Googlesuche wird umgeleitet, mbam muß umbenannt werden-startet sonst nicht.

crillix

Guten Tag, ich habe auch das Problem das sporadisch meine Googlesuchanfragen im Firefox als auch im IE umgeleitet werden. Ich habe schon viel darüber hier gelesen und GMER meldet in Rot eine suspekte Änderung, Mbam kann nur nachdem ich es umbenannt habe gestartet werden, auf die Seite virustotal.com werde ich gar nicht gelassen -Meldung Seite kann nicht angezeigt werden-, am Laptop geht sie aber. Damit bin ich jetzt überfordert und Frage daher hier die Fachleute.
Die Logs von OTL , Mbam und GMER im folgenden:
Schon mal vielen dank im voraus an die leute die sich damit am WE beschäftigen. leider habe ich zuviele Zeichen hier, deswegen das mbam und OTL log nur im Anhang.
##
GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit scan 2010-11-20 14:09:47
Windows 5.1.2600 Service Pack 3 Harddisk1\DR1 -> \Device\Ide\IdePort1 Hitachi_HDP725032GLA360 rev.GM3OA52A
Running: q6tttvft.exe; Driver: C:\DOKUME~1\REINHA~1\LOKALE~1\Temp\uftdypow.sys


---- System - GMER 1.0.15 ----

SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateKey [0xF7458E22]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0xF7439CDC]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0xF7439ECE]
SSDT 95BA8C14 ZwCreateThread
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteKey [0xF7459610]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteValueKey [0xF74598C4]
SSDT 95BA8C4B ZwLoadDriver
SSDT 95BA8C32 ZwLoadKey
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwOpenKey [0xF7457B14]
SSDT 95BA8C00 ZwOpenProcess
SSDT 95BA8C05 ZwOpenThread
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwRenameKey [0xF7459D30]
SSDT 95BA8C3C ZwReplaceKey
SSDT 95BA8C37 ZwRestoreKey
SSDT 95BA8C50 ZwSetSystemInformation
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwSetValueKey [0xF74590E2]
SSDT \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0x9B5AE620]
SSDT \??\C:\WINDOWS\system32\Drivers\uphcleanhlp.sys ZwUnloadKey [0x945C06D0]
SSDT 95BA8C0A ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.15 ----

.rsrc C:\WINDOWS\system32\drivers\ftdisk.sys entry point in ".rsrc" section [0xF74D3314]
init C:\WINDOWS\system32\drivers\monfilt.sys entry point in "init" section [0xA78D2280]
.text C:\WINDOWS\system32\drivers\hardlock.sys section is writeable [0x947C8400, 0x87EE2, 0xE8000020]
.protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0x9486C620] C:\WINDOWS\system32\drivers\hardlock.sys entry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0x9486C620]
.protectÿÿÿÿhardlockunknown last code section [0x9486C400, 0x5126, 0xE0000020] C:\WINDOWS\system32\drivers\hardlock.sys unknown last code section [0x9486C400, 0x5126, 0xE0000020]
? C:\WINDOWS\system32\Drivers\uphcleanhlp.sys Das System kann die angegebene Datei nicht finden. !

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\rdpclip.exe[744] ntdll.dll!NtCreateFile 7C91D0AE 1 Byte [FF]
.text C:\WINDOWS\system32\rdpclip.exe[744] ntdll.dll!NtCreateFile 7C91D0AE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\rdpclip.exe[744] ntdll.dll!NtCreateFile + 4 7C91D0B2 2 Bytes [74, 71] {JZ 0x73}
.text C:\WINDOWS\system32\rdpclip.exe[744] ntdll.dll!NtDeleteValueKey 7C91D26E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\rdpclip.exe[744] ntdll.dll!NtDeleteValueKey + 4 7C91D272 2 Bytes [7A, 71] {JP 0x73}
.text C:\WINDOWS\system32\rdpclip.exe[744] ntdll.dll!NtOpenFile 7C91D59E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\rdpclip.exe[744] ntdll.dll!NtOpenFile + 4 7C91D5A2 2 Bytes [71, 71] {JNO 0x73}
.text C:\WINDOWS\system32\rdpclip.exe[744] ntdll.dll!NtOpenProcess 7C91D5FE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\rdpclip.exe[744] ntdll.dll!NtOpenProcess + 4 7C91D602 2 Bytes [77, 71] {JA 0x73}
.text C:\WINDOWS\system32\rdpclip.exe[744] ntdll.dll!NtSetValueKey 7C91DDCE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\rdpclip.exe[744] ntdll.dll!NtSetValueKey + 4 7C91DDD2 2 Bytes [7D, 71] {JGE 0x73}
.text C:\WINDOWS\system32\rdpclip.exe[744] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00A80001
.text C:\WINDOWS\system32\rdpclip.exe[744] ADVAPI32.dll!CreateServiceA 77E07211 6 Bytes JMP 71840F5A
.text C:\WINDOWS\system32\rdpclip.exe[744] ADVAPI32.dll!CreateServiceW 77E073A9 6 Bytes JMP 71810F5A
.text C:\WINDOWS\system32\rdpclip.exe[744] USER32.dll!PostMessageW 7E368CCB 6 Bytes JMP 71870F5A
.text C:\WINDOWS\system32\rdpclip.exe[744] USER32.dll!SendMessageW 7E37929A 6 Bytes JMP 718D0F5A
.text C:\WINDOWS\system32\rdpclip.exe[744] USER32.dll!PostMessageA 7E37AAFD 6 Bytes JMP 718A0F5A
.text C:\WINDOWS\system32\rdpclip.exe[744] USER32.dll!SendInput 7E37F140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\rdpclip.exe[744] USER32.dll!SendInput + 4 7E37F144 2 Bytes [92, 71]
.text C:\WINDOWS\system32\rdpclip.exe[744] USER32.dll!SendMessageA 7E37F3C2 6 Bytes JMP 71900F5A
.text C:\WINDOWS\system32\rdpclip.exe[744] USER32.dll!mouse_event 7E3B673F 6 Bytes JMP 71990F5A
.text C:\WINDOWS\system32\rdpclip.exe[744] USER32.dll!keybd_event 7E3B6783 6 Bytes JMP 71960F5A
.text C:\WINDOWS\system32\rdpclip.exe[744] WS2_32.dll!WSALookupServiceNextW 71A13181 6 Bytes JMP 719F0F5A
.text C:\WINDOWS\system32\rdpclip.exe[744] WS2_32.dll!WSALookupServiceEnd 71A1350E 6 Bytes JMP 719C0F5A
.text C:\WINDOWS\system32\rdpclip.exe[744] WS2_32.dll!WSALookupServiceBeginW 71A135EF 6 Bytes JMP 71A60F5A
.text C:\WINDOWS\system32\rdpclip.exe[744] WS2_32.dll!connect 71A14A07 6 Bytes JMP 71AF0F5A
.text C:\WINDOWS\system32\rdpclip.exe[744] WS2_32.dll!listen 71A18CD3 6 Bytes JMP 71A90F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] ntdll.dll!NtCreateFile 7C91D0AE 1 Byte [FF]
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] ntdll.dll!NtCreateFile 7C91D0AE 3 Bytes [FF, 25, 1E]
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] ntdll.dll!NtCreateFile + 4 7C91D0B2 2 Bytes [75, 71] {JNZ 0x73}
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] ntdll.dll!NtDeleteValueKey 7C91D26E 3 Bytes [FF, 25, 1E]
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] ntdll.dll!NtDeleteValueKey + 4 7C91D272 2 Bytes [7B, 71] {JNP 0x73}
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] ntdll.dll!NtOpenFile 7C91D59E 3 Bytes [FF, 25, 1E]
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] ntdll.dll!NtOpenFile + 4 7C91D5A2 2 Bytes [72, 71] {JB 0x73}
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] ntdll.dll!NtOpenProcess 7C91D5FE 3 Bytes [FF, 25, 1E]
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] ntdll.dll!NtOpenProcess + 4 7C91D602 2 Bytes [78, 71] {JS 0x73}
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] ntdll.dll!NtSetValueKey 7C91DDCE 3 Bytes [FF, 25, 1E]
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] ntdll.dll!NtSetValueKey + 4 7C91DDD2 2 Bytes [7E, 71] {JLE 0x73}
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00EC0001
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] USER32.dll!PostMessageW 7E368CCB 6 Bytes JMP 71880F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] USER32.dll!SendMessageW 7E37929A 6 Bytes JMP 718E0F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] USER32.dll!PostMessageA 7E37AAFD 6 Bytes JMP 718B0F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] USER32.dll!SendInput 7E37F140 3 Bytes [FF, 25, 1E]
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] USER32.dll!SendInput + 4 7E37F144 2 Bytes [93, 71]
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] USER32.dll!SendMessageA 7E37F3C2 6 Bytes JMP 71910F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] USER32.dll!mouse_event 7E3B673F 6 Bytes JMP 719A0F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] USER32.dll!keybd_event 7E3B6783 6 Bytes JMP 71970F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] ADVAPI32.dll!CreateServiceA 77E07211 6 Bytes JMP 71850F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] ADVAPI32.dll!CreateServiceW 77E073A9 6 Bytes JMP 71820F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] WS2_32.dll!WSALookupServiceNextW 71A13181 6 Bytes JMP 71A30F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] WS2_32.dll!WSALookupServiceEnd 71A1350E 6 Bytes JMP 719D0F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] WS2_32.dll!WSALookupServiceBeginW 71A135EF 6 Bytes JMP 71A60F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] WS2_32.dll!connect 71A14A07 6 Bytes JMP 71AF0F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSE.exe[1596] WS2_32.dll!listen 71A18CD3 6 Bytes JMP 71A90F5A
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] ntdll.dll!NtCreateFile 7C91D0AE 1 Byte [FF]
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] ntdll.dll!NtCreateFile 7C91D0AE 3 Bytes [FF, 25, 1E]
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] ntdll.dll!NtCreateFile + 4 7C91D0B2 2 Bytes [87, 71]
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] ntdll.dll!NtDeleteValueKey 7C91D26E 3 Bytes [FF, 25, 1E]
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] ntdll.dll!NtDeleteValueKey + 4 7C91D272 2 Bytes [8D, 71]
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] ntdll.dll!NtOpenFile 7C91D59E 3 Bytes [FF, 25, 1E]
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] ntdll.dll!NtOpenFile + 4 7C91D5A2 2 Bytes [84, 71]
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] ntdll.dll!NtOpenProcess 7C91D5FE 3 Bytes [FF, 25, 1E]
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] ntdll.dll!NtOpenProcess + 4 7C91D602 2 Bytes [8A, 71]
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] ntdll.dll!NtSetValueKey 7C91DDCE 3 Bytes [FF, 25, 1E]
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] ntdll.dll!NtSetValueKey + 4 7C91DDD2 2 Bytes [90, 71]
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] KERNEL32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00B30001
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] USER32.dll!PostMessageW 7E368CCB 6 Bytes JMP 719A0F5A
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] USER32.dll!SendMessageW 7E37929A 6 Bytes JMP 71A00F5A
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] USER32.dll!PostMessageA 7E37AAFD 6 Bytes JMP 719D0F5A
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] USER32.dll!SendInput 7E37F140 3 Bytes [FF, 25, 1E]
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] USER32.dll!SendInput + 4 7E37F144 2 Bytes [A5, 71]
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] USER32.dll!SendMessageA 7E37F3C2 6 Bytes JMP 71A30F5A
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] USER32.dll!mouse_event 7E3B673F 6 Bytes JMP 71AC0F5A
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] USER32.dll!keybd_event 7E3B6783 6 Bytes JMP 71A90F5A
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] ADVAPI32.dll!CreateServiceA 77E07211 6 Bytes JMP 71970F5A
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] ADVAPI32.dll!CreateServiceW 77E073A9 6 Bytes JMP 71940F5A
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] WS2_32.dll!WSALookupServiceNextW 01063181 6 Bytes JMP 71820F5A
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] WS2_32.dll!WSALookupServiceEnd 0106350E 6 Bytes JMP 717F0F5A
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] WS2_32.dll!WSALookupServiceBeginW 010635EF 6 Bytes JMP 71760F5A
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] WS2_32.dll!connect 01064A07 6 Bytes JMP 717C0F5A
.text c:\windows\twain_32\kodak\kds_i1100\twaingui.exe[2684] WS2_32.dll!listen 01068CD3 6 Bytes JMP 71790F5A
.text C:\WINDOWS\system32\logon.scr[3060] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00C90001
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] ntdll.dll!NtCreateFile 7C91D0AE 1 Byte [FF]
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] ntdll.dll!NtCreateFile 7C91D0AE 3 Bytes [FF, 25, 1E]
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] ntdll.dll!NtCreateFile + 4 7C91D0B2 2 Bytes [87, 71]
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] ntdll.dll!NtDeleteValueKey 7C91D26E 3 Bytes [FF, 25, 1E]
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] ntdll.dll!NtDeleteValueKey + 4 7C91D272 2 Bytes [8D, 71]
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] ntdll.dll!NtOpenFile 7C91D59E 3 Bytes [FF, 25, 1E]
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] ntdll.dll!NtOpenFile + 4 7C91D5A2 2 Bytes [84, 71]
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] ntdll.dll!NtOpenProcess 7C91D5FE 3 Bytes [FF, 25, 1E]
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] ntdll.dll!NtOpenProcess + 4 7C91D602 2 Bytes [8A, 71]
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] ntdll.dll!NtSetValueKey 7C91DDCE 3 Bytes [FF, 25, 1E]
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] ntdll.dll!NtSetValueKey + 4 7C91DDD2 2 Bytes [90, 71]
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00C20001
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] ADVAPI32.dll!CreateServiceA 77E07211 6 Bytes JMP 71970F5A
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] ADVAPI32.dll!CreateServiceW 77E073A9 6 Bytes JMP 71940F5A
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] USER32.dll!PostMessageW 7E368CCB 6 Bytes JMP 719A0F5A
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] USER32.dll!SendMessageW 7E37929A 6 Bytes JMP 71A00F5A
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] USER32.dll!PostMessageA 7E37AAFD 6 Bytes JMP 719D0F5A
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] USER32.dll!SendInput 7E37F140 3 Bytes [FF, 25, 1E]
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] USER32.dll!SendInput + 4 7E37F144 2 Bytes [A5, 71]
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] USER32.dll!SendMessageA 7E37F3C2 6 Bytes JMP 71A30F5A
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] USER32.dll!mouse_event 7E3B673F 6 Bytes JMP 71AC0F5A
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] USER32.dll!keybd_event 7E3B6783 6 Bytes JMP 71A90F5A
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] WS2_32.dll!WSALookupServiceNextW 010C3181 6 Bytes JMP 71760F5A
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] WS2_32.dll!WSALookupServiceEnd 010C350E 6 Bytes JMP 71820F5A
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] WS2_32.dll!WSALookupServiceBeginW 010C35EF 6 Bytes JMP 71790F5A
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] WS2_32.dll!connect 010C4A07 6 Bytes JMP 717F0F5A
.text C:\PROGRA~1\TOBITI~1\DVREMIND.EXE[3164] WS2_32.dll!listen 010C8CD3 6 Bytes JMP 717C0F5A
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] ntdll.dll!NtCreateFile 7C91D0AE 1 Byte [FF]
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] ntdll.dll!NtCreateFile 7C91D0AE 3 Bytes [FF, 25, 1E]
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] ntdll.dll!NtCreateFile + 4 7C91D0B2 2 Bytes [87, 71]
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] ntdll.dll!NtDeleteValueKey 7C91D26E 3 Bytes [FF, 25, 1E]
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] ntdll.dll!NtDeleteValueKey + 4 7C91D272 2 Bytes [8D, 71]
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] ntdll.dll!NtOpenFile 7C91D59E 3 Bytes [FF, 25, 1E]
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] ntdll.dll!NtOpenFile + 4 7C91D5A2 2 Bytes [84, 71]
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] ntdll.dll!NtOpenProcess 7C91D5FE 3 Bytes [FF, 25, 1E]
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] ntdll.dll!NtOpenProcess + 4 7C91D602 2 Bytes [8A, 71]
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] ntdll.dll!NtSetValueKey 7C91DDCE 3 Bytes [FF, 25, 1E]
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] ntdll.dll!NtSetValueKey + 4 7C91DDD2 2 Bytes [90, 71]
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00AA0001
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] USER32.dll!PostMessageW 7E368CCB 6 Bytes JMP 719A0F5A
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] USER32.dll!SendMessageW 7E37929A 6 Bytes JMP 71A00F5A
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] USER32.dll!PostMessageA 7E37AAFD 6 Bytes JMP 719D0F5A
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] USER32.dll!SendInput 7E37F140 3 Bytes [FF, 25, 1E]
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] USER32.dll!SendInput + 4 7E37F144 2 Bytes [A5, 71]
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] USER32.dll!SendMessageA 7E37F3C2 6 Bytes JMP 71A30F5A
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] USER32.dll!mouse_event 7E3B673F 6 Bytes JMP 71AC0F5A
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] USER32.dll!keybd_event 7E3B6783 6 Bytes JMP 71A90F5A
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] ADVAPI32.dll!CreateServiceA 77E07211 6 Bytes JMP 71970F5A
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] ADVAPI32.dll!CreateServiceW 77E073A9 6 Bytes JMP 71940F5A
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] WS2_32.dll!WSALookupServiceNextW 00FD3181 6 Bytes JMP 717F0F5A
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] WS2_32.dll!WSALookupServiceEnd 00FD350E 6 Bytes JMP 717C0F5A
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] WS2_32.dll!WSALookupServiceBeginW 00FD35EF 6 Bytes JMP 71820F5A
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] WS2_32.dll!connect 00FD4A07 6 Bytes JMP 71790F5A
.text C:\Dokumente und Einstellungen\Reinhardt\Eigene Dateien\Downloads\q6tttvft.exe[3228] WS2_32.dll!listen 00FD8CD3 6 Bytes JMP 71760F5A
.text C:\WINDOWS\Explorer.EXE[3568] ntdll.dll!NtCreateFile 7C91D0AE 1 Byte [FF]
.text C:\WINDOWS\Explorer.EXE[3568] ntdll.dll!NtCreateFile 7C91D0AE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[3568] ntdll.dll!NtCreateFile + 4 7C91D0B2 2 Bytes [87, 71]
.text C:\WINDOWS\Explorer.EXE[3568] ntdll.dll!NtDeleteValueKey 7C91D26E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[3568] ntdll.dll!NtDeleteValueKey + 4 7C91D272 2 Bytes [8D, 71]
.text C:\WINDOWS\Explorer.EXE[3568] ntdll.dll!NtOpenFile 7C91D59E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[3568] ntdll.dll!NtOpenFile + 4 7C91D5A2 2 Bytes [84, 71]
.text C:\WINDOWS\Explorer.EXE[3568] ntdll.dll!NtOpenProcess 7C91D5FE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[3568] ntdll.dll!NtOpenProcess + 4 7C91D602 2 Bytes [8A, 71]
.text C:\WINDOWS\Explorer.EXE[3568] ntdll.dll!NtSetValueKey 7C91DDCE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[3568] ntdll.dll!NtSetValueKey + 4 7C91DDD2 2 Bytes [90, 71]
.text C:\WINDOWS\Explorer.EXE[3568] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00B70001
.text C:\WINDOWS\Explorer.EXE[3568] ADVAPI32.dll!CreateServiceA 77E07211 6 Bytes JMP 71970F5A
.text C:\WINDOWS\Explorer.EXE[3568] ADVAPI32.dll!CreateServiceW 77E073A9 6 Bytes JMP 71940F5A
.text C:\WINDOWS\Explorer.EXE[3568] USER32.dll!PostMessageW 7E368CCB 6 Bytes JMP 719A0F5A
.text C:\WINDOWS\Explorer.EXE[3568] USER32.dll!SendMessageW 7E37929A 6 Bytes JMP 71A00F5A
.text C:\WINDOWS\Explorer.EXE[3568] USER32.dll!PostMessageA 7E37AAFD 6 Bytes JMP 719D0F5A
.text C:\WINDOWS\Explorer.EXE[3568] USER32.dll!SendInput 7E37F140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[3568] USER32.dll!SendInput + 4 7E37F144 2 Bytes [A5, 71]
.text C:\WINDOWS\Explorer.EXE[3568] USER32.dll!SendMessageA 7E37F3C2 6 Bytes JMP 71A30F5A
.text C:\WINDOWS\Explorer.EXE[3568] USER32.dll!mouse_event 7E3B673F 6 Bytes JMP 71AC0F5A
.text C:\WINDOWS\Explorer.EXE[3568] USER32.dll!keybd_event 7E3B6783 6 Bytes JMP 71A90F5A
.text C:\WINDOWS\Explorer.EXE[3568] WS2_32.dll!WSALookupServiceNextW 00FD3181 6 Bytes JMP 71760F5A
.text C:\WINDOWS\Explorer.EXE[3568] WS2_32.dll!WSALookupServiceEnd 00FD350E 6 Bytes JMP 71820F5A
.text C:\WINDOWS\Explorer.EXE[3568] WS2_32.dll!WSALookupServiceBeginW 00FD35EF 6 Bytes JMP 71790F5A
.text C:\WINDOWS\Explorer.EXE[3568] WS2_32.dll!connect 00FD4A07 6 Bytes JMP 717F0F5A
.text C:\WINDOWS\Explorer.EXE[3568] WS2_32.dll!listen 00FD8CD3 6 Bytes JMP 717C0F5A
.text C:\WINDOWS\Explorer.EXE[3832] ntdll.dll!NtCreateFile 7C91D0AE 1 Byte [FF]
.text C:\WINDOWS\Explorer.EXE[3832] ntdll.dll!NtCreateFile 7C91D0AE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[3832] ntdll.dll!NtCreateFile + 4 7C91D0B2 2 Bytes [87, 71]
.text C:\WINDOWS\Explorer.EXE[3832] ntdll.dll!NtDeleteValueKey 7C91D26E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[3832] ntdll.dll!NtDeleteValueKey + 4 7C91D272 2 Bytes [8D, 71]
.text C:\WINDOWS\Explorer.EXE[3832] ntdll.dll!NtOpenFile 7C91D59E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[3832] ntdll.dll!NtOpenFile + 4 7C91D5A2 2 Bytes [84, 71]
.text C:\WINDOWS\Explorer.EXE[3832] ntdll.dll!NtOpenProcess 7C91D5FE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[3832] ntdll.dll!NtOpenProcess + 4 7C91D602 2 Bytes [8A, 71]
.text C:\WINDOWS\Explorer.EXE[3832] ntdll.dll!NtSetValueKey 7C91DDCE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[3832] ntdll.dll!NtSetValueKey + 4 7C91DDD2 2 Bytes [90, 71]
.text C:\WINDOWS\Explorer.EXE[3832] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00B80001
.text C:\WINDOWS\Explorer.EXE[3832] ADVAPI32.dll!CreateServiceA 77E07211 6 Bytes JMP 71970F5A
.text C:\WINDOWS\Explorer.EXE[3832] ADVAPI32.dll!CreateServiceW 77E073A9 6 Bytes JMP 71940F5A
.text C:\WINDOWS\Explorer.EXE[3832] USER32.dll!PostMessageW 7E368CCB 6 Bytes JMP 719A0F5A
.text C:\WINDOWS\Explorer.EXE[3832] USER32.dll!SendMessageW 7E37929A 6 Bytes JMP 71A00F5A
.text C:\WINDOWS\Explorer.EXE[3832] USER32.dll!PostMessageA 7E37AAFD 6 Bytes JMP 719D0F5A
.text C:\WINDOWS\Explorer.EXE[3832] USER32.dll!SendInput 7E37F140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[3832] USER32.dll!SendInput + 4 7E37F144 2 Bytes [A5, 71]
.text C:\WINDOWS\Explorer.EXE[3832] USER32.dll!SendMessageA 7E37F3C2 6 Bytes JMP 71A30F5A
.text C:\WINDOWS\Explorer.EXE[3832] USER32.dll!mouse_event 7E3B673F 6 Bytes JMP 71AC0F5A
.text C:\WINDOWS\Explorer.EXE[3832] USER32.dll!keybd_event 7E3B6783 6 Bytes JMP 71A90F5A
.text C:\WINDOWS\Explorer.EXE[3832] WS2_32.dll!WSALookupServiceNextW 00FE3181 6 Bytes JMP 71760F5A
.text C:\WINDOWS\Explorer.EXE[3832] WS2_32.dll!WSALookupServiceEnd 00FE350E 6 Bytes JMP 71820F5A
.text C:\WINDOWS\Explorer.EXE[3832] WS2_32.dll!WSALookupServiceBeginW 00FE35EF 6 Bytes JMP 71790F5A
.text C:\WINDOWS\Explorer.EXE[3832] WS2_32.dll!connect 00FE4A07 6 Bytes JMP 717F0F5A
.text C:\WINDOWS\Explorer.EXE[3832] WS2_32.dll!listen 00FE8CD3 6 Bytes JMP 717C0F5A
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] ntdll.dll!NtCreateFile 7C91D0AE 1 Byte [FF]
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] ntdll.dll!NtCreateFile 7C91D0AE 3 Bytes [FF, 25, 1E]
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] ntdll.dll!NtCreateFile + 4 7C91D0B2 2 Bytes [87, 71]
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] ntdll.dll!NtDeleteValueKey 7C91D26E 3 Bytes [FF, 25, 1E]
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] ntdll.dll!NtDeleteValueKey + 4 7C91D272 2 Bytes [8D, 71]
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] ntdll.dll!NtOpenFile 7C91D59E 3 Bytes [FF, 25, 1E]
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] ntdll.dll!NtOpenFile + 4 7C91D5A2 2 Bytes [84, 71]
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] ntdll.dll!NtOpenProcess 7C91D5FE 3 Bytes [FF, 25, 1E]
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] ntdll.dll!NtOpenProcess + 4 7C91D602 2 Bytes [8A, 71]
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] ntdll.dll!NtSetValueKey 7C91DDCE 3 Bytes [FF, 25, 1E]
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] ntdll.dll!NtSetValueKey + 4 7C91DDD2 2 Bytes [90, 71]
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00AF0001
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] USER32.dll!PostMessageW 7E368CCB 6 Bytes JMP 719A0F5A
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] USER32.dll!SendMessageW 7E37929A 6 Bytes JMP 71A00F5A
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] USER32.dll!PostMessageA 7E37AAFD 6 Bytes JMP 719D0F5A
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] USER32.dll!SendInput 7E37F140 3 Bytes [FF, 25, 1E]
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] USER32.dll!SendInput + 4 7E37F144 2 Bytes [A5, 71]
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] USER32.dll!SendMessageA 7E37F3C2 6 Bytes JMP 71A30F5A
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] USER32.dll!mouse_event 7E3B673F 6 Bytes JMP 71AC0F5A
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] USER32.dll!keybd_event 7E3B6783 6 Bytes JMP 71A90F5A
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] ADVAPI32.dll!CreateServiceA 77E07211 6 Bytes JMP 71970F5A
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] ADVAPI32.dll!CreateServiceW 77E073A9 6 Bytes JMP 71940F5A
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] WS2_32.dll!WSALookupServiceNextW 00F93181 6 Bytes JMP 71760F5A
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] WS2_32.dll!WSALookupServiceEnd 00F9350E 6 Bytes JMP 71820F5A
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] WS2_32.dll!WSALookupServiceBeginW 00F935EF 6 Bytes JMP 71790F5A
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] WS2_32.dll!connect 00F94A07 6 Bytes JMP 717F0F5A
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3992] WS2_32.dll!listen 00F98CD3 6 Bytes JMP 717C0F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] ntdll.dll!NtCreateFile 7C91D0AE 1 Byte [FF]
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] ntdll.dll!NtCreateFile 7C91D0AE 3 Bytes [FF, 25, 1E]
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] ntdll.dll!NtCreateFile + 4 7C91D0B2 2 Bytes [75, 71] {JNZ 0x73}
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] ntdll.dll!NtDeleteValueKey 7C91D26E 3 Bytes [FF, 25, 1E]
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] ntdll.dll!NtDeleteValueKey + 4 7C91D272 2 Bytes [7B, 71] {JNP 0x73}
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] ntdll.dll!NtOpenFile 7C91D59E 3 Bytes [FF, 25, 1E]
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] ntdll.dll!NtOpenFile + 4 7C91D5A2 2 Bytes [72, 71] {JB 0x73}
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] ntdll.dll!NtOpenProcess 7C91D5FE 3 Bytes [FF, 25, 1E]
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] ntdll.dll!NtOpenProcess + 4 7C91D602 2 Bytes [78, 71] {JS 0x73}
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] ntdll.dll!NtSetValueKey 7C91DDCE 3 Bytes [FF, 25, 1E]
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] ntdll.dll!NtSetValueKey + 4 7C91DDD2 2 Bytes [7E, 71] {JLE 0x73}
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00EA0001
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] USER32.dll!PostMessageW 7E368CCB 6 Bytes JMP 71880F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] USER32.dll!SendMessageW 7E37929A 6 Bytes JMP 718E0F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] USER32.dll!PostMessageA 7E37AAFD 6 Bytes JMP 718B0F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] USER32.dll!SendInput 7E37F140 3 Bytes [FF, 25, 1E]
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] USER32.dll!SendInput + 4 7E37F144 2 Bytes [93, 71]
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] USER32.dll!SendMessageA 7E37F3C2 6 Bytes JMP 71910F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] USER32.dll!mouse_event 7E3B673F 6 Bytes JMP 719A0F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] USER32.dll!keybd_event 7E3B6783 6 Bytes JMP 71970F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] ADVAPI32.dll!CreateServiceA 77E07211 6 Bytes JMP 71850F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] ADVAPI32.dll!CreateServiceW 77E073A9 6 Bytes JMP 71820F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] WS2_32.dll!WSALookupServiceNextW 71A13181 6 Bytes JMP 71A30F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] WS2_32.dll!WSALookupServiceEnd 71A1350E 6 Bytes JMP 719D0F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] WS2_32.dll!WSALookupServiceBeginW 71A135EF 6 Bytes JMP 71A60F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] WS2_32.dll!connect 71A14A07 6 Bytes JMP 71AF0F5A
.text C:\Programme\Kodak\Document Imaging\kds_i1100\Smart Touch\KSSCFG.exe[4044] WS2_32.dll!listen 71A18CD3 6 Bytes JMP 71A90F5A

---- Devices - GMER 1.0.15 ----

Device Ntfs.sys (NT File System Driver/Microsoft Corporation)

AttachedDevice tdrpm258.sys (Acronis Try&Decide Volume Filter Driver/Acronis)

Device Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)
Device rdpdr.sys (Microsoft RDP Device redirector/Microsoft Corporation)
Device ftdisk.sys (FT-Datenträgertreiber/Microsoft Corporation)

AttachedDevice fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 89B2CAEA
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 89B2CAEA
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP0T0L0-4 89B2CAEA
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP0T1L0-c 89B2CAEA
Device \Driver\PCTSDInjDriver32 \Device\PCTSDInjDriver32 PCTSDInj32.sys
Device mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)
Device Fs_Rec.SYS (File System Recognizer Driver/Microsoft Corporation)
Device \Device\Ide\IdeDeviceP1T0L0-17 -> \??\IDE#DiskHitachi_HDP725032GLA360_________________GM3OA52A#5&95bd10&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Syncmgr\AutoSync\username\LAN-Verbindung
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Syncmgr\AutoSync\username\LAN-Verbindung\{FF5E08AB-1A45-4236-9C3B-3DF308AD5D31}
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Syncmgr\AutoSync\username\LAN-Verbindung\{FF5E08AB-1A45-4236-9C3B-3DF308AD5D31}@ItemsChecked 0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Syncmgr\AutoSync\username\LAN-Verbindung\{FF5E08AB-1A45-4236-9C3B-3DF308AD5D31}\{FFFFFFFD-9599-46B8-A9B7-E20155FC4EAF}
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Syncmgr\AutoSync\username\LAN-Verbindung\{FF5E08AB-1A45-4236-9C3B-3DF308AD5D31}\{FFFFFFFD-9599-46B8-A9B7-E20155FC4EAF}@CheckState 0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Syncmgr\AutoSync\username\LAN-Verbindung\{FF5E08AB-1A45-4236-9C3B-3DF308AD5D31}\{FFFFFFFE-9599-46B8-A9B7-E20155FC4EAF}
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Syncmgr\AutoSync\username\LAN-Verbindung\{FF5E08AB-1A45-4236-9C3B-3DF308AD5D31}\{FFFFFFFE-9599-46B8-A9B7-E20155FC4EAF}@CheckState 0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Syncmgr\AutoSync\username\LAN-Verbindung\{FF5E08AB-1A45-4236-9C3B-3DF308AD5D31}\{FFFFFFFF-9599-46B8-A9B7-E20155FC4EAF}
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Syncmgr\AutoSync\username\LAN-Verbindung\{FF5E08AB-1A45-4236-9C3B-3DF308AD5D31}\{FFFFFFFF-9599-46B8-A9B7-E20155FC4EAF}@CheckState 0

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk1\DR1 sectors 625142192 (+254): rootkit-like behavior;

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\drivers\ftdisk.sys suspicious modification; TDL3 <-- ROOTKIT !!!

---- EOF - GMER 1.0.15 ----
####################################################