| |
| |||||||
Log-Analyse und Auswertung: Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle??Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
29.01.2014, 14:14
| #1 |
 |  Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Liebe Helfer, bei der versuchten Reparatur meines Systems habe ich nach ersten Fortschritten naiverweise den PCSmartFixer heruntergeladen  und einen Scan durchgeführt. Nach kurzer Recherche sofort das Programm beendet und mit Spybot S&D das System bereinigen lassen. Soweit zur Vorgeschichte..FRST gibt folgende Fehlermeldungen aus: Error saving files: C:\FRST\Hives\BCD [.. weiter mit HIVES\system, software, default, security, sam, Users\00000001\NTuser.dat, Users\00000002\Usrclass.dat] Continue with the next file? RegCreateKeyEx: 5 Zugriff verweigert Ja, ich habe die 64-bit-Version heruntergeladen  Beim zweiten Klick auf Scan geht der Scan dann los (..?!?) und funktioniert ab da immer. Mein System: Win 7 64 bit, Avast free Virenschutz - findet regelmäßig nichts, außer den Bedrohungen, die sofort geblockt werden. Logs gibt es noch von Spybot, wegen Unterbrechungen sind es mehrere Checks und Fixes, ein paar sind möglicherweise zu lang für hier.. FRST.txt hat 11 Seiten, Gmer.txt ist nicht viel kleiner .. doch lieber als Anhang posten?) Was passiert eigentlich, wenn man im Defogger nicht re-enabled? Gruß und Dank im Voraus Jo07 Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 09:33 on 29/01/2014 (Admin)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
|
|
29.01.2014, 14:53
| #2 | |
| /// the machine /// TB-Ausbilder    |  Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? hi,
__________________Zitat:
Jetzt die Logs bitte posten, in Codetags, ruhig mehrere Antworten benutzen und die Logs aufteilen.
__________________ |
|
29.01.2014, 15:16
| #3 |
| | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Hallo Schrauber,
__________________in Ordnung, dann erstmal die größte, Gmer Teil1 (2 und 3 folgen) Code:
ATTFilter GMER 2.1.19355 - hxxp://www.gmer.net
Rootkit scan 2014-01-29 13:17:28
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD16 rev.11.0 149,05GB
Running: gmer.exe; Driver: C:\Users\Admin\AppData\Local\Temp\pwdirfow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800033f8000 63 bytes [00, 00, 15, 02, 46, 69, 6C, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 592 fffff800033f8040 1 byte [01]
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 000000014a280460
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 000000014a280450
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 000000014a280370
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 000000014a280470
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 000000014a2803e0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 000000014a280320
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 000000014a2803b0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 000000014a280390
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 000000014a2802e0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 000000014a2802d0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 000000014a280310
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 000000014a2803c0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 000000014a2803f0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 000000014a280230
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 000000014a280480
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 000000014a2803a0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 000000014a2802f0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 000000014a280350
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 000000014a280290
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 000000014a2802b0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 000000014a2803d0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 000000014a280330
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 000000014a280410
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 000000014a280240
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 000000014a2801e0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 000000014a280250
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 000000014a280490
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 000000014a2804a0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 000000014a280300
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 000000014a280360
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 000000014a2802a0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 000000014a2802c0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 000000014a280380
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 000000014a280340
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 000000014a280440
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 000000014a280260
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 000000014a280270
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 000000014a280400
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 000000014a2801f0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 000000014a280210
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 000000014a280200
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 000000014a280420
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 000000014a280430
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 000000014a280220
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 000000014a280280
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 000000014a280460
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 000000014a280450
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 000000014a280370
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 000000014a280470
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 000000014a2803e0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 000000014a280320
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 000000014a2803b0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 000000014a280390
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 000000014a2802e0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 000000014a2802d0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 000000014a280310
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 000000014a2803c0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 000000014a2803f0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 000000014a280230
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 000000014a280480
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 000000014a2803a0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 000000014a2802f0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 000000014a280350
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 000000014a280290
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 000000014a2802b0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 000000014a2803d0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 000000014a280330
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 000000014a280410
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 000000014a280240
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 000000014a2801e0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 000000014a280250
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 000000014a280490
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 000000014a2804a0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 000000014a280300
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 000000014a280360
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 000000014a2802a0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 000000014a2802c0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 000000014a280380
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 000000014a280340
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 000000014a280440
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 000000014a280260
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 000000014a280270
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 000000014a280400
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 000000014a2801f0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 000000014a280210
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 000000014a280200
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 000000014a280420
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 000000014a280430
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 000000014a280220
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 000000014a280280
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\services.exe[608] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\svchost.exe[748] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000001000703b0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000100070390
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000001000702e0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000001000702d0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000100070310
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000001000703c0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000001000703f0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000100070230
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000100070480
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000001000703a0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000001000702f0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000100070350
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000100070290
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000001000702b0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000001000703d0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000100070330
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000100070410
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000100070240
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000001000701e0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000100070250
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000100070490
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000001000704a0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000100070300
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000100070360
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000001000702a0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000001000702c0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000100070380
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280
.text C:\Windows\system32\svchost.exe[832] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000001000703b0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000100070390
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000001000702e0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000001000702d0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000100070310
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000001000703c0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000001000703f0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000100070230
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000100070480
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000001000703a0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000001000702f0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000100070350
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000100070290
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000001000702b0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000001000703d0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000100070330
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000100070410
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000100070240
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000001000701e0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000100070250
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000100070490
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000001000704a0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000100070300
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000100070360
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000001000702a0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000001000702c0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000100070380
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280
.text C:\Windows\System32\svchost.exe[984] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\System32\svchost.exe[352] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000001000703b0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000100070390
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000001000702e0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000001000702d0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000100070310
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000001000703c0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000001000703f0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000100070230
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000100070480
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000001000703a0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000001000702f0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000100070350
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000100070290
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000001000702b0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000001000703d0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000100070330
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000100070410
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000100070240
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000001000701e0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000100070250
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000100070490
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000001000704a0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000100070300
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000100070360
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000001000702a0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000001000702c0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000100070380
|
|
29.01.2014, 15:24
| #4 |
| | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Gmer Teil2 [CODE] .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280 .text C:\Windows\system32\svchost.exe[472] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280 .text C:\Windows\system32\svchost.exe[372] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000001000703b0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000100070390 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000001000702e0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000001000702d0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000100070310 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000001000703c0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000001000703f0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000100070230 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000100070480 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000001000703a0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000001000702f0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000100070350 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000100070290 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000001000702b0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000001000703d0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000100070330 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000100070410 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000100070240 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000001000701e0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000100070250 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000100070490 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000001000704a0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000100070300 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000100070360 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000001000702a0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000001000702c0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000100070380 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Program Files (x86)\Acer\Registration\GregHSRW.exe[1720] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62] .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280 .text C:\Windows\Explorer.EXE[2380] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000001000703b0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000100070390 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000001000702e0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000001000702d0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000100070310 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000001000703c0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000001000703f0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000100070230 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000100070480 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000001000703a0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000001000702f0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000100070350 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000100070290 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000001000702b0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000001000703d0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000100070330 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000100070410 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000100070240 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000001000701e0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000100070250 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000100070490 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000001000704a0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000100070300 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000100070360 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000001000702a0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000001000702c0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000100070380 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe[2576] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62] .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe[3792] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62] .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320 |
|
29.01.2014, 15:31
| #5 |
| | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Nochmal Teil 2 mit vollständigen Code-Tags  Code:
ATTFilter .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280
.text C:\Windows\system32\svchost.exe[472] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\svchost.exe[372] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000001000703b0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000100070390
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000001000702e0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000001000702d0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000100070310
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000001000703c0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000001000703f0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000100070230
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000100070480
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000001000703a0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000001000702f0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000100070350
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000100070290
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000001000702b0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000001000703d0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000100070330
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000100070410
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000100070240
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000001000701e0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000100070250
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000100070490
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000001000704a0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000100070300
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000100070360
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000001000702a0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000001000702c0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000100070380
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files (x86)\Acer\Registration\GregHSRW.exe[1720] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\Explorer.EXE[2380] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000001000703b0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000100070390
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000001000702e0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000001000702d0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000100070310
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000001000703c0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000001000703f0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000100070230
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000100070480
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000001000703a0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000001000702f0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000100070350
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000100070290
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000001000702b0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000001000703d0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000100070330
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000100070410
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000100070240
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000001000701e0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000100070250
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000100070490
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000001000704a0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000100070300
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000100070360
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000001000702a0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000001000702c0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000100070380
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe[2576] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe[3792] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320
|
|
29.01.2014, 15:38
| #6 |
| | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Gmer Teil 3 Code:
ATTFilter .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000100070390
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000001000702e0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000001000702d0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000100070310
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000001000703c0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000001000703f0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000100070230
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000100070480
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000001000703a0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000001000702f0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000100070350
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000100070290
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000001000702b0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000001000703d0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000100070330
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000100070410
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000100070240
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000001000701e0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000100070250
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000100070490
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000001000704a0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000100070300
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000100070360
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000001000702a0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000001000702c0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000100070380
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420*
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[800] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[800] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000765e1465 2 bytes [5E, 76]
.text C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[800] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000765e14bb 2 bytes [5E, 76]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[848] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3296] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\System32\hkcmd.exe[2708] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\System32\igfxpers.exe[760] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4072] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4072] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000765e1465 2 bytes [5E, 76]
.text C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4072] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000765e14bb 2 bytes [5E, 76]
.text ... * 2
.text C:\Program Files\Avast5\AvastUI.exe[3688] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\ProgramData\FLEXnet\Connect\11\agent.exe[2536] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000001000703b0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000100070390
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000001000702e0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000001000702d0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000100070310
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000001000703c0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000001000703f0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000100070230
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000100070480
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000001000703a0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000001000702f0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000100070350
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000100070290
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000001000702b0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000001000703d0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000100070330
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000100070410
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000100070240
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000001000701e0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000100070250
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000100070490
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000001000704a0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000100070300
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000100070360
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000001000702a0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000001000702c0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000100070380
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files\Apoint2K\Apntex.exe[1012] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\taskmgr.exe[3420] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
|
|
30.01.2014, 14:37
| #7 |
| /// the machine /// TB-Ausbilder | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
30.01.2014, 20:33
| #8 |
| | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Nr. 1 Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.01.30.04 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 Admin :: *****-PC [Administrator] 30.01.2014 15:46:45 mbam-log-2014-01-30 (15-46-45).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 298744 Laufzeit: 8 Minute(n), 59 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 1 HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 6 C:\Users\Admin\AppData\Local\Temp\mt_ffx\Delta (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\mt_ffx\Delta\delta (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\mt_ffx\Delta\delta\1.8.16.16 (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\ct3288691 (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\ct3297265 (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\ct3297861 (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 4 C:\Users\*****\Downloads\cdbxp_setup_4.5.2.4214_minimal.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\*****\Downloads\FreeFileSync_5.11_setup.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\*****\Downloads\FreeFileSync_5.12_setup.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\*****\Downloads\FreeFileSync_5.15_Windows_Setup.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) FRST folgt. ..und >Hilfe< keine Thunderbird-Daten mehr vorhanden. Außer einer Adresse im Adressbuch. Code:
ATTFilter # AdwCleaner v3.018 - Bericht erstellt am 30/01/2014 um 16:42:03
# Updated 28/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Admin - ****-PC
# Gestartet von : C:\Users\****\Downloads\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\ProgramData\Uniblue\DriverScanner
Ordner Gelöscht : C:\Program Files (x86)\FTDownloader.com
Ordner Gelöscht : C:\Users\****\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\boost_interprocess
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\****\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\****\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\****\AppData\Local\Babylon
Ordner Gelöscht : C:\Users\****\AppData\Local\Temp\Babylon
Ordner Gelöscht : C:\Users\****\AppData\Local\Temp\boost_interprocess
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\ConduitEngine
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\DVDVideoSoftTB
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\****\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Admin\AppData\Local\PutLockerDownloader
Ordner Gelöscht : C:\Users\Admin\AppData\Local\Temp\Babylon
Ordner Gelöscht : C:\Users\Admin\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Admin\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Admin\AppData\Roaming\Yontoo
Ordner Gelöscht : C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FTDownloader.com
Ordner Gelöscht : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7k1i9pr.default\Extensions\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}
Datei Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\bprotector_extensions.sqlite
Datei Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\bprotector_prefs.js
Datei Gelöscht : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7k1i9pr.default\invalidprefs.js
Datei Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\user.js
Datei Gelöscht : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7k1i9pr.default\user.js
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bbffdhejhaoiflnpooogkckfdcmmjppn
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\.bdc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\.bgl
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\.bof
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\BabylonHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Conduit.Engine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\driverscanner
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\FTDownloader
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabylonTC_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabylonTC_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\5b28a8abd39ea47
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2269050
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{6536801B-F50C-449B-9476-093DFD3789E3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0BF91075-F457-4A8B-99EF-140B52D2F22A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{37425600-CB21-49A0-8659-476FBAB0F8E8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{64B00DAC-870D-4E6A-8D34-3A6E3E427A30}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0BF91075-F457-4A8B-99EF-140B52D2F22A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{37425600-CB21-49A0-8659-476FBAB0F8E8}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Tarma Installer
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\prefs.js ]
Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://www2.delta-search.com/?affID=119777&tt=gc_&babsrc=NT_ss&mntrId=04DC0017C4AFA9FC");
Zeile gelöscht : user_pref("browser.search.order.1", "Delta Search");
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\"I[...]
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.rambler.ru.style", ".WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}");
Zeile gelöscht : user_pref("extentions.y2layers.defaultEnableAppsList", "bestvideodownloader,brain/default2,easyinline/dock,superfish,superfishgoogleeil,yontooinstalled,yontoonewoffers,dropdowndeals");
Zeile gelöscht : user_pref("extentions.y2layers.installId", "c1580c3d-02ab-4ae9-b426-d870a07be818");
[ Datei : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\agw5p9qz.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #psa-teoma-result .ptbs .WRCN, #teoma-results .ptbs .WRCN {display:inline !important; background: url(\\\\\"IMAGE\\\\\") r[...]
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\\\\\\\:\\\\\\\\/\\\\\\\\/(.+\\\\\\\\.)?ask\\\\\\\\.com\\\\\\\\/.*");
[ Datei : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7k1i9pr.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\"I[...]
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.rambler.ru.style", ".WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}");
Zeile gelöscht : user_pref("extentions.y2layers.defaultEnableAppsList", "twittube,buzzdock,YontooNewOffers");
Zeile gelöscht : user_pref("extentions.y2layers.installId", "c1580c3d-02ab-4ae9-b426-d870a07be818");
[ Datei : C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\2eqwvwc3.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\"I[...]
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.rambler.ru.style", ".WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}");
*************************
AdwCleaner[R0].txt - [8464 octets] - [30/01/2014 16:14:54]
AdwCleaner[S0].txt - [8321 octets] - [30/01/2014 16:42:03]
########## EOF - \AdwCleaner\AdwCleaner[S0].txt - [8381 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Home Premium x64
Ran by Admin on 30.01.2014 at 17:06:33,11
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-739932340-378401146-3079080163-1005\Software\sweetim
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Users\Admin\AppData\Roaming\getrighttogo"
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 30.01.2014 at 17:18:12,88
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014 Ran by **** (ATTENTION: The logged in user is not administrator) on ****-PC on 30-01-2014 19:42:33 Running from C:\Users\****\Downloads Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Acer Inc.) C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (AVAST Software) C:\Program Files\Avast5\AvastUI.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Hidfind.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation) HKLM\...\Run: [ePower_DMC] - C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe [492032 2009-07-21] (Acer Inc.) HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8060960 2009-08-06] (Realtek Semiconductor) HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [295936 2009-05-22] (Alps Electric Co., Ltd.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated) HKLM-x32\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe [2068856 2011-10-12] (Flexera Software LLC.) HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\Avast5\AvastUI.exe [3764024 2013-12-27] (AVAST Software) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\RunOnce: [20131224] - C:\Program Files\Avast5\setup\emupdate\2c383f79-31d0-4459-a858-971cd985047c.exe /check [181136 2014-01-30] (AVAST Software) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] - rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [1127496 2013-04-04] (Malwarebytes Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKCU\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKtray.exe [619216 2009-05-18] (Expert System S.p.A.) HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18642024 2013-02-28] (Skype Technologies S.A.) HKCU\...\Run: [AutoStart-Manager 2006] - C:\Program Files (x86)\Tools&More\Autostart-Manager\AutoStart-Manager.exe [397312 2005-12-23] (Wirth New Media Sarl ) HKCU\...\Policies\system: [LogonHoursAction] 2 HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1 Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.bing.com HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=extensa_5230&r=27361109a116l0308z185i4751t287 HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR URLSearchHook: HKCU - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_de SearchScopes: HKCU - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050 BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Avast5\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software) Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software) Toolbar: HKLM-x32 - No Name - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - No File Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\Avast5\aswWebRepIE.dll (AVAST Software) Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No File DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - No File Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default FF DefaultSearchEngine: benefind FF SelectedSearchEngine: benefind FF Homepage: hxxp://www.benefind.de FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @java.com/DTPlugin,version=10.13.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.13.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll () FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8064.0206 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: nuance.com/DragonRIAPlugin - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\npDgnRia.dll (Nuance Communications Inc.) FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Users\****\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\100-search-engines.xml FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\benefind.xml FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\ecosia.xml FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\scroogle-ssl-search.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: RequestPolicy - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\Extensions\requestpolicy@requestpolicy.com.xpi [2013-01-29] FF Extension: NoScript - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-01-28] FF Extension: Google Privacy - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\Extensions\{ea61041c-1e22-4400-99a0-aea461e69d04}.xpi [2013-01-28] FF HKLM-x32\...\Firefox\Extensions: [jid0-lmZNVK7a82O8cufhdfB9dUDfA2w@jetpack] - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\ffShim.xpi FF Extension: Dragon NaturallySpeaking Rich Internet Application Support - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\ffShim.xpi [2012-07-13] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Avast5\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\Avast5\WebRep\FF [2011-04-25] ==================== Services (Whitelisted) ================= R2 ABBYY.Licensing.FineReader.Professional.11.0; C:\Program Files (x86)\ABBYY FineReader 11\NetworkLicenseServer.exe [819976 2011-09-22] (ABBYY) R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759072 2008-10-09] (ABBYY (BIT Software)) R2 avast! Antivirus; C:\Program Files\Avast5\AvastSvc.exe [50344 2013-12-27] (AVAST Software) R2 ETService; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [24576 2009-08-12] () S2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 MSSQL$MSSMLBIZ; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation) S2 NewServiceInstall1; C:\Program Files (x86)\SDL International\T2007_FL\TT\Lng\Dialogs1031.lng [11264 2007-04-23] () R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated) S2 LEC TranslateDotNet Server; "C:\Program Files (x86)\Power Translator 12\LogoMedia TranslateDotNet Server.exe" [x] ==================== Drivers (Whitelisted) ==================== R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2013-10-23] (AVAST Software) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2013-12-27] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-10-23] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-10-23] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2013-12-27] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2013-12-27] (AVAST Software) R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2013-12-27] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2013-12-27] () R3 bbcap; C:\Windows\System32\DRIVERS\bbcap.sys [4608 2010-12-23] (Windows (R) Codename Longhorn DDK provider) S3 O2MDRDR; C:\Windows\system32\DRIVERS\o2mdx64.sys [63264 2009-05-07] (O2Micro ) S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] () S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-01-30 19:42 - 2014-01-30 19:42 - 00017732 _____ C:\Users\****\Downloads\FRST.txt 2014-01-30 18:11 - 2014-01-30 18:11 - 00000000 ____D C:\Windows\system32\%LOCALAPPDATA% 2014-01-30 17:18 - 2014-01-30 17:18 - 00000893 _____ C:\Users\Admin\Desktop\JRT.txt 2014-01-30 17:06 - 2014-01-30 17:06 - 00000000 ____D C:\Windows\ERUNT 2014-01-30 16:14 - 2014-01-30 16:42 - 00000000 ____D C:\AdwCleaner 2014-01-30 15:37 - 2014-01-30 15:37 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes 2014-01-30 15:34 - 2014-01-30 15:34 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-01-30 15:34 - 2014-01-30 15:34 - 00000000 ____D C:\ProgramData\Malwarebytes 2014-01-30 15:34 - 2014-01-30 15:34 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-01-30 15:34 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-01-30 15:25 - 2014-01-30 15:25 - 01037068 _____ (Thisisu) C:\Users\****\Downloads\JRT.exe 2014-01-30 15:19 - 2014-01-30 15:19 - 01166132 _____ C:\Users\****\Downloads\adwcleaner.exe 2014-01-30 15:17 - 2014-01-30 15:18 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\****\Downloads\mbam-setup-1.75.0.1300.exe 2014-01-29 14:28 - 2014-01-29 14:28 - 00000000 ____D C:\Users\*****\AppData\Roaming\AVAST Software 2014-01-29 13:17 - 2014-01-29 13:24 - 00462752 _____ C:\Users\****\Desktop\Gmer.txt 2014-01-29 13:16 - 2014-01-29 13:16 - 00462761 _____ C:\Users\Admin\Desktop\Gmer.log 2014-01-29 12:08 - 2014-01-29 12:08 - 00658328 _____ C:\Users\Admin\Desktop\Gmer.txt 2014-01-29 10:26 - 2014-01-29 11:07 - 00029581 _____ C:\Users\****\Desktop\Addition.txt 2014-01-29 10:24 - 2014-01-29 10:55 - 00034881 _____ C:\Users\****\Desktop\FRST.txt 2014-01-29 10:06 - 2014-01-30 19:42 - 00000000 ____D C:\FRST 2014-01-29 09:33 - 2014-01-29 09:33 - 00000000 _____ C:\Users\Admin\defogger_reenable 2014-01-29 09:29 - 2014-01-29 09:29 - 00370971 _____ C:\Users\****\Desktop\gmer_2.1.19355.zip 2014-01-29 09:23 - 2014-01-29 09:24 - 02079744 _____ (Farbar) C:\Users\****\Downloads\FRST64.exe 2014-01-29 09:23 - 2014-01-29 09:23 - 00050477 _____ C:\Users\****\Downloads\Defogger(1).exe 2014-01-28 23:39 - 2014-01-28 23:40 - 00002210 _____ C:\Windows\wininit.ini 2014-01-28 21:17 - 2014-01-28 21:17 - 00000000 ____D C:\Program Files\Common Files\Apple 2014-01-28 20:39 - 2014-01-28 22:54 - 00359656 _____ (Microsoft Corporation) C:\Users\Admin\Downloads\msicuu2.exe 2014-01-28 14:23 - 2014-01-28 14:23 - 00283096 _____ (Mozilla) C:\Users\****\Downloads\Firefox Setup Stub 26.0.exe 2014-01-27 16:46 - 2014-01-27 16:48 - 90578216 _____ (AVAST Software) C:\Users\****\Downloads\avast_free_antivirus_setup.exe 2014-01-26 12:43 - 2014-01-26 12:43 - 00000000 ____D C:\.jes 2014-01-24 23:40 - 2014-01-24 23:40 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih(1).exe 2014-01-24 22:11 - 2014-01-24 22:11 - 00000000 ____D C:\ProgramData\Oracle 2014-01-24 22:10 - 2014-01-24 22:10 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-01-24 22:10 - 2014-01-24 22:10 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-01-24 22:10 - 2014-01-24 22:10 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-01-24 22:10 - 2014-01-24 22:10 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-01-24 22:06 - 2014-01-30 16:42 - 00000000 ____D C:\ProgramData\Uniblue 2014-01-24 21:56 - 2014-01-24 21:56 - 00000000 ____D C:\Users\Admin\AppData\Roaming\AVAST Software 2014-01-24 21:48 - 2014-01-24 21:51 - 00000000 ____D C:\Users\Desktop\Dragon NaturallySpeaking 11 Home 2014-01-24 21:48 - 2013-03-04 11:09 - 00005757 _____ C:\Users\Desktop\ADMIN-Aktionen ab 28-01-13.doc - Verknüpfung.lnk 2014-01-24 21:48 - 2013-02-04 18:21 - 00001042 _____ C:\Users\Desktop\ProjectX.jar - Verknüpfung.lnk 2014-01-24 21:48 - 2013-02-04 18:11 - 00208384 _____ (Imago) C:\Users\Desktop\ImagoMPEG-Muxer.exe 2014-01-24 21:48 - 2012-10-09 13:55 - 00001014 _____ C:\Users\Desktop\kreawi Prüfungstrainer (Demo).lnk 2014-01-24 21:48 - 2012-05-05 20:14 - 00001380 _____ C:\Users\Desktop\CopyTrans Control Center.lnk 2014-01-24 21:48 - 2011-09-22 10:05 - 00001172 _____ C:\Users\Desktop\WavePad Sound Editor.lnk 2014-01-24 21:48 - 2011-09-01 07:08 - 00000977 _____ C:\Users\Desktop\Juice.lnk 2014-01-24 21:48 - 2011-05-16 06:41 - 00006332 _____ C:\Users\Desktop\Router_Setup.html 2014-01-24 21:48 - 2011-04-07 13:35 - 00001304 _____ C:\Users\Desktop\Audio Converter.lnk 2014-01-24 21:48 - 2011-03-26 12:29 - 00001402 _____ C:\Users\Desktop\YouTube to MP3 Converter.lnk 2014-01-24 21:48 - 2011-03-26 12:29 - 00001243 _____ C:\Users\Desktop\DVDVideoSoft Studio.lnk 2014-01-24 21:48 - 2009-05-20 22:32 - 00000172 ____R C:\Users\Desktop\Router Login.url 2014-01-24 21:42 - 2014-01-24 21:42 - 00000667 _____ C:\Besitz übernehmen.reg 2014-01-24 21:36 - 2014-01-24 21:36 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih.exe 2014-01-23 12:44 - 2014-01-23 12:44 - 00001781 _____ C:\Users\Public\Desktop\f4.lnk 2014-01-23 12:43 - 2014-01-23 12:43 - 00006906 _____ C:\Windows\SysWOW64\jupdate-1.6.0_07-b06.log 2014-01-23 12:42 - 2014-01-23 12:44 - 00000000 ____D C:\Program Files (x86)\f4 2014-01-15 14:26 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2014-01-15 14:26 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2014-01-15 14:26 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2014-01-15 14:26 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2014-01-15 14:26 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2014-01-15 14:26 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2014-01-15 14:26 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2014-01-15 14:26 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2014-01-15 14:26 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-01-09 15:09 - 2014-01-09 18:12 - 00000000 ____D C:\Users\****\Documents\Family Tree Maker 2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\IsolatedStorage 2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\Ancestry.com 2014-01-09 14:49 - 2014-01-09 14:49 - 00000000 ____D C:\IExp1.tmp 2014-01-09 14:48 - 2014-01-09 14:49 - 00000000 ___HD C:\Windows\msdownld.tmp 2014-01-09 14:48 - 2014-01-09 14:48 - 00002043 _____ C:\Users\Public\Desktop\Family Tree Maker 2010 (DE).lnk 2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Windows\RegisteredPackages 2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft WSE 3.0 2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\Microsoft WSE 2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\IExp0.tmp 2014-01-09 14:43 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\Family Tree Maker 2010 (DE) 2014-01-09 14:43 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\BCL Technologies 2014-01-09 14:34 - 2014-01-09 14:34 - 00000000 ____D C:\Users\****\AppData\Roaming\YORAKO 2014-01-09 14:31 - 2014-01-09 14:31 - 00000000 ____D C:\Program Files (x86)\Namenslexikon ==================== One Month Modified Files and Folders ======= 2014-01-30 19:44 - 2014-01-30 19:42 - 00017732 _____ C:\Users\****\Downloads\FRST.txt 2014-01-30 19:43 - 2010-04-05 13:46 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-01-30 19:42 - 2014-01-29 10:06 - 00000000 ____D C:\FRST 2014-01-30 19:14 - 2013-01-28 11:45 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-01-30 18:11 - 2014-01-30 18:11 - 00000000 ____D C:\Windows\system32\%LOCALAPPDATA% 2014-01-30 17:52 - 2013-03-10 18:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird 2014-01-30 17:52 - 2010-09-10 12:01 - 00000000 ____D C:\Users\Admin\AppData\Local\Thunderbird 2014-01-30 17:18 - 2014-01-30 17:18 - 00000893 _____ C:\Users\Admin\Desktop\JRT.txt 2014-01-30 17:06 - 2014-01-30 17:06 - 00000000 ____D C:\Windows\ERUNT 2014-01-30 17:01 - 2010-04-05 13:37 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-01-30 16:52 - 2009-07-14 05:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-01-30 16:52 - 2009-07-14 05:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-01-30 16:44 - 2011-09-22 18:24 - 00042276 _____ C:\Windows\setupact.log 2014-01-30 16:44 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2014-01-30 16:43 - 2009-09-08 05:37 - 01388732 _____ C:\Windows\WindowsUpdate.log 2014-01-30 16:42 - 2014-01-30 16:14 - 00000000 ____D C:\AdwCleaner 2014-01-30 16:42 - 2014-01-24 22:06 - 00000000 ____D C:\ProgramData\Uniblue 2014-01-30 16:42 - 2011-11-30 17:44 - 00000000 ____D C:\Users\****\AppData\Roaming\Babylon 2014-01-30 16:06 - 2011-11-13 17:03 - 00098358 _____ C:\Windows\PFRO.log 2014-01-30 15:37 - 2014-01-30 15:37 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes 2014-01-30 15:34 - 2014-01-30 15:34 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-01-30 15:34 - 2014-01-30 15:34 - 00000000 ____D C:\ProgramData\Malwarebytes 2014-01-30 15:34 - 2014-01-30 15:34 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-01-30 15:25 - 2014-01-30 15:25 - 01037068 _____ (Thisisu) C:\Users\****\Downloads\JRT.exe 2014-01-30 15:19 - 2014-01-30 15:19 - 01166132 _____ C:\Users\****\Downloads\adwcleaner.exe 2014-01-30 15:18 - 2014-01-30 15:17 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\****\Downloads\mbam-setup-1.75.0.1300.exe 2014-01-30 12:14 - 2013-08-01 11:34 - 00000000 ____D C:\pending 2014-01-30 11:38 - 2010-03-30 15:51 - 00088479 _____ C:\Windows\Run32A50.mch 2014-01-30 09:58 - 2010-03-31 16:16 - 00000131 _____ C:\Windows\Star.ini 2014-01-30 09:58 - 2010-03-30 15:59 - 00000000 ____D C:\Program Files (x86)\Transit XV 2014-01-30 09:58 - 2010-03-30 15:28 - 00000035 _____ C:\Windows\A5W.INI 2014-01-30 09:58 - 2010-03-30 15:28 - 00000000 ____D C:\Windows\A5W_DATA 2014-01-29 15:06 - 2011-10-28 20:16 - 00002035 _____ C:\Users\****\AppData\Roaming\SAS7_000.DAT 2014-01-29 14:39 - 2013-01-28 11:45 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-01-29 14:39 - 2013-01-28 11:45 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-01-29 14:39 - 2010-10-13 14:13 - 00000000 ____D C:\Users\Admin\AppData\Local\Adobe 2014-01-29 14:35 - 2011-06-21 08:30 - 00000000 ____D C:\Users\****** 2014-01-29 14:28 - 2014-01-29 14:28 - 00000000 ____D C:\Users\*****\AppData\Roaming\AVAST Software 2014-01-29 14:24 - 2010-05-14 22:01 - 00000404 _____ C:\Windows\Brownie.ini 2014-01-29 13:24 - 2014-01-29 13:17 - 00462752 _____ C:\Users\****\Desktop\Gmer.txt 2014-01-29 13:16 - 2014-01-29 13:16 - 00462761 _____ C:\Users\Admin\Desktop\Gmer.log 2014-01-29 12:08 - 2014-01-29 12:08 - 00658328 _____ C:\Users\Admin\Desktop\Gmer.txt 2014-01-29 11:07 - 2014-01-29 10:26 - 00029581 _____ C:\Users\****\Desktop\Addition.txt 2014-01-29 10:55 - 2014-01-29 10:24 - 00034881 _____ C:\Users\****\Desktop\FRST.txt 2014-01-29 09:33 - 2014-01-29 09:33 - 00000000 _____ C:\Users\Admin\defogger_reenable 2014-01-29 09:33 - 2013-05-07 18:29 - 00000472 _____ C:\Users\****\Desktop\defogger_disable.log 2014-01-29 09:33 - 2010-06-20 22:32 - 00000000 ____D C:\Users\Admin 2014-01-29 09:29 - 2014-01-29 09:29 - 00370971 _____ C:\Users\****\Desktop\gmer_2.1.19355.zip 2014-01-29 09:24 - 2014-01-29 09:23 - 02079744 _____ (Farbar) C:\Users\****\Downloads\FRST64.exe 2014-01-29 09:23 - 2014-01-29 09:23 - 00050477 _____ C:\Users\****\Downloads\Defogger(1).exe 2014-01-29 07:14 - 2012-02-17 20:49 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2014-01-28 23:40 - 2014-01-28 23:39 - 00002210 _____ C:\Windows\wininit.ini 2014-01-28 23:11 - 2012-02-17 20:49 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2014-01-28 23:10 - 2011-10-28 02:28 - 00000000 ____D C:\Program Files (x86)\Power Translator 12 2014-01-28 22:54 - 2014-01-28 20:39 - 00359656 _____ (Microsoft Corporation) C:\Users\Admin\Downloads\msicuu2.exe 2014-01-28 22:03 - 2013-06-11 12:23 - 00000000 ____D C:\Program Files\WinRAR 2014-01-28 21:17 - 2014-01-28 21:17 - 00000000 ____D C:\Program Files\Common Files\Apple 2014-01-28 20:17 - 2013-11-17 21:07 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-01-28 20:17 - 2012-05-05 21:43 - 00000000 ____D C:\Program Files (x86)\iTunes 2014-01-28 20:14 - 2011-11-13 15:37 - 00000000 ____D C:\Program Files (x86)\QuickTime 2014-01-28 20:11 - 2011-01-02 21:41 - 00000000 ____D C:\ProgramData\Apple 2014-01-28 19:44 - 2009-08-26 06:16 - 00000000 ____D C:\Program Files (x86)\Microsoft Office 2014-01-28 19:44 - 2009-08-22 11:23 - 00000000 ____D C:\Windows\ShellNew 2014-01-28 19:27 - 2009-08-26 06:16 - 00000000 ____D C:\ProgramData\Microsoft Help 2014-01-28 19:27 - 2009-07-14 03:34 - 00000449 _____ C:\Windows\win.ini 2014-01-28 18:12 - 2011-10-29 23:34 - 00000000 ____D C:\Program Files (x86)\ABBYY FineReader 11 2014-01-28 14:23 - 2014-01-28 14:23 - 00283096 _____ (Mozilla) C:\Users\****\Downloads\Firefox Setup Stub 26.0.exe 2014-01-28 11:34 - 2009-08-22 10:33 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2014-01-28 11:32 - 2013-10-22 10:58 - 00000000 ____D C:\ProgramData\SYSTRAN 2014-01-27 16:48 - 2014-01-27 16:46 - 90578216 _____ (AVAST Software) C:\Users\****\Downloads\avast_free_antivirus_setup.exe 2014-01-26 19:15 - 2010-08-05 10:27 - 00000000 ____D C:\Users\****\AppData\Roaming\FileZilla 2014-01-26 13:57 - 2009-11-16 20:36 - 00115976 _____ C:\Users\****\AppData\Local\GDIPFONTCACHEV1.DAT 2014-01-26 13:55 - 2009-07-14 05:45 - 00453088 _____ C:\Windows\system32\FNTCACHE.DAT 2014-01-26 13:48 - 2010-07-06 09:38 - 00115976 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT 2014-01-26 12:50 - 2009-11-29 16:01 - 00000633 _____ C:\Windows\ODBC.INI 2014-01-26 12:49 - 2010-07-06 09:38 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-01-26 12:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system 2014-01-26 12:43 - 2014-01-26 12:43 - 00000000 ____D C:\.jes 2014-01-25 10:46 - 2011-11-05 14:56 - 00000000 ____D C:\Users\****\Downloads\F4 installationsordner 2014-01-24 23:52 - 2013-10-22 13:47 - 00000000 ____D C:\Users\****\AppData\Roaming\SYSTRAN 2014-01-24 23:52 - 2013-10-22 13:47 - 00000000 ____D C:\Users\****\AppData\Local\SYSTRAN 2014-01-24 23:40 - 2014-01-24 23:40 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih(1).exe 2014-01-24 22:13 - 2010-07-06 09:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Mozilla 2014-01-24 22:11 - 2014-01-24 22:11 - 00000000 ____D C:\ProgramData\Oracle 2014-01-24 22:10 - 2014-01-24 22:10 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-01-24 22:10 - 2014-01-24 22:10 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-01-24 22:10 - 2014-01-24 22:10 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-01-24 22:10 - 2014-01-24 22:10 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-01-24 22:10 - 2010-06-29 13:48 - 00000000 ____D C:\Program Files (x86)\Java 2014-01-24 21:56 - 2014-01-24 21:56 - 00000000 ____D C:\Users\Admin\AppData\Roaming\AVAST Software 2014-01-24 21:56 - 2010-07-06 09:38 - 00001425 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-01-24 21:56 - 2010-07-06 09:38 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-01-24 21:56 - 2010-07-06 09:37 - 00000000 ____D C:\Users\Admin\AppData\Local\VirtualStore 2014-01-24 21:51 - 2014-01-24 21:48 - 00000000 ____D C:\Users\Desktop\Dragon NaturallySpeaking 11 Home 2014-01-24 21:42 - 2014-01-24 21:42 - 00000667 _____ C:\Besitz übernehmen.reg 2014-01-24 21:36 - 2014-01-24 21:36 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih.exe 2014-01-24 06:51 - 2010-05-14 22:04 - 00000432 _____ C:\Windows\BRWMARK.INI 2014-01-24 04:39 - 2011-12-18 18:23 - 00000000 ____D C:\Users\****\AppData\Local\.elfohilfe 2014-01-23 13:08 - 2009-09-08 15:27 - 00754068 _____ C:\Windows\system32\perfh007.dat 2014-01-23 13:08 - 2009-09-08 15:27 - 00171888 _____ C:\Windows\system32\perfc007.dat 2014-01-23 13:08 - 2009-07-14 06:13 - 01760852 _____ C:\Windows\system32\PerfStringBackup.INI 2014-01-23 12:44 - 2014-01-23 12:44 - 00001781 _____ C:\Users\Public\Desktop\f4.lnk 2014-01-23 12:44 - 2014-01-23 12:42 - 00000000 ____D C:\Program Files (x86)\f4 2014-01-23 12:43 - 2014-01-23 12:43 - 00006906 _____ C:\Windows\SysWOW64\jupdate-1.6.0_07-b06.log 2014-01-23 01:17 - 2010-08-04 21:37 - 00000000 ____D C:\Users\****\AppData\Roaming\vlc 2014-01-23 01:12 - 2012-04-19 18:52 - 00000000 ____D C:\Users\****\AppData\Roaming\dvdcss 2014-01-22 15:22 - 2013-03-27 19:49 - 00030863 _____ C:\Users\****\Downloads\Feiertage_2009-2013_DE.ics 2014-01-15 18:11 - 2013-07-27 10:08 - 00000000 ____D C:\Windows\system32\MRT 2014-01-15 18:07 - 2010-05-09 20:43 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-01-09 18:12 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\Documents\Family Tree Maker 2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\IsolatedStorage 2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\Ancestry.com 2014-01-09 14:49 - 2014-01-09 14:49 - 00000000 ____D C:\IExp1.tmp 2014-01-09 14:49 - 2014-01-09 14:48 - 00000000 ___HD C:\Windows\msdownld.tmp 2014-01-09 14:48 - 2014-01-09 14:48 - 00002043 _____ C:\Users\Public\Desktop\Family Tree Maker 2010 (DE).lnk 2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Windows\RegisteredPackages 2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft WSE 3.0 2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\Microsoft WSE 2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\IExp0.tmp 2014-01-09 14:48 - 2014-01-09 14:43 - 00000000 ____D C:\Program Files (x86)\Family Tree Maker 2010 (DE) 2014-01-09 14:48 - 2014-01-09 14:43 - 00000000 ____D C:\Program Files (x86)\BCL Technologies 2014-01-09 14:34 - 2014-01-09 14:34 - 00000000 ____D C:\Users\****\AppData\Roaming\YORAKO 2014-01-09 14:31 - 2014-01-09 14:31 - 00000000 ____D C:\Program Files (x86)\Namenslexikon Files to move or delete: ==================== C:\Users\Desktop\ImagoMPEG-Muxer.exe C:\Users\****\FineCount.reg Some content of TEMP: ==================== C:\Users\Admin\AppData\Local\Temp\Quarantine.exe C:\Users\****\AppData\Local\Temp\DivXSetup.exe C:\Users\****\AppData\Local\Temp\DWPUpgradeInstaller.exe C:\Users\****\AppData\Local\Temp\ffmpeg13.exe C:\Users\****\AppData\Local\Temp\jna666123695494861687.dll C:\Users\****\AppData\Local\Temp\RSPUpgradeInstaller.exe C:\Users\****\AppData\Local\Temp\SkypeSetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== End Of Log ============================ --- --- --- |
|
31.01.2014, 16:16
| #9 |
| /// the machine /// TB-Ausbilder | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle??ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
01.02.2014, 10:12
| #10 |
| | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Guten Abend, einige Programme starteten nach den vorigen Scans über Admin und gingen nicht! Die Downloads von Eset und Security Check waren plötzlich auf Admin/Downloads!  All dies, obwohl die Downloads und Programmaufrufe vom nicht-Admin-Benutzerkonto gestartet wurden. Hat sich aber nun wieder geregelt, alles stimmt wieder.  Positiv: Delta search ist entfernt. Eset stoppt bei ca. 90% beim Apple Mobile Device Driver.. letzterer lässt sich nicht deinstallieren. Code:
ATTFilter ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=12
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=82408bf70a66fe46a8f9568c4fcdebdc
# engine=16889
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-01-31 10:17:39
# local_time=2014-01-31 11:17:39 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 36808 142836509 0 0
# scanned=75293
# found=4
# cleaned=0
# scan_time=5955
sh=D6CF7460A4F696A0E053E042B09C92A7970F30BD ft=1 fh=3da28455addb719c vn="a variant of Win32/Adware.Yontoo.B application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll.vir"
sh=B1EC69FED8C774E82CA75E281D04815342F05014 ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip worm" ac=I fn="C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage38.zip"
sh=AFBD87CE1316F244F89DC8F2664E30CDA622FC1E ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip worm" ac=I fn="C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage4.zip"
sh=552EE4F57C9683F7E82B13CF3F414188C653582D ft=1 fh=5565d5049be9d18b vn="multiple threats" ac=I fn="C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PN0FWDDV\yontoosetup[1].exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.79 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` MVPS Hosts File Spybot - Search & Destroy Malwarebytes Anti-Malware Version 1.75.0.1300 Java 7 Update 51 Adobe Flash Player 12.0.0.43 Flash Player out of Date! Adobe Reader 9 Adobe Reader out of Date! Mozilla Firefox (26.0) Mozilla Thunderbird (17.0.5) ````````Process Check: objlist.exe by Laurent```````` ESET ESET Online Scanner OnlineScannerApp.exe Avast5 AvastSvc.exe Avast5 AvastUI.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log``````````````````````  FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014
Ran by **** (ATTENTION: The logged in user is not administrator) on ****-PC on 01-02-2014 00:30:07
Running from C:\Users\****\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Acer Inc.) C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(AVAST Software) C:\Program Files\Avast5\AvastUI.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Hidfind.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [ePower_DMC] - C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe [492032 2009-07-21] (Acer Inc.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8060960 2009-08-06] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [295936 2009-05-22] (Alps Electric Co., Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe [2068856 2011-10-12] (Flexera Software LLC.)
HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\Avast5\AvastUI.exe [3764024 2013-12-27] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKtray.exe [619216 2009-05-18] (Expert System S.p.A.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18642024 2013-02-28] (Skype Technologies S.A.)
HKCU\...\Run: [AutoStart-Manager 2006] - C:\Program Files (x86)\Tools&More\Autostart-Manager\AutoStart-Manager.exe [397312 2005-12-23] (Wirth New Media Sarl )
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.bing.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=extensa_5230&r=27361109a116l0308z185i4751t287
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
URLSearchHook: HKCU - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_de
SearchScopes: HKCU - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Avast5\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - No Name - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - No File
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\Avast5\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No File
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default
FF DefaultSearchEngine: benefind
FF SelectedSearchEngine: benefind
FF Homepage: hxxp://www.benefind.de
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.13.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.13.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8064.0206 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: nuance.com/DragonRIAPlugin - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\npDgnRia.dll (Nuance Communications Inc.)
FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Users\****\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\100-search-engines.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\benefind.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\ecosia.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\scroogle-ssl-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: RequestPolicy - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\Extensions\requestpolicy@requestpolicy.com.xpi [2013-01-29]
FF Extension: NoScript - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-01-28]
FF Extension: Google Privacy - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\Extensions\{ea61041c-1e22-4400-99a0-aea461e69d04}.xpi [2013-01-28]
FF HKLM-x32\...\Firefox\Extensions: [jid0-lmZNVK7a82O8cufhdfB9dUDfA2w@jetpack] - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\ffShim.xpi
FF Extension: No Name - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\ffShim.xpi [2012-07-13]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Avast5\WebRep\FF [2011-04-25]
==================== Services (Whitelisted) =================
R2 ABBYY.Licensing.FineReader.Professional.11.0; C:\Program Files (x86)\ABBYY FineReader 11\NetworkLicenseServer.exe [819976 2011-09-22] (ABBYY)
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759072 2008-10-09] (ABBYY (BIT Software))
R2 avast! Antivirus; C:\Program Files\Avast5\AvastSvc.exe [50344 2013-12-27] (AVAST Software)
R2 ETService; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [24576 2009-08-12] ()
S2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 MSSQL$MSSMLBIZ; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S2 NewServiceInstall1; C:\Program Files (x86)\SDL International\T2007_FL\TT\Lng\Dialogs1031.lng [11264 2007-04-23] ()
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated)
S2 LEC TranslateDotNet Server; "C:\Program Files (x86)\Power Translator 12\LogoMedia TranslateDotNet Server.exe" [x]
==================== Drivers (Whitelisted) ====================
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2013-10-23] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2013-12-27] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-10-23] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-10-23] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2013-12-27] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2013-12-27] (AVAST Software)
S3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2013-12-27] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2013-12-27] ()
R3 bbcap; C:\Windows\System32\DRIVERS\bbcap.sys [4608 2010-12-23] (Windows (R) Codename Longhorn DDK provider)
S3 O2MDRDR; C:\Windows\system32\DRIVERS\o2mdx64.sys [63264 2009-05-07] (O2Micro )
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-01 00:30 - 2014-02-01 00:30 - 00017293 _____ C:\Users\****\Downloads\FRST.txt
2014-01-31 23:23 - 2014-01-31 23:23 - 00000000 ____D C:\Program Files\Common Files\Apple
2014-01-31 21:32 - 2014-01-31 21:32 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-31 20:52 - 2014-01-31 20:53 - 00987425 _____ C:\Users\Admin\Downloads\SecurityCheck.exe
2014-01-31 20:32 - 2014-01-31 20:32 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_enu.exe _nicht gelöscht, da nicht beendet
2014-01-30 18:11 - 2014-01-30 18:11 - 00000000 ____D C:\Windows\system32\%LOCALAPPDATA%
2014-01-30 17:18 - 2014-01-30 17:18 - 00000893 _____ C:\Users\Admin\Desktop\JRT.txt
2014-01-30 17:06 - 2014-01-30 17:06 - 00000000 ____D C:\Windows\ERUNT
2014-01-30 16:14 - 2014-01-30 16:42 - 00000000 ____D C:\AdwCleaner
2014-01-30 15:37 - 2014-01-30 15:37 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2014-01-30 15:34 - 2014-01-30 15:34 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-30 15:34 - 2014-01-30 15:34 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-30 15:34 - 2014-01-30 15:34 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-30 15:34 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-30 15:25 - 2014-01-30 15:25 - 01037068 _____ (Thisisu) C:\Users\****\Downloads\JRT.exe
2014-01-30 15:19 - 2014-01-30 15:19 - 01166132 _____ C:\Users\****\Downloads\adwcleaner.exe
2014-01-30 15:17 - 2014-01-30 15:18 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\****\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-29 14:28 - 2014-01-29 14:28 - 00000000 ____D C:\Users\*****\AppData\Roaming\AVAST Software
2014-01-29 13:17 - 2014-01-29 13:24 - 00462752 _____ C:\Users\****\Desktop\Gmer.txt
2014-01-29 13:16 - 2014-01-29 13:16 - 00462761 _____ C:\Users\Admin\Desktop\Gmer.log
2014-01-29 12:08 - 2014-01-29 12:08 - 00658328 _____ C:\Users\Admin\Desktop\Gmer.txt
2014-01-29 10:26 - 2014-01-29 11:07 - 00029581 _____ C:\Users\****\Desktop\Addition.txt
2014-01-29 10:24 - 2014-01-29 10:55 - 00034881 _____ C:\Users\****\Desktop\FRST.txt
2014-01-29 10:06 - 2014-02-01 00:30 - 00000000 ____D C:\FRST
2014-01-29 09:33 - 2014-01-29 09:33 - 00000000 _____ C:\Users\Admin\defogger_reenable
2014-01-29 09:29 - 2014-01-29 09:29 - 00370971 _____ C:\Users\****\Desktop\gmer_2.1.19355.zip
2014-01-29 09:23 - 2014-01-29 09:24 - 02079744 _____ (Farbar) C:\Users\****\Downloads\FRST64.exe
2014-01-29 09:23 - 2014-01-29 09:23 - 00050477 _____ C:\Users\****\Downloads\Defogger(1).exe
2014-01-28 23:39 - 2014-01-28 23:40 - 00002210 _____ C:\Windows\wininit.ini
2014-01-28 20:39 - 2014-01-28 22:54 - 00359656 _____ (Microsoft Corporation) C:\Users\Admin\Downloads\msicuu2.exe
2014-01-28 14:23 - 2014-01-28 14:23 - 00283096 _____ (Mozilla) C:\Users\****\Downloads\Firefox Setup Stub 26.0.exe
2014-01-27 16:46 - 2014-01-27 16:48 - 90578216 _____ (AVAST Software) C:\Users\****\Downloads\avast_free_antivirus_setup.exe
2014-01-26 12:43 - 2014-01-26 12:43 - 00000000 ____D C:\.jes
2014-01-24 23:40 - 2014-01-24 23:40 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih(1).exe
2014-01-24 22:11 - 2014-01-24 22:11 - 00000000 ____D C:\ProgramData\Oracle
2014-01-24 22:10 - 2014-01-24 22:10 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-01-24 22:10 - 2014-01-24 22:10 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-01-24 22:10 - 2014-01-24 22:10 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-01-24 22:10 - 2014-01-24 22:10 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-24 22:06 - 2014-01-30 16:42 - 00000000 ____D C:\ProgramData\Uniblue
2014-01-24 21:56 - 2014-01-24 21:56 - 00000000 ____D C:\Users\Admin\AppData\Roaming\AVAST Software
2014-01-24 21:48 - 2014-01-24 21:51 - 00000000 ____D C:\Users\Desktop\Dragon NaturallySpeaking 11 Home
2014-01-24 21:48 - 2013-03-04 11:09 - 00005757 _____ C:\Users\Desktop\ADMIN-Aktionen ab 28-01-13.doc - Verknüpfung.lnk
2014-01-24 21:48 - 2013-02-04 18:21 - 00001042 _____ C:\Users\Desktop\ProjectX.jar - Verknüpfung.lnk
2014-01-24 21:48 - 2013-02-04 18:11 - 00208384 _____ (Imago) C:\Users\Desktop\ImagoMPEG-Muxer.exe
2014-01-24 21:48 - 2012-10-09 13:55 - 00001014 _____ C:\Users\Desktop\kreawi Prüfungstrainer (Demo).lnk
2014-01-24 21:48 - 2012-05-05 20:14 - 00001380 _____ C:\Users\Desktop\CopyTrans Control Center.lnk
2014-01-24 21:48 - 2011-09-22 10:05 - 00001172 _____ C:\Users\Desktop\WavePad Sound Editor.lnk
2014-01-24 21:48 - 2011-09-01 07:08 - 00000977 _____ C:\Users\Desktop\Juice.lnk
2014-01-24 21:48 - 2011-05-16 06:41 - 00006332 _____ C:\Users\Desktop\Router_Setup.html
2014-01-24 21:48 - 2011-04-07 13:35 - 00001304 _____ C:\Users\Desktop\Audio Converter.lnk
2014-01-24 21:48 - 2011-03-26 12:29 - 00001402 _____ C:\Users\Desktop\YouTube to MP3 Converter.lnk
2014-01-24 21:48 - 2011-03-26 12:29 - 00001243 _____ C:\Users\Desktop\DVDVideoSoft Studio.lnk
2014-01-24 21:48 - 2009-05-20 22:32 - 00000172 ____R C:\Users\Desktop\Router Login.url
2014-01-24 21:42 - 2014-01-24 21:42 - 00000667 _____ C:\Besitz übernehmen.reg
2014-01-24 21:36 - 2014-01-24 21:36 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih.exe
2014-01-23 12:44 - 2014-01-23 12:44 - 00001781 _____ C:\Users\Public\Desktop\f4.lnk
2014-01-23 12:43 - 2014-01-23 12:43 - 00006906 _____ C:\Windows\SysWOW64\jupdate-1.6.0_07-b06.log
2014-01-23 12:42 - 2014-01-23 12:44 - 00000000 ____D C:\Program Files (x86)\f4
2014-01-15 14:26 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 14:26 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 14:26 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 14:26 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 14:26 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 14:26 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 14:26 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 14:26 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 14:26 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-09 15:09 - 2014-01-09 18:12 - 00000000 ____D C:\Users\****\Documents\Family Tree Maker
2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\IsolatedStorage
2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\Ancestry.com
2014-01-09 14:49 - 2014-01-09 14:49 - 00000000 ____D C:\IExp1.tmp
2014-01-09 14:48 - 2014-01-09 14:49 - 00000000 ___HD C:\Windows\msdownld.tmp
2014-01-09 14:48 - 2014-01-09 14:48 - 00002043 _____ C:\Users\Public\Desktop\Family Tree Maker 2010 (DE).lnk
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Windows\RegisteredPackages
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft WSE 3.0
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\Microsoft WSE
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\IExp0.tmp
2014-01-09 14:43 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\Family Tree Maker 2010 (DE)
2014-01-09 14:43 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\BCL Technologies
2014-01-09 14:34 - 2014-01-09 14:34 - 00000000 ____D C:\Users\****\AppData\Roaming\YORAKO
2014-01-09 14:31 - 2014-01-09 14:31 - 00000000 ____D C:\Program Files (x86)\Namenslexikon
==================== One Month Modified Files and Folders =======
2014-02-01 00:30 - 2014-02-01 00:30 - 00017293 _____ C:\Users\****\Downloads\FRST.txt
2014-02-01 00:30 - 2014-01-29 10:06 - 00000000 ____D C:\FRST
2014-02-01 00:28 - 2010-04-05 13:37 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-01 00:14 - 2013-01-28 11:45 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-01 00:05 - 2009-09-08 05:37 - 01453683 _____ C:\Windows\WindowsUpdate.log
2014-01-31 23:44 - 2009-07-14 05:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-31 23:44 - 2009-07-14 05:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-31 23:43 - 2010-04-05 13:46 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-31 23:23 - 2014-01-31 23:23 - 00000000 ____D C:\Program Files\Common Files\Apple
2014-01-31 21:32 - 2014-01-31 21:32 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-31 21:31 - 2009-09-08 15:27 - 00754068 _____ C:\Windows\system32\perfh007.dat
2014-01-31 21:31 - 2009-09-08 15:27 - 00171888 _____ C:\Windows\system32\perfc007.dat
2014-01-31 21:31 - 2009-07-14 06:13 - 01760852 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-31 21:22 - 2011-09-22 18:24 - 00043071 _____ C:\Windows\setupact.log
2014-01-31 20:53 - 2014-01-31 20:52 - 00987425 _____ C:\Users\Admin\Downloads\SecurityCheck.exe
2014-01-31 20:32 - 2014-01-31 20:32 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_enu löschanleitung beachten.exe
2014-01-30 18:11 - 2014-01-30 18:11 - 00000000 ____D C:\Windows\system32\%LOCALAPPDATA%
2014-01-30 17:52 - 2013-03-10 18:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2014-01-30 17:52 - 2010-09-10 12:01 - 00000000 ____D C:\Users\Admin\AppData\Local\Thunderbird
2014-01-30 17:18 - 2014-01-30 17:18 - 00000893 _____ C:\Users\Admin\Desktop\JRT.txt
2014-01-30 17:06 - 2014-01-30 17:06 - 00000000 ____D C:\Windows\ERUNT
2014-01-30 16:44 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-30 16:42 - 2014-01-30 16:14 - 00000000 ____D C:\AdwCleaner
2014-01-30 16:42 - 2014-01-24 22:06 - 00000000 ____D C:\ProgramData\Uniblue
2014-01-30 16:42 - 2011-11-30 17:44 - 00000000 ____D C:\Users\****\AppData\Roaming\Babylon
2014-01-30 16:06 - 2011-11-13 17:03 - 00098358 _____ C:\Windows\PFRO.log
2014-01-30 15:37 - 2014-01-30 15:37 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2014-01-30 15:34 - 2014-01-30 15:34 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-30 15:34 - 2014-01-30 15:34 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-30 15:34 - 2014-01-30 15:34 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-30 15:25 - 2014-01-30 15:25 - 01037068 _____ (Thisisu) C:\Users\****\Downloads\JRT.exe
2014-01-30 15:19 - 2014-01-30 15:19 - 01166132 _____ C:\Users\****\Downloads\adwcleaner.exe
2014-01-30 15:18 - 2014-01-30 15:17 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\****\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-30 12:14 - 2013-08-01 11:34 - 00000000 ____D C:\pending
2014-01-30 11:38 - 2010-03-30 15:51 - 00088479 _____ C:\Windows\Run32A50.mch
2014-01-30 09:58 - 2010-03-31 16:16 - 00000131 _____ C:\Windows\Star.ini
2014-01-30 09:58 - 2010-03-30 15:59 - 00000000 ____D C:\Program Files (x86)\Transit XV
2014-01-30 09:58 - 2010-03-30 15:28 - 00000035 _____ C:\Windows\A5W.INI
2014-01-30 09:58 - 2010-03-30 15:28 - 00000000 ____D C:\Windows\A5W_DATA
2014-01-29 15:06 - 2011-10-28 20:16 - 00002035 _____ C:\Users\****\AppData\Roaming\SAS7_000.DAT
2014-01-29 14:39 - 2013-01-28 11:45 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-01-29 14:39 - 2013-01-28 11:45 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-29 14:39 - 2010-10-13 14:13 - 00000000 ____D C:\Users\Admin\AppData\Local\Adobe
2014-01-29 14:35 - 2011-06-21 08:30 - 00000000 ____D C:\Users\*****
2014-01-29 14:28 - 2014-01-29 14:28 - 00000000 ____D C:\Users\*****\AppData\Roaming\AVAST Software
2014-01-29 14:24 - 2010-05-14 22:01 - 00000404 _____ C:\Windows\Brownie.ini
2014-01-29 13:24 - 2014-01-29 13:17 - 00462752 _____ C:\Users\****\Desktop\Gmer.txt
2014-01-29 13:16 - 2014-01-29 13:16 - 00462761 _____ C:\Users\Admin\Desktop\Gmer.log
2014-01-29 12:08 - 2014-01-29 12:08 - 00658328 _____ C:\Users\Admin\Desktop\Gmer.txt
2014-01-29 11:07 - 2014-01-29 10:26 - 00029581 _____ C:\Users\****\Desktop\Addition.txt
2014-01-29 10:55 - 2014-01-29 10:24 - 00034881 _____ C:\Users\****\Desktop\FRST.txt
2014-01-29 09:33 - 2014-01-29 09:33 - 00000000 _____ C:\Users\Admin\defogger_reenable
2014-01-29 09:33 - 2013-05-07 18:29 - 00000472 _____ C:\Users\****\Desktop\defogger_disable.log
2014-01-29 09:33 - 2010-06-20 22:32 - 00000000 ____D C:\Users\Admin
2014-01-29 09:29 - 2014-01-29 09:29 - 00370971 _____ C:\Users\****\Desktop\gmer_2.1.19355.zip
2014-01-29 09:24 - 2014-01-29 09:23 - 02079744 _____ (Farbar) C:\Users\****\Downloads\FRST64.exe
2014-01-29 09:23 - 2014-01-29 09:23 - 00050477 _____ C:\Users\****\Downloads\Defogger(1).exe
2014-01-29 07:14 - 2012-02-17 20:49 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2014-01-28 23:40 - 2014-01-28 23:39 - 00002210 _____ C:\Windows\wininit.ini
2014-01-28 23:11 - 2012-02-17 20:49 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy
2014-01-28 23:10 - 2011-10-28 02:28 - 00000000 ____D C:\Program Files (x86)\Power Translator 12
2014-01-28 22:54 - 2014-01-28 20:39 - 00359656 _____ (Microsoft Corporation) C:\Users\Admin\Downloads\msicuu2.exe
2014-01-28 22:03 - 2013-06-11 12:23 - 00000000 ____D C:\Program Files\WinRAR
2014-01-28 20:17 - 2013-11-17 21:07 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-28 20:17 - 2012-05-05 21:43 - 00000000 ____D C:\Program Files (x86)\iTunes
2014-01-28 20:14 - 2011-11-13 15:37 - 00000000 ____D C:\Program Files (x86)\QuickTime
2014-01-28 20:11 - 2011-01-02 21:41 - 00000000 ____D C:\ProgramData\Apple
2014-01-28 19:44 - 2009-08-26 06:16 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2014-01-28 19:44 - 2009-08-22 11:23 - 00000000 ____D C:\Windows\ShellNew
2014-01-28 19:27 - 2009-08-26 06:16 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-28 19:27 - 2009-07-14 03:34 - 00000449 _____ C:\Windows\win.ini
2014-01-28 18:12 - 2011-10-29 23:34 - 00000000 ____D C:\Program Files (x86)\ABBYY FineReader 11
2014-01-28 14:23 - 2014-01-28 14:23 - 00283096 _____ (Mozilla) C:\Users\****\Downloads\Firefox Setup Stub 26.0.exe
2014-01-28 11:34 - 2009-08-22 10:33 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2014-01-28 11:32 - 2013-10-22 10:58 - 00000000 ____D C:\ProgramData\SYSTRAN
2014-01-27 16:48 - 2014-01-27 16:46 - 90578216 _____ (AVAST Software) C:\Users\****\Downloads\avast_free_antivirus_setup.exe
2014-01-26 19:15 - 2010-08-05 10:27 - 00000000 ____D C:\Users\****\AppData\Roaming\FileZilla
2014-01-26 13:57 - 2009-11-16 20:36 - 00115976 _____ C:\Users\****\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-26 13:55 - 2009-07-14 05:45 - 00453088 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-26 13:48 - 2010-07-06 09:38 - 00115976 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-26 12:50 - 2009-11-29 16:01 - 00000633 _____ C:\Windows\ODBC.INI
2014-01-26 12:49 - 2010-07-06 09:38 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-26 12:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system
2014-01-26 12:43 - 2014-01-26 12:43 - 00000000 ____D C:\.jes
2014-01-25 10:46 - 2011-11-05 14:56 - 00000000 ____D C:\Users\****\Downloads\F4 installationsordner
2014-01-24 23:52 - 2013-10-22 13:47 - 00000000 ____D C:\Users\****\AppData\Roaming\SYSTRAN
2014-01-24 23:52 - 2013-10-22 13:47 - 00000000 ____D C:\Users\****\AppData\Local\SYSTRAN
2014-01-24 23:40 - 2014-01-24 23:40 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih(1).exe
2014-01-24 22:13 - 2010-07-06 09:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Mozilla
2014-01-24 22:11 - 2014-01-24 22:11 - 00000000 ____D C:\ProgramData\Oracle
2014-01-24 22:10 - 2014-01-24 22:10 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-01-24 22:10 - 2014-01-24 22:10 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-01-24 22:10 - 2014-01-24 22:10 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-01-24 22:10 - 2014-01-24 22:10 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-24 22:10 - 2010-06-29 13:48 - 00000000 ____D C:\Program Files (x86)\Java
2014-01-24 21:56 - 2014-01-24 21:56 - 00000000 ____D C:\Users\Admin\AppData\Roaming\AVAST Software
2014-01-24 21:56 - 2010-07-06 09:38 - 00001425 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-01-24 21:56 - 2010-07-06 09:38 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-01-24 21:56 - 2010-07-06 09:37 - 00000000 ____D C:\Users\Admin\AppData\Local\VirtualStore
2014-01-24 21:51 - 2014-01-24 21:48 - 00000000 ____D C:\Users\Desktop\Dragon NaturallySpeaking 11 Home
2014-01-24 21:42 - 2014-01-24 21:42 - 00000667 _____ C:\Besitz übernehmen.reg
2014-01-24 21:36 - 2014-01-24 21:36 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih.exe
2014-01-24 06:51 - 2010-05-14 22:04 - 00000432 _____ C:\Windows\BRWMARK.INI
2014-01-24 04:39 - 2011-12-18 18:23 - 00000000 ____D C:\Users\****\AppData\Local\.elfohilfe
2014-01-23 12:44 - 2014-01-23 12:44 - 00001781 _____ C:\Users\Public\Desktop\f4.lnk
2014-01-23 12:44 - 2014-01-23 12:42 - 00000000 ____D C:\Program Files (x86)\f4
2014-01-23 12:43 - 2014-01-23 12:43 - 00006906 _____ C:\Windows\SysWOW64\jupdate-1.6.0_07-b06.log
2014-01-23 01:17 - 2010-08-04 21:37 - 00000000 ____D C:\Users\****\AppData\Roaming\vlc
2014-01-23 01:12 - 2012-04-19 18:52 - 00000000 ____D C:\Users\****\AppData\Roaming\dvdcss
2014-01-22 15:22 - 2013-03-27 19:49 - 00030863 _____ C:\Users\****\Downloads\Feiertage_2009-2013_DE.ics
2014-01-15 18:11 - 2013-07-27 10:08 - 00000000 ____D C:\Windows\system32\MRT
2014-01-15 18:07 - 2010-05-09 20:43 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-09 18:12 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\Documents\Family Tree Maker
2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\IsolatedStorage
2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\Ancestry.com
2014-01-09 14:49 - 2014-01-09 14:49 - 00000000 ____D C:\IExp1.tmp
2014-01-09 14:49 - 2014-01-09 14:48 - 00000000 ___HD C:\Windows\msdownld.tmp
2014-01-09 14:48 - 2014-01-09 14:48 - 00002043 _____ C:\Users\Public\Desktop\Family Tree Maker 2010 (DE).lnk
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Windows\RegisteredPackages
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft WSE 3.0
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\Microsoft WSE
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\IExp0.tmp
2014-01-09 14:48 - 2014-01-09 14:43 - 00000000 ____D C:\Program Files (x86)\Family Tree Maker 2010 (DE)
2014-01-09 14:48 - 2014-01-09 14:43 - 00000000 ____D C:\Program Files (x86)\BCL Technologies
2014-01-09 14:34 - 2014-01-09 14:34 - 00000000 ____D C:\Users\****\AppData\Roaming\YORAKO
2014-01-09 14:31 - 2014-01-09 14:31 - 00000000 ____D C:\Program Files (x86)\Namenslexikon
Files to move or delete:
====================
C:\Users\Desktop\ImagoMPEG-Muxer.exe
C:\Users\****\FineCount.reg
Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\Quarantine.exe
C:\Users\****\AppData\Local\Temp\DivXSetup.exe
C:\Users\****\AppData\Local\Temp\DWPUpgradeInstaller.exe
C:\Users\****\AppData\Local\Temp\ffmpeg13.exe
C:\Users\****\AppData\Local\Temp\jna666123695494861687.dll
C:\Users\****\AppData\Local\Temp\RSPUpgradeInstaller.exe
C:\Users\****\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== End Of Log ============================
--- --- --- Geändert von jo07 (01.02.2014 um 01:00 Uhr) |
|
02.02.2014, 06:30
| #11 |
| /// the machine /// TB-Ausbilder | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Flash wird falsch angezeigt Fertig Falls Du Lob oder Kritik loswerden möchtest kannst Du das hier tun Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
02.02.2014, 10:27
| #12 |
| | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Danke.. noch Fragen? Ja: Eset ist doch nicht durchgelaufen. Danach hat ein Stick, der beim Eset-Scan mit angeschlossen war, und den ich dann auf dem Netbook benutzen wollte, dort eine Virenmeldung ausgelöst (Datei: ein Servicepack eines Programms, das nicht mehr supportet wird, das ich aber noch brauche).. Grüße Jo07 |
|
03.02.2014, 10:41
| #13 |
| /// the machine /// TB-Ausbilder | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Scanne den Stick mal mit deinem Antivirenprogramm und mit Malwarebytes.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.02.2014, 15:02
| #14 |
| | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Hab ich gemacht, Avast meldet keine Funde, konnte aber die Autorun.inf auf dem Stick nicht prüfen, da sie 'nicht zur Verfügung' stand. Sie ist aber dort vorhanden. Malwarebytes findet keine Bedrohungen. -Was ist mit Eset, das doch gar nicht zu Ende gescannt hat? -Thunderbird hat heute beim Verfassen einer E-Mail plötzlich gemeldet, dass eine Datei angehängt wird, und als ich sofort das Programm schloss, kam die Meldung: Thunderbird ist dabei, eine Nachricht zu versenden (ich war weit weg vom Senden-Button)... Gruß, jo07 |
|
04.02.2014, 09:59
| #15 |
| /// the machine /// TB-Ausbilder | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? ESET ist nur da um auf Reste zu scannen, und hat bis zum Abbruch nur inaktiven Müll gefunden. Poste bitte mal ein frisches FRST log.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? |
| avast, scan, security, smartpcfixer spybot, software, spybot, win |
Hybrid-Darstellung
