVirtualMemory [0x8E197822]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenTimer [0x8C03B0DC]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenThread [0x8C03326E]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSemaphore [0x8C03AEF6]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSection [0x8C03B036]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenProcess [0x8C032E78]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenMutant [0x8C03AEAC]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenIoCompletion [0x8C03B122]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEventPair [0x8C03AF86]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEvent [0x8C03AF42]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeMultipleKeys [0x8C03092C]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeKey [0x8C03398C]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwModifyBootEntry [0x8C02E6DC]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwLoadDriver [0x8E195C12]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwFreeVirtualMemory [0x8E1976C2]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDuplicateObject [0x8C033596]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteBootEntry [0x8C02E676]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDebugActiveProcess [0x8C02FE9C]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateTimer [0x8C03B0B8]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateThreadEx [0x8C02F800]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateThread [0x8C02F5E4]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSemaphore [0x8C03AECE]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateSection [0x8E197992]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateMutant [0x8C03AE86]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateIoCompletion [0x8C03B0FE]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEventPair [0x8C03AF64]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEvent [0x8C03AF18]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwAssignProcessToJobObject [0x8C02F0E6]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwAlpcSendWaitReceivePort [0x8C031256]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwAllocateVirtualMemory [0x8E1975FA]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwAddBootEntry [0x8C02E610]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0x8E1B0E00]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject
---- Kernel code sections - GMER 2.1 ----
.text ntoskrnl.exe!ZwCallbackReturn + 118 81AD7E24 4 Bytes CALL E4800A2B
.text ntoskrnl.exe!ZwCallbackReturn + 16C 81AD7E78 12 Bytes [56, E5, 02, 8C, C8, 01, 03, ...]
.text ntoskrnl.exe!ZwCallbackReturn + 604 81AD8310 12 Bytes [B8, B0, 03, 8C, 00, F8, 02, ...]
.text ntoskrnl.exe!ZwReplacePartitionUnit + 26B1 81B4DAB5 1 Byte [06]
.text ntoskrnl.exe!KiDispatchInterrupt + 66A 81B5239A 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
---- User code sections - GMER 2.1 ----
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[272] KERNEL32.DLL!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\WINDOWS\system32\csrss.exe[432] kernel32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\WINDOWS\system32\wininit.exe[496] KERNEL32.DLL!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\WINDOWS\system32\csrss.exe[524] kernel32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\WINDOWS\system32\winlogon.exe[564] KERNEL32.DLL!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text ...
? C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[944] C:\WINDOWS\SYSTEM32\ntdll.dll time/date stamp mismatch;
.text C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[944] ntdll.dll!NtProtectVirtualMemory 76F55940 5 Bytes JMP 698F1986 C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\ushata.dll (Ushata module/Kaspersky Lab ZAO)
? C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[944] C:\WINDOWS\system32\KERNEL32.DLL time/date stamp mismatch; unknown module: 0.dllunknown module: cryptnet.dllunknown module: 0.dllunknown module: KERNELBASE.dll
.text C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[944] KERNEL32.DLL!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[944] user32.dll!UserClientDllInitialize + 311 74DBC3EC 4 Bytes [F0, 28, 8F, 69]
.text C:\WINDOWS\system32\dwm.exe[968] KERNEL32.DLL!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\WINDOWS\system32\svchost.exe[980] KERNEL32.DLL!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\WINDOWS\System32\svchost.exe[1084] KERNEL32.DLL!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\Classic Shell\ClassicShellService.exe[1220] KERNEL32.DLL!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\WINDOWS\system32\svchost.exe[1264] KERNEL32.DLL!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text ...
.text C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x86__8wekyb3d8bbwe\LiveComm.exe[1372] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 006103FC
.text C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x86__8wekyb3d8bbwe\LiveComm.exe[1372] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 006101F8
.text C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x86__8wekyb3d8bbwe\LiveComm.exe[1372] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 006D0A08
.text C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x86__8wekyb3d8bbwe\LiveComm.exe[1372] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 006D0804
.text C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x86__8wekyb3d8bbwe\LiveComm.exe[1372] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 006D03FC
.text C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x86__8wekyb3d8bbwe\LiveComm.exe[1372] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 006D01F8
.text C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x86__8wekyb3d8bbwe\LiveComm.exe[1372] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 006D0600
.text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[1384] KERNEL32.DLL!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\WINDOWS\system32\lxeecoms.exe[1524] KERNEL32.DLL!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\WINDOWS\System32\spoolsv.exe[1620] KERNEL32.DLL!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe[1672] KERNEL32.DLL!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\Classic Shell\ClassicStartMenu.exe[1764] KERNEL32.DLL!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text ...
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[2444] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 015803FC
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[2444] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 015801F8
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[2444] KERNEL32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[2444] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 015D0A08
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[2444] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 015D0804
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[2444] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 015D03FC
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[2444] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 015D01F8
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[2444] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 015D0600
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe[2576] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 00D603FC
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe[2576] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 00D601F8
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe[2576] KERNEL32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe[2576] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00DA0A08
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe[2576] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00DA0804
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe[2576] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 00DA03FC
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe[2576] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 00DA01F8
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe[2576] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00DA0600
.text C:\Program Files\Secunia\PSI\PSIA.exe[2672] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 007F03FC
.text C:\Program Files\Secunia\PSI\PSIA.exe[2672] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 007F01F8
.text C:\Program Files\Secunia\PSI\PSIA.exe[2672] KERNEL32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\Secunia\PSI\PSIA.exe[2672] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00820A08
.text C:\Program Files\Secunia\PSI\PSIA.exe[2672] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00820804
.text C:\Program Files\Secunia\PSI\PSIA.exe[2672] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 008203FC
.text C:\Program Files\Secunia\PSI\PSIA.exe[2672] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 008201F8
.text C:\Program Files\Secunia\PSI\PSIA.exe[2672] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00820600
.text C:\Program Files\IObit\Start Menu 8\StartMenuServices.exe[2764] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 001F03FC
.text C:\Program Files\IObit\Start Menu 8\StartMenuServices.exe[2764] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 001F01F8
.text C:\Program Files\IObit\Start Menu 8\StartMenuServices.exe[2764] user32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00230A08
.text C:\Program Files\IObit\Start Menu 8\StartMenuServices.exe[2764] user32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00230804
.text C:\Program Files\IObit\Start Menu 8\StartMenuServices.exe[2764] user32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 002303FC
.text C:\Program Files\IObit\Start Menu 8\StartMenuServices.exe[2764] user32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 002301F8
.text C:\Program Files\IObit\Start Menu 8\StartMenuServices.exe[2764] user32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00230600
.text C:\WINDOWS\system32\svchost.exe[2828] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 00AE03FC
.text C:\WINDOWS\system32\svchost.exe[2828] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 00AE01F8
.text C:\WINDOWS\system32\svchost.exe[2828] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00BE0A08
.text C:\WINDOWS\system32\svchost.exe[2828] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00BE0804
.text C:\WINDOWS\system32\svchost.exe[2828] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 00BE03FC
.text C:\WINDOWS\system32\svchost.exe[2828] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 00BE01F8
.text C:\WINDOWS\system32\svchost.exe[2828] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00BE0600
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe[2864] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 00BC03FC
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe[2864] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 00BC01F8
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe[2864] KERNEL32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe[2864] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00C00A08
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe[2864] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00C00804
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe[2864] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 00C003FC
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe[2864] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 00C001F8
.text C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe[2864] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00C00600
.text C:\Program Files\IObit\Start Menu 8\StartMenu8.exe[2972] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 002003FC
.text C:\Program Files\IObit\Start Menu 8\StartMenu8.exe[2972] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 002001F8
.text C:\Program Files\IObit\Start Menu 8\StartMenu8.exe[2972] user32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00240A08
.text C:\Program Files\IObit\Start Menu 8\StartMenu8.exe[2972] user32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00240804
.text C:\Program Files\IObit\Start Menu 8\StartMenu8.exe[2972] user32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 002403FC
.text C:\Program Files\IObit\Start Menu 8\StartMenu8.exe[2972] user32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 002401F8
.text C:\Program Files\IObit\Start Menu 8\StartMenu8.exe[2972] user32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00240600
.text C:\WINDOWS\system32\svchost.exe[3340] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 011003FC
.text C:\WINDOWS\system32\svchost.exe[3340] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 011001F8
.text C:\WINDOWS\system32\svchost.exe[3340] KERNEL32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\WINDOWS\system32\svchost.exe[3412] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 00B103FC
.text C:\WINDOWS\system32\svchost.exe[3412] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 00B101F8
.text C:\WINDOWS\system32\svchost.exe[3412] KERNEL32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\WINDOWS\system32\svchost.exe[3412] user32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00B30A08
.text C:\WINDOWS\system32\svchost.exe[3412] user32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00B30804
.text C:\WINDOWS\system32\svchost.exe[3412] user32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 00B303FC
.text C:\WINDOWS\system32\svchost.exe[3412] user32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 00B301F8
.text C:\WINDOWS\system32\svchost.exe[3412] user32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00B30600
.text C:\Windows\System32\WUDFHost.exe[3492] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 001503FC
.text C:\Windows\System32\WUDFHost.exe[3492] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 001501F8
.text C:\Windows\System32\WUDFHost.exe[3492] KERNEL32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Windows\System32\WUDFHost.exe[3492] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00190A08
.text C:\Windows\System32\WUDFHost.exe[3492] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00190804
.text C:\Windows\System32\WUDFHost.exe[3492] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 001903FC
.text C:\Windows\System32\WUDFHost.exe[3492] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 001901F8
.text C:\Windows\System32\WUDFHost.exe[3492] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00190600
.text C:\Program Files\IObit\Start Menu 8\StartMenu_Hook.exe[3512] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 002003FC
.text C:\Program Files\IObit\Start Menu 8\StartMenu_Hook.exe[3512] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 002001F8
.text C:\Program Files\IObit\Start Menu 8\StartMenu_Hook.exe[3512] KERNEL32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\IObit\Start Menu 8\StartMenu_Hook.exe[3512] user32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00240A08
.text C:\Program Files\IObit\Start Menu 8\StartMenu_Hook.exe[3512] user32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00240804
.text C:\Program Files\IObit\Start Menu 8\StartMenu_Hook.exe[3512] user32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 002403FC
.text C:\Program Files\IObit\Start Menu 8\StartMenu_Hook.exe[3512] user32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 002401F8
.text C:\Program Files\IObit\Start Menu 8\StartMenu_Hook.exe[3512] user32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00240600
.text C:\WINDOWS\system32\SearchIndexer.exe[3608] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 004703FC
.text C:\WINDOWS\system32\SearchIndexer.exe[3608] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 004701F8
.text C:\WINDOWS\system32\SearchIndexer.exe[3608] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 004A0A08
.text C:\WINDOWS\system32\SearchIndexer.exe[3608] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 004A0804
.text C:\WINDOWS\system32\SearchIndexer.exe[3608] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 004A03FC
.text C:\WINDOWS\system32\SearchIndexer.exe[3608] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 004A01F8
.text C:\WINDOWS\system32\SearchIndexer.exe[3608] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 004A0600
.text C:\Program Files\Mozilla Firefox\firefox.exe[3860] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 00C003FC
.text C:\Program Files\Mozilla Firefox\firefox.exe[3860] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 5BF6F140 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[3860] KERNEL32.dll!InterlockedExchange + 11 76A0153B 7 Bytes JMP 5C58FDF5 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[3860] KERNEL32.dll!GetStdHandle + C 76A01B37 7 Bytes JMP 5C58FDD2 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[3860] KERNEL32.dll!CreateProcessW + 69 76A04798 7 Bytes JMP 5BF72942 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[3860] KERNEL32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\Mozilla Firefox\firefox.exe[3860] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00C10A08
.text C:\Program Files\Mozilla Firefox\firefox.exe[3860] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00C10804
.text C:\Program Files\Mozilla Firefox\firefox.exe[3860] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 00C103FC
.text C:\Program Files\Mozilla Firefox\firefox.exe[3860] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 00C101F8
.text C:\Program Files\Mozilla Firefox\firefox.exe[3860] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00C10600
.text C:\Program Files\Mozilla Firefox\firefox.exe[3860] GDI32.dll!SetWindowOrgEx + 3C7 74A68C9D 7 Bytes JMP 5C58FD53 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\IObit\Start Menu 8\InstallServices32.exe[3988] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 002003FC
.text C:\Program Files\IObit\Start Menu 8\InstallServices32.exe[3988] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 002001F8
.text C:\Program Files\IObit\Start Menu 8\InstallServices32.exe[3988] KERNEL32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\IObit\Start Menu 8\InstallServices32.exe[3988] user32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00330A08
.text C:\Program Files\IObit\Start Menu 8\InstallServices32.exe[3988] user32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00330804
.text C:\Program Files\IObit\Start Menu 8\InstallServices32.exe[3988] user32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 003303FC
.text C:\Program Files\IObit\Start Menu 8\InstallServices32.exe[3988] user32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 003301F8
.text C:\Program Files\IObit\Start Menu 8\InstallServices32.exe[3988] user32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00330600
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[4240] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 006B03FC
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[4240] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 006B01F8
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[4240] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 006F0A08
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[4240] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 006F0804
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[4240] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 006F03FC
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[4240] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 006F01F8
.text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[4240] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 006F0600
.text C:\Program Files\Apoint2K\Apoint.exe[4252] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 003003FC
.text C:\Program Files\Apoint2K\Apoint.exe[4252] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 003001F8
.text C:\Program Files\Apoint2K\Apoint.exe[4252] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00320A08
.text C:\Program Files\Apoint2K\Apoint.exe[4252] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00320804
.text C:\Program Files\Apoint2K\Apoint.exe[4252] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 003203FC
.text C:\Program Files\Apoint2K\Apoint.exe[4252] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 003201F8
.text C:\Program Files\Apoint2K\Apoint.exe[4252] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00320600
.text C:\Program Files\Lexmark Pro700 Series\lxeemon.exe[4264] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 002103FC
.text C:\Program Files\Lexmark Pro700 Series\lxeemon.exe[4264] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 002101F8
.text C:\Program Files\Lexmark Pro700 Series\lxeemon.exe[4264] KERNEL32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\Lexmark Pro700 Series\lxeemon.exe[4264] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00230A08
.text C:\Program Files\Lexmark Pro700 Series\lxeemon.exe[4264] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00230804
.text C:\Program Files\Lexmark Pro700 Series\lxeemon.exe[4264] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 002303FC
.text C:\Program Files\Lexmark Pro700 Series\lxeemon.exe[4264] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 002301F8
.text C:\Program Files\Lexmark Pro700 Series\lxeemon.exe[4264] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00230600
.text C:\Program Files\Lexmark Pro700 Series\ezprint.exe[4276] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 002003FC
.text C:\Program Files\Lexmark Pro700 Series\ezprint.exe[4276] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 002001F8
.text C:\Program Files\Lexmark Pro700 Series\ezprint.exe[4276] KERNEL32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\Lexmark Pro700 Series\ezprint.exe[4276] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 004A0A08
.text C:\Program Files\Lexmark Pro700 Series\ezprint.exe[4276] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 004A0804
.text C:\Program Files\Lexmark Pro700 Series\ezprint.exe[4276] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 004A03FC
.text C:\Program Files\Lexmark Pro700 Series\ezprint.exe[4276] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 004A01F8
.text C:\Program Files\Lexmark Pro700 Series\ezprint.exe[4276] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 004A0600
.text C:\WINDOWS\system32\ctfmon.exe[4312] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 00A803FC
.text C:\WINDOWS\system32\ctfmon.exe[4312] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 00A801F8
.text C:\WINDOWS\system32\ctfmon.exe[4312] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00AA0A08
.text C:\WINDOWS\system32\ctfmon.exe[4312] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00AA0804
.text C:\WINDOWS\system32\ctfmon.exe[4312] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 00AA03FC
.text C:\WINDOWS\system32\ctfmon.exe[4312] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 00AA01F8
.text C:\WINDOWS\system32\ctfmon.exe[4312] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00AA0600
.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[4320] KERNEL32.DLL!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\Boxcryptor Classic\BoxcryptorClassic.exe[4424] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 00B303FC
.text C:\Program Files\Boxcryptor Classic\BoxcryptorClassic.exe[4424] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 00B301F8
.text C:\Program Files\Boxcryptor Classic\BoxcryptorClassic.exe[4424] KERNEL32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\Boxcryptor Classic\BoxcryptorClassic.exe[4424] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00B60A08
.text C:\Program Files\Boxcryptor Classic\BoxcryptorClassic.exe[4424] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00B60804
.text C:\Program Files\Boxcryptor Classic\BoxcryptorClassic.exe[4424] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 00B603FC
.text C:\Program Files\Boxcryptor Classic\BoxcryptorClassic.exe[4424] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 00B601F8
.text C:\Program Files\Boxcryptor Classic\BoxcryptorClassic.exe[4424] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00B60600
.text C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe[4600] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 005603FC
.text C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe[4600] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 005601F8
.text C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe[4600] KERNEL32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe[4600] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 005A0A08
.text C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe[4600] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 005A0804
.text C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe[4600] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 005A03FC
.text C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe[4600] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 005A01F8
.text C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe[4600] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 005A0600
? C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[4608] C:\WINDOWS\SYSTEM32\ntdll.dll time/date stamp mismatch;
.text C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[4608] ntdll.dll!NtProtectVirtualMemory 76F55940 5 Bytes JMP 698F1986 C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\ushata.dll (Ushata module/Kaspersky Lab ZAO)
.text C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[4608] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 001803FC
.text C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[4608] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 001801F8
? C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[4608] C:\WINDOWS\system32\KERNEL32.dll time/date stamp mismatch; unknown module: 0.dllunknown module: cryptnet.dllunknown module: 0.dllunknown module: KERNELBASE.dll
.text C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[4608] user32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 001E0A08
.text C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[4608] user32.dll!UserClientDllInitialize + 311 74DBC3EC 4 Bytes [F0, 28, 8F, 69]
.text C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[4608] user32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 001E0804
.text C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[4608] user32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 001E03FC
.text C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[4608] user32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 001E01F8
.text C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[4608] user32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 001E0600
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[4640] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 002003FC
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[4640] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 002001F8
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[4640] KERNEL32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[4640] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00220A08
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[4640] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00220804
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[4640] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 002203FC
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[4640] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 002201F8
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[4640] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00220600
.text C:\Program Files\Secunia\PSI\psi_tray.exe[4688] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 00CA03FC
.text C:\Program Files\Secunia\PSI\psi_tray.exe[4688] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 00CA01F8
.text C:\Program Files\Secunia\PSI\psi_tray.exe[4688] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00CC0A08
.text C:\Program Files\Secunia\PSI\psi_tray.exe[4688] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00CC0804
.text C:\Program Files\Secunia\PSI\psi_tray.exe[4688] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 00CC03FC
.text C:\Program Files\Secunia\PSI\psi_tray.exe[4688] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 00CC01F8
.text C:\Program Files\Secunia\PSI\psi_tray.exe[4688] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00CC0600
.text C:\Program Files\Apoint2K\Apntex.exe[4740] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 002003FC
.text C:\Program Files\Apoint2K\Apntex.exe[4740] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 002001F8
.text C:\Program Files\Apoint2K\Apntex.exe[4740] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00220A08
.text C:\Program Files\Apoint2K\Apntex.exe[4740] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00220804
.text C:\Program Files\Apoint2K\Apntex.exe[4740] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 002203FC
.text C:\Program Files\Apoint2K\Apntex.exe[4740] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 002201F8
.text C:\Program Files\Apoint2K\Apntex.exe[4740] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00220600
.text C:\WINDOWS\system32\conhost.exe[4768] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 00D703FC
.text C:\WINDOWS\system32\conhost.exe[4768] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 00D701F8
.text C:\WINDOWS\system32\conhost.exe[4768] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00D90A08
.text C:\WINDOWS\system32\conhost.exe[4768] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00D90804
.text C:\WINDOWS\system32\conhost.exe[4768] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 00D903FC
.text C:\WINDOWS\system32\conhost.exe[4768] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 00D901F8
.text C:\WINDOWS\system32\conhost.exe[4768] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00D90600
.text C:\Users\Lib!\Desktop\gmer_2.1.19163.exe[4816] KERNEL32.DLL!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\Apoint2K\HidFind.exe[4884] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 002003FC
.text C:\Program Files\Apoint2K\HidFind.exe[4884] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 002001F8
.text C:\Program Files\Apoint2K\HidFind.exe[4884] KERNEL32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\Apoint2K\HidFind.exe[4884] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00220A08
.text C:\Program Files\Apoint2K\HidFind.exe[4884] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00220804
.text C:\Program Files\Apoint2K\HidFind.exe[4884] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 002203FC
.text C:\Program Files\Apoint2K\HidFind.exe[4884] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 002201F8
.text C:\Program Files\Apoint2K\HidFind.exe[4884] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00220600
.text C:\Program Files\IObit\IObit Malware Fighter\IMF.exe[5036] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 002103FC
.text C:\Program Files\IObit\IObit Malware Fighter\IMF.exe[5036] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 002101F8
.text C:\Program Files\IObit\IObit Malware Fighter\IMF.exe[5036] KERNEL32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Program Files\IObit\IObit Malware Fighter\IMF.exe[5036] user32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 00390A08
.text C:\Program Files\IObit\IObit Malware Fighter\IMF.exe[5036] user32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 00390804
.text C:\Program Files\IObit\IObit Malware Fighter\IMF.exe[5036] user32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 003903FC
.text C:\Program Files\IObit\IObit Malware Fighter\IMF.exe[5036] user32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 003901F8
.text C:\Program Files\IObit\IObit Malware Fighter\IMF.exe[5036] user32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 00390600
.text C:\Windows\System32\RuntimeBroker.exe[5104] ntdll.dll!LdrUnloadDll 76F62029 5 Bytes JMP 009903FC
.text C:\Windows\System32\RuntimeBroker.exe[5104] ntdll.dll!LdrLoadDll 76F75D29 5 Bytes JMP 009901F8
.text C:\Windows\System32\RuntimeBroker.exe[5104] KERNEL32.dll!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
.text C:\Windows\System32\RuntimeBroker.exe[5104] USER32.dll!UnhookWindowsHookEx 74DBA37A 5 Bytes JMP 009C0A08
.text C:\Windows\System32\RuntimeBroker.exe[5104] USER32.dll!SetWindowsHookExW 74DBF223 5 Bytes JMP 009C0804
.text C:\Windows\System32\RuntimeBroker.exe[5104] USER32.dll!UnhookWinEvent 74DBFE7F 5 Bytes JMP 009C03FC
.text C:\Windows\System32\RuntimeBroker.exe[5104] USER32.dll!SetWinEventHook 74DC938E 5 Bytes JMP 009C01F8
.text C:\Windows\System32\RuntimeBroker.exe[5104] USER32.dll!SetWindowsHookExA 74DD6F76 5 Bytes JMP 009C0600
.text C:\Program Files\ESET\ESET Online Scanner\OnlineScannerApp.exe[5288] KERNEL32.DLL!GetBinaryTypeW + 6F 76A1DDE0 1 Byte [62]
---- Devices - GMER 2.1 ----
Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)
AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat cbfs4.sys (Callback File System Driver/EldoS Corporation)
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed -1136276321
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Code:
Alles auswählen Aufklappen ATTFilter
C:\Users\Lib!\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7IMQ7W51\pack[1].7z Variante von Win32/bProtector.A Anwendung
C:\Users\Lib!\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QRBR2828\wajam_install[1].exe Win32/Wajam.A Anwendung
C:\Users\Lib!\AppData\Local\Temp\WEM5e3Is.exe.part Variante von Win32/InstallCore.CN Anwendung
C:\Users\Lib!\AppData\Local\Temp\16561674.Uninstall\uninstaller.exe Variante von Win32/InstallCore.AZ Anwendung
C:\Users\Lib!\AppData\Local\Temp\16588241.Uninstall\uninstaller.exe Variante von Win32/InstallCore.AZ Anwendung
C:\Users\Lib!\AppData\Local\Temp\16631079.Uninstall\uninstaller.exe Variante von Win32/InstallCore.AZ Anwendung
C:\Users\Lib!\AppData\Local\Temp\3132765.Uninstall\uninstaller.exe Variante von Win32/InstallCore.AZ Anwendung
C:\Users\Lib!\AppData\Local\Temp\5112230.Uninstall\uninstaller.exe Variante von Win32/InstallCore.AZ Anwendung
C:\Users\Lib!\AppData\Local\Temp\EFBC509D-BAB0-7891-9EB2-06E06E3E2329\Latest\BabMaint.exe Win32/Toolbar.Babylon.I Anwendung
C:\Users\Lib!\AppData\Local\Temp\EFBC509D-BAB0-7891-9EB2-06E06E3E2329\Latest\ccp.exe Win32/Toolbar.Babylon.M Anwendung
C:\Users\Lib!\AppData\Local\Temp\EFBC509D-BAB0-7891-9EB2-06E06E3E2329\Latest\IEHelper.dll Win32/Toolbar.Babylon.E Anwendung
C:\Users\Lib!\AppData\Local\Temp\is357113909\1823777_stp\uninstaller.exe Variante von Win32/InstallCore.AZ Anwendung
C:\Users\Lib!\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z\Zip Opener Packages\uninstaller.exe Variante von Win32/InstallCore.AZ Anwendung
C:\Users\Lib!\Downloads\icq8_setup_8.0b6019 - CHIP-Downloader.exe Variante von Win32/DownloadSponsor.A Anwendung
D:\Down\CrystalDiskInfo5_0_2-en.exe Win32/OpenCandy Anwendung
D:\Down\SoftonicDownloader_fuer_unlocker.exe Win32/SoftonicDownloader.E Anwendung
D:\Down\winamp561_full_emusic-7plus_all.exe Win32/OpenCandy Anwendung
D:\Down\winamp5623_full_emusic-7plus_de-de.exe Win32/OpenCandy Anwendung
D:\Down\winamp563_full_emusic-7plus_de-de.exe Win32/OpenCandy Anwendung
Code:
Alles auswählen Aufklappen ATTFilter
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Datenbank Version: v2013.09.17.07
Windows 8 x86 NTFS
Internet Explorer 10.0.9200.16688
Lib! :: LIB-PC [Administrator]
17.09.2013 15:57:48
mbam-log-2013-09-17 (15-57-48).txt
Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 217202
Laufzeit: 9 Minute(n), 28 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 7
HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
HKCR\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} (PUP.Optional.Wajam.A) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} (PUP.Optional.Wajam) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\DataMngr (PUP.Optional.DataMngr.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\BabSolution\Updater (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Infizierte Registrierungswerte: 1
HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0L1N1H2O1S -> Erfolgreich gelöscht und in Quarantäne gestellt.
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 3
C:\Users\Lib!\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lib!\AppData\Roaming\BABSOLUTION (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lib!\AppData\Roaming\BABSOLUTION\Shared (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Infizierte Dateien: 19
C:\ProgramData\DSearchLink\DSearchLink.exe (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt.
C:\Users\Lib!\AppData\Local\Temp\ZKRge08m.exe.part (PUP.Optional.Bandoo) -> Keine Aktion durchgeführt.
C:\Users\Lib!\AppData\Local\Temp\WEM5e3Is.exe.part (PUP.Optional.Installcore) -> Keine Aktion durchgeführt.
C:\Users\Lib!\AppData\Local\Temp\EFBC509D-BAB0-7891-9EB2-06E06E3E2329\Latest\BabMaint.exe (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt.
C:\Users\Lib!\AppData\Local\Temp\EFBC509D-BAB0-7891-9EB2-06E06E3E2329\Latest\BExternal.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lib!\AppData\Local\Temp\EFBC509D-BAB0-7891-9EB2-06E06E3E2329\Latest\CrxInstaller.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lib!\AppData\Local\Temp\EFBC509D-BAB0-7891-9EB2-06E06E3E2329\Latest\DSearchLink.exe (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lib!\AppData\Local\Temp\EFBC509D-BAB0-7891-9EB2-06E06E3E2329\Latest\MntrDLLInstall.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lib!\AppData\Local\Temp\EFBC509D-BAB0-7891-9EB2-06E06E3E2329\Latest\MyDeltaTB.exe (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lib!\AppData\Local\Temp\EFBC509D-BAB0-7891-9EB2-06E06E3E2329\Latest\Setup.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lib!\AppData\Local\Temp\is357113909\1823681_stp.EXE (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lib!\AppData\Local\Temp\is357113909\1823334_stp\DeltaTB.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lib!\AppData\Local\Temp\is357113909\1823419_stp\wajam_download.exe (PUP.Optional.Wajam) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lib!\AppData\Local\Temp\is357113909\1823565_stp\OptimizerPro.exe (PUP.Optional.OptimizePro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Temp\Optimizer_Pro.exe (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lib!\Downloads\ZipOpenerSetup.exe (PUP.Optional.Installcore) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lib!\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lib!\AppData\Local\Google\Chrome\User Data\Default\Local Storage\CHROME-EXTENSION_EOONCJEJNPPFJJKLAPAAMHCDMJBILMDE_0.LOCALSTORAGE (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lib!\AppData\Roaming\BABSOLUTION\Shared\BUSolution.dll (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
(Ende)
17.09.2013, 21:12
Hybrid-Darstellung
