| ichwillmit | 05.11.2010 18:29 |
Hallo Arne,
Hab mir Deine Links durchgelesen. ;) Werde mich in Zukunft daran halten.
Hier die log's
GMER log
GMER Logfile: Code:
GMER 1.0.15.15507 - hxxp://www.gmer.net
Rootkit scan 2010-11-05 17:37:12
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 WDC_WD300EB-75CPF0 06.04G06
Running: 3yn7ip2r.exe; Driver: C:\DOKUME~1\XXXXX\LOKALE~1\Temp\fftdapow.sys
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\system32\drivers\SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.) ZwClose [0xF47A1160]
SSDT \SystemRoot\system32\drivers\SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.) ZwCreateFile [0xF47A0868]
SSDT \SystemRoot\system32\drivers\SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.) ZwCreateKey [0xF479D320]
SSDT \SystemRoot\system32\drivers\SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.) ZwCreateProcess [0xF479FE90]
SSDT \SystemRoot\system32\drivers\SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.) ZwCreateProcessEx [0xF479FD9C]
SSDT \SystemRoot\system32\drivers\SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.) ZwCreateThread [0xF47A03FC]
SSDT \SystemRoot\system32\drivers\SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.) ZwDeleteFile [0xF47A1210]
SSDT \SystemRoot\system32\drivers\SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.) ZwDeleteKey [0xF479D786]
SSDT \SystemRoot\system32\drivers\SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.) ZwDeleteValueKey [0xF479D846]
SSDT \SystemRoot\system32\drivers\sbhips.sys (Sunbelt Personal Firewall Host Intrusion Prevention Driver/Sunbelt Software, Inc.) ZwLoadDriver [0xF77A101C]
SSDT \SystemRoot\system32\drivers\sbhips.sys (Sunbelt Personal Firewall Host Intrusion Prevention Driver/Sunbelt Software, Inc.) ZwMapViewOfSection [0xF77A1168]
SSDT \SystemRoot\system32\drivers\SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.) ZwOpenFile [0xF47A0B54]
SSDT \SystemRoot\system32\drivers\SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.) ZwOpenKey [0xF479D5CA]
SSDT \SystemRoot\system32\drivers\SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.) ZwResumeThread [0xF47A04EC]
SSDT \SystemRoot\system32\drivers\SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.) ZwSetInformationFile [0xF47A0E8C]
SSDT \SystemRoot\system32\drivers\SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.) ZwSetValueKey [0xF479D9BC]
SSDT \SystemRoot\system32\drivers\SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.) ZwWriteFile [0xF47A0DE0]
---- Kernel code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF6C9B380, 0x3DF545, 0xE8000020]
---- User code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\wscntfy.exe[180] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000701A8
.text C:\WINDOWS\system32\wscntfy.exe[180] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00070090
.text C:\WINDOWS\system32\wscntfy.exe[180] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00070694
.text C:\WINDOWS\system32\wscntfy.exe[180] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000702C0
.text C:\WINDOWS\system32\wscntfy.exe[180] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00070234
.text C:\WINDOWS\system32\wscntfy.exe[180] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00070004
.text C:\WINDOWS\system32\wscntfy.exe[180] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0007011C
.text C:\WINDOWS\system32\wscntfy.exe[180] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000704F0
.text C:\WINDOWS\system32\wscntfy.exe[180] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0007057C
.text C:\WINDOWS\system32\wscntfy.exe[180] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000703D8
.text C:\WINDOWS\system32\wscntfy.exe[180] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0007034C
.text C:\WINDOWS\system32\wscntfy.exe[180] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00070464
.text C:\WINDOWS\system32\wscntfy.exe[180] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00070608
.text C:\WINDOWS\system32\wscntfy.exe[180] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000707AC
.text C:\WINDOWS\system32\wscntfy.exe[180] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00070720
.text C:\WINDOWS\System32\alg.exe[256] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\System32\alg.exe[256] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\System32\alg.exe[256] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\System32\alg.exe[256] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\System32\alg.exe[256] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\System32\alg.exe[256] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\System32\alg.exe[256] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\System32\alg.exe[256] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\System32\alg.exe[256] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\System32\alg.exe[256] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\System32\alg.exe[256] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\System32\alg.exe[256] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\System32\alg.exe[256] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\System32\alg.exe[256] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\System32\alg.exe[256] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\System32\alg.exe[256] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\System32\alg.exe[256] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\System32\alg.exe[256] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\WINDOWS\Explorer.EXE[408] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\Explorer.EXE[408] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\Explorer.EXE[408] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\Explorer.EXE[408] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\Explorer.EXE[408] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\Explorer.EXE[408] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\Explorer.EXE[408] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\Explorer.EXE[408] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\Explorer.EXE[408] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\Explorer.EXE[408] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\Explorer.EXE[408] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\Explorer.EXE[408] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\Explorer.EXE[408] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\Explorer.EXE[408] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\Explorer.EXE[408] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\Explorer.EXE[408] WININET.dll!InternetConnectA 408CDEAE 5 Bytes JMP 00080F54
.text C:\WINDOWS\Explorer.EXE[408] WININET.dll!InternetConnectW 408CF862 5 Bytes JMP 00080FE0
.text C:\WINDOWS\Explorer.EXE[408] WININET.dll!InternetOpenA 408DD690 5 Bytes JMP 00080D24
.text C:\WINDOWS\Explorer.EXE[408] WININET.dll!InternetOpenW 408DDB09 5 Bytes JMP 00080DB0
.text C:\WINDOWS\Explorer.EXE[408] WININET.dll!InternetOpenUrlA 408DF3A4 5 Bytes JMP 00080E3C
.text C:\WINDOWS\Explorer.EXE[408] WININET.dll!InternetOpenUrlW 40926D5F 5 Bytes JMP 00080EC8
.text C:\WINDOWS\Explorer.EXE[408] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\Explorer.EXE[408] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\Explorer.EXE[408] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 5 Bytes JMP 0046F3C0 D:\Tobit Radio.fx\Server\rfx-server.exe
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] WS2_32.dll!socket 71A14211 5 Bytes JMP 001308C4
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] WS2_32.dll!bind 71A14480 5 Bytes JMP 00130838
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00130950
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] WININET.dll!InternetConnectA 408CDEAE 5 Bytes JMP 00130F54
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] WININET.dll!InternetConnectW 408CF862 5 Bytes JMP 00130FE0
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] WININET.dll!InternetOpenA 408DD690 5 Bytes JMP 00130D24
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] WININET.dll!InternetOpenW 408DDB09 5 Bytes JMP 00130DB0
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] WININET.dll!InternetOpenUrlA 408DF3A4 5 Bytes JMP 00130E3C
.text D:\Tobit Radio.fx\Server\rfx-server.exe[476] WININET.dll!InternetOpenUrlW 40926D5F 5 Bytes JMP 00130EC8
.text C:\Programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe[836] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe[836] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe[836] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe[836] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe[836] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe[836] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe[836] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe[836] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe[836] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe[836] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe[836] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe[836] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe[836] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe[836] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe[836] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\svchost.exe[952] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\svchost.exe[952] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\Programme\TomTom HOME 2\TomTomHOMEService.exe[964] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\TomTom HOME 2\TomTomHOMEService.exe[964] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\TomTom HOME 2\TomTomHOMEService.exe[964] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\TomTom HOME 2\TomTomHOMEService.exe[964] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\TomTom HOME 2\TomTomHOMEService.exe[964] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\TomTom HOME 2\TomTomHOMEService.exe[964] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\TomTom HOME 2\TomTomHOMEService.exe[964] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\TomTom HOME 2\TomTomHOMEService.exe[964] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\TomTom HOME 2\TomTomHOMEService.exe[964] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\TomTom HOME 2\TomTomHOMEService.exe[964] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\TomTom HOME 2\TomTomHOMEService.exe[964] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\TomTom HOME 2\TomTomHOMEService.exe[964] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\TomTom HOME 2\TomTomHOMEService.exe[964] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\WINDOWS\system32\csrss.exe[972] KERNEL32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001601A8
.text C:\WINDOWS\system32\csrss.exe[972] KERNEL32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00160090
.text C:\WINDOWS\system32\csrss.exe[972] KERNEL32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00160694
.text C:\WINDOWS\system32\csrss.exe[972] KERNEL32.dll!CreateProcessW 7C802336 5 Bytes JMP 001602C0
.text C:\WINDOWS\system32\csrss.exe[972] KERNEL32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00160234
.text C:\WINDOWS\system32\csrss.exe[972] KERNEL32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00160004
.text C:\WINDOWS\system32\csrss.exe[972] KERNEL32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0016011C
.text C:\WINDOWS\system32\csrss.exe[972] KERNEL32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001604F0
.text C:\WINDOWS\system32\csrss.exe[972] KERNEL32.dll!CreateThread 7C8106D7 5 Bytes JMP 0016057C
.text C:\WINDOWS\system32\csrss.exe[972] KERNEL32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001603D8
.text C:\WINDOWS\system32\csrss.exe[972] KERNEL32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0016034C
.text C:\WINDOWS\system32\csrss.exe[972] KERNEL32.dll!WinExec 7C86250D 5 Bytes JMP 00160464
.text C:\WINDOWS\system32\csrss.exe[972] KERNEL32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00160608
.text C:\WINDOWS\system32\csrss.exe[972] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001607AC
.text C:\WINDOWS\system32\csrss.exe[972] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00160720
.text C:\WINDOWS\system32\winlogon.exe[996] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000701A8
.text C:\WINDOWS\system32\winlogon.exe[996] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00070090
.text C:\WINDOWS\system32\winlogon.exe[996] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00070694
.text C:\WINDOWS\system32\winlogon.exe[996] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000702C0
.text C:\WINDOWS\system32\winlogon.exe[996] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00070234
.text C:\WINDOWS\system32\winlogon.exe[996] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00070004
.text C:\WINDOWS\system32\winlogon.exe[996] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0007011C
.text C:\WINDOWS\system32\winlogon.exe[996] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000704F0
.text C:\WINDOWS\system32\winlogon.exe[996] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0007057C
.text C:\WINDOWS\system32\winlogon.exe[996] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000703D8
.text C:\WINDOWS\system32\winlogon.exe[996] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0007034C
.text C:\WINDOWS\system32\winlogon.exe[996] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00070464
.text C:\WINDOWS\system32\winlogon.exe[996] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00070608
.text C:\WINDOWS\system32\winlogon.exe[996] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000707AC
.text C:\WINDOWS\system32\winlogon.exe[996] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00070720
.text C:\WINDOWS\system32\winlogon.exe[996] WS2_32.dll!socket 71A14211 5 Bytes JMP 000708C4
.text C:\WINDOWS\system32\winlogon.exe[996] WS2_32.dll!bind 71A14480 5 Bytes JMP 00070838
.text C:\WINDOWS\system32\winlogon.exe[996] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00070950
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\services.exe[1040] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\services.exe[1040] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\lsass.exe[1052] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\lsass.exe[1052] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\lsass.exe[1052] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\lsass.exe[1052] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\lsass.exe[1052] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\WINDOWS\system32\nvsvc32.exe[1212] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\WINDOWS\system32\nvsvc32.exe[1212] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\WINDOWS\system32\nvsvc32.exe[1212] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\WINDOWS\system32\nvsvc32.exe[1212] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\WINDOWS\system32\nvsvc32.exe[1212] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\WINDOWS\system32\nvsvc32.exe[1212] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\WINDOWS\system32\nvsvc32.exe[1212] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\WINDOWS\system32\nvsvc32.exe[1212] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\WINDOWS\system32\nvsvc32.exe[1212] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\WINDOWS\system32\nvsvc32.exe[1212] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\WINDOWS\system32\nvsvc32.exe[1212] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\WINDOWS\system32\nvsvc32.exe[1212] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\WINDOWS\system32\nvsvc32.exe[1212] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\WINDOWS\system32\nvsvc32.exe[1212] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\WINDOWS\system32\nvsvc32.exe[1212] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\WINDOWS\system32\svchost.exe[1260] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\svchost.exe[1260] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\svchost.exe[1260] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\svchost.exe[1260] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\svchost.exe[1260] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\svchost.exe[1260] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\svchost.exe[1260] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\svchost.exe[1260] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\svchost.exe[1260] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\svchost.exe[1260] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\svchost.exe[1260] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\svchost.exe[1260] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\svchost.exe[1260] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\svchost.exe[1260] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\svchost.exe[1260] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\svchost.exe[1260] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\svchost.exe[1260] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\svchost.exe[1260] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\svchost.exe[1328] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\svchost.exe[1328] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\svchost.exe[1328] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\System32\svchost.exe[1440] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\System32\svchost.exe[1440] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\System32\svchost.exe[1440] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\System32\svchost.exe[1440] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\System32\svchost.exe[1440] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\WINDOWS\System32\svchost.exe[1440] WININET.dll!InternetConnectA 408CDEAE 5 Bytes JMP 00080F54
.text C:\WINDOWS\System32\svchost.exe[1440] WININET.dll!InternetConnectW 408CF862 5 Bytes JMP 00080FE0
.text C:\WINDOWS\System32\svchost.exe[1440] WININET.dll!InternetOpenA 408DD690 5 Bytes JMP 00080D24
.text C:\WINDOWS\System32\svchost.exe[1440] WININET.dll!InternetOpenW 408DDB09 5 Bytes JMP 00080DB0
.text C:\WINDOWS\System32\svchost.exe[1440] WININET.dll!InternetOpenUrlA 408DF3A4 5 Bytes JMP 00080E3C
.text C:\WINDOWS\System32\svchost.exe[1440] WININET.dll!InternetOpenUrlW 40926D5F 5 Bytes JMP 00080EC8
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\svchost.exe[1536] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\svchost.exe[1536] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\svchost.exe[1536] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\svchost.exe[1536] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\svchost.exe[1536] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\WINDOWS\system32\svchost.exe[1684] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\svchost.exe[1684] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\svchost.exe[1684] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\svchost.exe[1684] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\svchost.exe[1684] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\svchost.exe[1684] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\svchost.exe[1684] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\svchost.exe[1684] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\svchost.exe[1684] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\svchost.exe[1684] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\svchost.exe[1684] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\svchost.exe[1684] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\svchost.exe[1684] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\svchost.exe[1684] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\svchost.exe[1684] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\svchost.exe[1684] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\svchost.exe[1684] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\svchost.exe[1684] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\WINDOWS\system32\spoolsv.exe[1788] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\spoolsv.exe[1788] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\spoolsv.exe[1788] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\spoolsv.exe[1788] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\spoolsv.exe[1788] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\spoolsv.exe[1788] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\spoolsv.exe[1788] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\spoolsv.exe[1788] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\spoolsv.exe[1788] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\spoolsv.exe[1788] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\spoolsv.exe[1788] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\spoolsv.exe[1788] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\spoolsv.exe[1788] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\spoolsv.exe[1788] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\spoolsv.exe[1788] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\spoolsv.exe[1788] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\spoolsv.exe[1788] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\spoolsv.exe[1788] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\WINDOWS\system32\svchost.exe[1884] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\svchost.exe[1884] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\svchost.exe[1884] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\svchost.exe[1884] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\svchost.exe[1884] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\svchost.exe[1884] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\svchost.exe[1884] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\svchost.exe[1884] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\svchost.exe[1884] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\svchost.exe[1884] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\svchost.exe[1884] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\svchost.exe[1884] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\svchost.exe[1884] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\svchost.exe[1884] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\svchost.exe[1884] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\svchost.exe[1884] WININET.dll!InternetConnectA 408CDEAE 5 Bytes JMP 00080F54
.text C:\WINDOWS\system32\svchost.exe[1884] WININET.dll!InternetConnectW 408CF862 5 Bytes JMP 00080FE0
.text C:\WINDOWS\system32\svchost.exe[1884] WININET.dll!InternetOpenA 408DD690 5 Bytes JMP 00080D24
.text C:\WINDOWS\system32\svchost.exe[1884] WININET.dll!InternetOpenW 408DDB09 5 Bytes JMP 00080DB0
.text C:\WINDOWS\system32\svchost.exe[1884] WININET.dll!InternetOpenUrlA 408DF3A4 5 Bytes JMP 00080E3C
.text C:\WINDOWS\system32\svchost.exe[1884] WININET.dll!InternetOpenUrlW 40926D5F 5 Bytes JMP 00080EC8
.text C:\WINDOWS\system32\svchost.exe[1884] WS2_32.dll!socket 71A14211 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\svchost.exe[1884] WS2_32.dll!bind 71A14480 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\svchost.exe[1884] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00080950
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1916] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1916] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1916] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1916] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1916] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1916] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1916] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1916] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1916] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1916] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1916] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1916] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1916] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1916] WS2_32.dll!socket 71A14211 5 Bytes JMP 001308C4
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1916] WS2_32.dll!bind 71A14480 5 Bytes JMP 00130838
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1916] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00130950
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1916] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1916] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\Bonjour\mDNSResponder.exe[1932] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\Bonjour\mDNSResponder.exe[1932] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\Bonjour\mDNSResponder.exe[1932] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\Bonjour\mDNSResponder.exe[1932] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\Bonjour\mDNSResponder.exe[1932] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\Bonjour\mDNSResponder.exe[1932] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\Bonjour\mDNSResponder.exe[1932] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\Bonjour\mDNSResponder.exe[1932] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\Bonjour\mDNSResponder.exe[1932] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\Bonjour\mDNSResponder.exe[1932] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\Bonjour\mDNSResponder.exe[1932] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\Bonjour\mDNSResponder.exe[1932] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\Bonjour\mDNSResponder.exe[1932] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\Bonjour\mDNSResponder.exe[1932] WS2_32.dll!socket 71A14211 5 Bytes JMP 001308C4
.text C:\Programme\Bonjour\mDNSResponder.exe[1932] WS2_32.dll!bind 71A14480 5 Bytes JMP 00130838
.text C:\Programme\Bonjour\mDNSResponder.exe[1932] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00130950
.text C:\Programme\Bonjour\mDNSResponder.exe[1932] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\Bonjour\mDNSResponder.exe[1932] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Dokumente und Einstellungen\XXXXX\Desktop\3yn7ip2r.exe[2416] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Dokumente und Einstellungen\XXXXX\Desktop\3yn7ip2r.exe[2416] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Dokumente und Einstellungen\XXXXX\Desktop\3yn7ip2r.exe[2416] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Dokumente und Einstellungen\XXXXX\Desktop\3yn7ip2r.exe[2416] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Dokumente und Einstellungen\XXXXX\Desktop\3yn7ip2r.exe[2416] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Dokumente und Einstellungen\XXXXX\Desktop\3yn7ip2r.exe[2416] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Dokumente und Einstellungen\XXXXX\Desktop\3yn7ip2r.exe[2416] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Dokumente und Einstellungen\XXXXX\Desktop\3yn7ip2r.exe[2416] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Dokumente und Einstellungen\XXXXX\Desktop\3yn7ip2r.exe[2416] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Dokumente und Einstellungen\XXXXX\Desktop\3yn7ip2r.exe[2416] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Dokumente und Einstellungen\XXXXX\Desktop\3yn7ip2r.exe[2416] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Dokumente und Einstellungen\XXXXX\Desktop\3yn7ip2r.exe[2416] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Dokumente und Einstellungen\XXXXX\Desktop\3yn7ip2r.exe[2416] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Dokumente und Einstellungen\XXXXX\Desktop\3yn7ip2r.exe[2416] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Dokumente und Einstellungen\XXXXX\Desktop\3yn7ip2r.exe[2416] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\WINDOWS\Logi_MwX.Exe[2456] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\WINDOWS\Logi_MwX.Exe[2456] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\WINDOWS\Logi_MwX.Exe[2456] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\WINDOWS\Logi_MwX.Exe[2456] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\WINDOWS\Logi_MwX.Exe[2456] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\WINDOWS\Logi_MwX.Exe[2456] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\WINDOWS\Logi_MwX.Exe[2456] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\WINDOWS\Logi_MwX.Exe[2456] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\WINDOWS\Logi_MwX.Exe[2456] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\WINDOWS\Logi_MwX.Exe[2456] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\WINDOWS\Logi_MwX.Exe[2456] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\WINDOWS\Logi_MwX.Exe[2456] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\WINDOWS\Logi_MwX.Exe[2456] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\WINDOWS\Logi_MwX.Exe[2456] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\WINDOWS\Logi_MwX.Exe[2456] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\CyberLink\PowerDVD\PDVDServ.exe[2472] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\CyberLink\PowerDVD\PDVDServ.exe[2472] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\CyberLink\PowerDVD\PDVDServ.exe[2472] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\CyberLink\PowerDVD\PDVDServ.exe[2472] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\CyberLink\PowerDVD\PDVDServ.exe[2472] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\CyberLink\PowerDVD\PDVDServ.exe[2472] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\CyberLink\PowerDVD\PDVDServ.exe[2472] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\CyberLink\PowerDVD\PDVDServ.exe[2472] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\CyberLink\PowerDVD\PDVDServ.exe[2472] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\CyberLink\PowerDVD\PDVDServ.exe[2472] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\CyberLink\PowerDVD\PDVDServ.exe[2472] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\CyberLink\PowerDVD\PDVDServ.exe[2472] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\CyberLink\PowerDVD\PDVDServ.exe[2472] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\CyberLink\PowerDVD\PDVDServ.exe[2472] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\CyberLink\PowerDVD\PDVDServ.exe[2472] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\WINDOWS\system32\RUNDLL32.EXE[2496] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\RUNDLL32.EXE[2496] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\RUNDLL32.EXE[2496] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\RUNDLL32.EXE[2496] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\RUNDLL32.EXE[2496] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\RUNDLL32.EXE[2496] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\RUNDLL32.EXE[2496] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\RUNDLL32.EXE[2496] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\RUNDLL32.EXE[2496] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\RUNDLL32.EXE[2496] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\RUNDLL32.EXE[2496] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\RUNDLL32.EXE[2496] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\RUNDLL32.EXE[2496] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\RUNDLL32.EXE[2496] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\RUNDLL32.EXE[2496] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\Programme\iTunes\iTunesHelper.exe[2524] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\iTunes\iTunesHelper.exe[2524] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\iTunes\iTunesHelper.exe[2524] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\iTunes\iTunesHelper.exe[2524] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\iTunes\iTunesHelper.exe[2524] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\iTunes\iTunesHelper.exe[2524] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\iTunes\iTunesHelper.exe[2524] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\iTunes\iTunesHelper.exe[2524] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\iTunes\iTunesHelper.exe[2524] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\iTunes\iTunesHelper.exe[2524] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\iTunes\iTunesHelper.exe[2524] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\iTunes\iTunesHelper.exe[2524] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\iTunes\iTunesHelper.exe[2524] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\iTunes\iTunesHelper.exe[2524] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\iTunes\iTunesHelper.exe[2524] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\iTunes\iTunesHelper.exe[2524] WS2_32.dll!socket 71A14211 5 Bytes JMP 001308C4
.text C:\Programme\iTunes\iTunesHelper.exe[2524] WS2_32.dll!bind 71A14480 5 Bytes JMP 00130838
.text C:\Programme\iTunes\iTunesHelper.exe[2524] WS2_32.dll!connect 71A14A07 5 Bytes JMP 00130950
.text C:\Programme\iTunes\iTunesHelper.exe[2524] WININET.DLL!InternetConnectA 408CDEAE 5 Bytes JMP 00130F54
.text C:\Programme\iTunes\iTunesHelper.exe[2524] WININET.DLL!InternetConnectW 408CF862 5 Bytes JMP 00130FE0
.text C:\Programme\iTunes\iTunesHelper.exe[2524] WININET.DLL!InternetOpenA 408DD690 5 Bytes JMP 00130D24
.text C:\Programme\iTunes\iTunesHelper.exe[2524] WININET.DLL!InternetOpenW 408DDB09 5 Bytes JMP 00130DB0
.text C:\Programme\iTunes\iTunesHelper.exe[2524] WININET.DLL!InternetOpenUrlA 408DF3A4 5 Bytes JMP 00130E3C
.text C:\Programme\iTunes\iTunesHelper.exe[2524] WININET.DLL!InternetOpenUrlW 40926D5F 5 Bytes JMP 00130EC8
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] WININET.dll!InternetConnectA 408CDEAE 5 Bytes JMP 00130F54
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] WININET.dll!InternetConnectW 408CF862 5 Bytes JMP 00130FE0
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] WININET.dll!InternetOpenA 408DD690 5 Bytes JMP 00130D24
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] WININET.dll!InternetOpenW 408DDB09 5 Bytes JMP 00130DB0
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] WININET.dll!InternetOpenUrlA 408DF3A4 5 Bytes JMP 00130E3C
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[2540] WININET.dll!InternetOpenUrlW 40926D5F 5 Bytes JMP 00130EC8
.text C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe[2568] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe[2568] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe[2568] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe[2568] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe[2568] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe[2568] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe[2568] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe[2568] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe[2568] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe[2568] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe[2568] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe[2568] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe[2568] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe[2568] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe[2568] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\Logitech\SetPoint\KEM.exe[2752] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\Logitech\SetPoint\KEM.exe[2752] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\Logitech\SetPoint\KEM.exe[2752] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\Logitech\SetPoint\KEM.exe[2752] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\Logitech\SetPoint\KEM.exe[2752] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\Logitech\SetPoint\KEM.exe[2752] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\Logitech\SetPoint\KEM.exe[2752] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\Logitech\SetPoint\KEM.exe[2752] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\Logitech\SetPoint\KEM.exe[2752] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\Logitech\SetPoint\KEM.exe[2752] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\Logitech\SetPoint\KEM.exe[2752] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\Logitech\SetPoint\KEM.exe[2752] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\Logitech\SetPoint\KEM.exe[2752] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\Logitech\SetPoint\KEM.exe[2752] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\Logitech\SetPoint\KEM.exe[2752] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\Programme\Logitech\SetPoint\KHALMNPR.EXE[2808] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\Logitech\SetPoint\KHALMNPR.EXE[2808] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\Logitech\SetPoint\KHALMNPR.EXE[2808] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\Logitech\SetPoint\KHALMNPR.EXE[2808] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\Logitech\SetPoint\KHALMNPR.EXE[2808] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\Logitech\SetPoint\KHALMNPR.EXE[2808] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\Logitech\SetPoint\KHALMNPR.EXE[2808] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\Logitech\SetPoint\KHALMNPR.EXE[2808] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\Logitech\SetPoint\KHALMNPR.EXE[2808] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\Logitech\SetPoint\KHALMNPR.EXE[2808] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\Logitech\SetPoint\KHALMNPR.EXE[2808] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\Logitech\SetPoint\KHALMNPR.EXE[2808] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\Logitech\SetPoint\KHALMNPR.EXE[2808] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\Logitech\SetPoint\KHALMNPR.EXE[2808] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\Logitech\SetPoint\KHALMNPR.EXE[2808] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
.text C:\WINDOWS\system32\ctfmon.exe[2932] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\ctfmon.exe[2932] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\ctfmon.exe[2932] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\ctfmon.exe[2932] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\ctfmon.exe[2932] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\ctfmon.exe[2932] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\ctfmon.exe[2932] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\ctfmon.exe[2932] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\ctfmon.exe[2932] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\ctfmon.exe[2932] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\ctfmon.exe[2932] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\ctfmon.exe[2932] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\ctfmon.exe[2932] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\ctfmon.exe[2932] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\ctfmon.exe[2932] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00080720
.text C:\Programme\iPod\bin\iPodService.exe[3180] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001301A8
.text C:\Programme\iPod\bin\iPodService.exe[3180] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00130090
.text C:\Programme\iPod\bin\iPodService.exe[3180] kernel32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 00130694
.text C:\Programme\iPod\bin\iPodService.exe[3180] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001302C0
.text C:\Programme\iPod\bin\iPodService.exe[3180] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00130234
.text C:\Programme\iPod\bin\iPodService.exe[3180] kernel32.dll!VirtualAlloc 7C809AF1 5 Bytes JMP 00130004
.text C:\Programme\iPod\bin\iPodService.exe[3180] kernel32.dll!VirtualAllocEx 7C809B12 5 Bytes JMP 0013011C
.text C:\Programme\iPod\bin\iPodService.exe[3180] kernel32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 001304F0
.text C:\Programme\iPod\bin\iPodService.exe[3180] kernel32.dll!CreateThread 7C8106D7 5 Bytes JMP 0013057C
.text C:\Programme\iPod\bin\iPodService.exe[3180] kernel32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 001303D8
.text C:\Programme\iPod\bin\iPodService.exe[3180] kernel32.dll!CreateProcessInternalA 7C81D54E 5 Bytes JMP 0013034C
.text C:\Programme\iPod\bin\iPodService.exe[3180] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00130464
.text C:\Programme\iPod\bin\iPodService.exe[3180] kernel32.dll!SetThreadContext 7C863C09 5 Bytes JMP 00130608
.text C:\Programme\iPod\bin\iPodService.exe[3180] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 001307AC
.text C:\Programme\iPod\bin\iPodService.exe[3180] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00130720
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.)
Device \FileSystem\Fastfat \Fat B66E4D20
---- EOF - GMER 1.0.15 ----
--- --- ---
OSAM log
OSAM Logfile: Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 17:54:09 on 05.11.2010
OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702
Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures
Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries
[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
"nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl
"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl
[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"catchme" (catchme) - ? - C:\cofi\catchme.sys (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys (File not found)
"EZ-USB FX2 FIRMWARE LOADER (LVEzLD06.sys)" (LVEzLoader) - "Animation Technologies Inc." - C:\WINDOWS\System32\Drivers\LVEzLD06.sys
"fftdapow" (fftdapow) - ? - C:\DOKUME~1\XXXXX\LOKALE~1\Temp\fftdapow.sys (Hidden registry entry, rootkit activity | File not found)
"Hauppauge WinTV USB Pro (PAL/SECAM FM)" (NuVision) - "Hauppauge Computer Works" - C:\WINDOWS\System32\DRIVERS\NUVision.sys
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys (File not found)
"LVUSB Service" (LifeView_USBDVBT) - "Animation Technologies Inc." - C:\WINDOWS\System32\Drivers\AVUSB_TX.sys
"OMCI" (OMCI) - "Dell Computer Corporation" - C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys (File not found)
"PQNTDrv" (PQNTDrv) - ? - C:\WINDOWS\system32\drivers\PQNTDrv.sys (File found, but it contains no detailed information)
"SbFw" (SbFw) - "Sunbelt Software, Inc." - C:\WINDOWS\System32\drivers\SbFw.sys
"Sunbelt HIPS Driver" (sbhips) - "Sunbelt Software, Inc." - C:\WINDOWS\system32\drivers\sbhips.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys (File not found)
[Explorer]
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "Adobe.Acrobat.ContextMenu" - ? - (File not found | COM-object registry key not found)
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll (File not found)
{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Programme\iTunes\iTunesMiniPlayer.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? - (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\OFFICE11\msohev.dll
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL
{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Programme\Real\RealPlayer\rpshell.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? - (File not found | COM-object registry key not found)
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{E0D79304-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, Inc." - C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
{E0D79305-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, Inc." - C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
{E0D79306-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, Inc." - C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
{E0D79307-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, Inc." - C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found)
<binary data> "ITBarLayout" - ? - (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{67DABFBF-D0AB-41FA-9C46-CC0F21721616} "DivXBrowserPlugin Object" - "DivX,Inc." - C:\Programme\DivX\DivX Web Player\npdivx32.dll / hxxp://download.divx.com/player/DivXBrowserPlugin.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_21" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_21.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} "Java Plug-in 1.6.0_21" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_21.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_21" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_21.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
{3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} "Office Update Installation Engine" - "Microsoft Corporation" - C:\WINDOWS\opuc.dll / hxxp://office.microsoft.com/officeupdate/content/opuc3.cab
{166B1BCA-3F9C-11CF-8075-444553540000} "Shockwave ActiveX Control" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Adobe\Director\SwDir.dll / hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10k.ocx / https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
{2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} "Symantec AntiVirus scanner" - "Symantec Corporation" - C:\WINDOWS\Downloaded Program Files\avsniff.dll / hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
{644E432F-49D3-41A1-8DD5-E099162EEEC5} "Symantec RuFSI Utility Class" - "Symantec Corporation" - C:\WINDOWS\Downloaded Program Files\rufsi.dll / hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
{1E54D648-B804-468d-BC78-4AFFED8E262F} "System Requirements Lab Class" - "Husdawg, LLC" - C:\WINDOWS\Downloaded Program Files\sysreqlab_nvd.dll / hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\WINDOWS\system32\LegitCheckControl.DLL / hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? - (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} "{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}" - ? - (File not found | COM-object registry key not found) /
{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}" - ? - (File not found | COM-object registry key not found) /
{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? - (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
"Logitech Desktop Messenger.lnk" - "Logitech" - C:\Programme\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe (Shortcut exists | File exists)
"Logitech SetPoint.lnk" - "Logitech Inc." - C:\Programme\Logitech\SetPoint\KEM.exe (Shortcut exists | File exists)
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\XXXXX\Startmenü\Programme\Autostart\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"NBJ" - "Ahead Software AG" - "C:\Programme\Ahead\Nero BackItUp\NBJ.exe"
"TomTomHOME.exe" - "TomTom" - "C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe" -s
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"iTunesHelper" - "Apple Inc." - "C:\Programme\iTunes\iTunesHelper.exe"
"NeroFilterCheck" - "Ahead Software Gmbh" - C:\WINDOWS\system32\NeroCheck.exe
"NvCplDaemon" - "NVIDIA Corporation" - RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
"NvMediaCenter" - "NVIDIA Corporation" - RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
"nwiz" - "NVIDIA Corporation" - C:\Programme\NVIDIA Corporation\nView\nwiz.exe /install
"QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime\qttask.exe" -atboottime
"RemoteControl" - "Cyberlink Corp." - C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\mdimon.dll
[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Programme\Bonjour\mDNSResponder.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Programme\iPod\bin\iPodService.exe
"NVIDIA Display Driver Service" (NVSvc) - "NVIDIA Corporation" - C:\WINDOWS\system32\nvsvc32.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"Radio.fx Server" (Radio.fx) - ? - D:\Tobit Radio.fx\Server\rfx-server.exe
"SbPF.Launcher" (SbPF.Launcher) - "Sunbelt Software, Inc." - C:\Programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe
"Sunbelt Personal Firewall 4" (SPF4) - "Sunbelt Software, Inc." - C:\Programme\Sunbelt Software\Personal Firewall\SbPFSvc.exe
"TomTomHOMEService" (TomTomHOMEService) - "TomTom" - C:\Programme\TomTom HOME 2\TomTomHOMEService.exe
[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll
[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Programme\Bonjour\mdnsNSP.dll
===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---
If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru[/QUOTE]
MBR log Zitat:
MBRCheck, version 1.2.3
(c) 2010, AD
Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000006d
Kernel Drivers (total 123):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EF000 \WINDOWS\system32\hal.dll
0xF7B2F000 \WINDOWS\system32\KDCOM.DLL
0xF7A3F000 \WINDOWS\system32\BOOTVID.dll
0xF75DF000 ACPI.sys
0xF7B31000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF75CE000 pci.sys
0xF762F000 isapnp.sys
0xF7BF7000 pciide.sys
0xF78AF000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7B33000 intelide.sys
0xF763F000 MountMgr.sys
0xF75AF000 ftdisk.sys
0xF7B35000 dmload.sys
0xF7589000 dmio.sys
0xF78B7000 PartMgr.sys
0xF764F000 VolSnap.sys
0xF7571000 atapi.sys
0xF765F000 disk.sys
0xF766F000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF7551000 fltmgr.sys
0xF753F000 sr.sys
0xF7528000 KSecDD.sys
0xF749B000 Ntfs.sys
0xF746E000 NDIS.sys
0xF7454000 Mup.sys
0xF767F000 agp440.sys
0xF785F000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF6C9B000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF6C87000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF797F000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF6C63000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF7987000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF6BF6000 \SystemRoot\system32\DRIVERS\fpcibase.sys
0xF6BD3000 \SystemRoot\system32\DRIVERS\e100b325.sys
0xF798F000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF786F000 \SystemRoot\system32\drivers\i8042prt.sys
0xF7B07000 \SystemRoot\system32\DRIVERS\L8042Kbd.sys
0xF7997000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF787F000 \SystemRoot\system32\DRIVERS\L8042mou.Sys
0xF788F000 \SystemRoot\system32\DRIVERS\LMouKE.Sys
0xF799F000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF789F000 \SystemRoot\system32\DRIVERS\serial.sys
0xF7B0B000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF6BBF000 \SystemRoot\system32\DRIVERS\parport.sys
0xF769F000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF76AF000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF76BF000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF6B9C000 \SystemRoot\system32\DRIVERS\ks.sys
0xF79A7000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0xF6B18000 \SystemRoot\system32\drivers\smwdm.sys
0xF6AF4000 \SystemRoot\system32\drivers\portcls.sys
0xF76CF000 \SystemRoot\system32\drivers\drmk.sys
0xF7B55000 \SystemRoot\system32\drivers\aeaudio.sys
0xF76DF000 \SystemRoot\system32\DRIVERS\avmwan.sys
0xF7D56000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF76EF000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7B17000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF6ADD000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF76FF000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF770F000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF79AF000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF6ACC000 \SystemRoot\system32\DRIVERS\psched.sys
0xF771F000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF79B7000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF79BF000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF697A000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xF772F000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF773F000 \SystemRoot\system32\DRIVERS\sbfwim.sys
0xF7B59000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF691C000 \SystemRoot\system32\DRIVERS\update.sys
0xF741B000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF775F000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF776F000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7B5B000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF79D7000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF7B5F000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7C8F000 \SystemRoot\System32\Drivers\Null.SYS
0xF7B61000 \SystemRoot\System32\Drivers\Beep.SYS
0xF79E7000 \SystemRoot\System32\drivers\vga.sys
0xF7B63000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7B65000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF79EF000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF79F7000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF4793000 \SystemRoot\system32\drivers\SbFw.sys
0xF7AD7000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xF4780000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF4727000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF46FF000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF46DD000 \SystemRoot\System32\drivers\afd.sys
0xF778F000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF779F000 \SystemRoot\system32\drivers\sbhips.sys
0xF46B7000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF77AF000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF4667000 \SystemRoot\system32\DRIVERS\NUVision.sys
0xF77BF000 \SystemRoot\system32\DRIVERS\STREAM.SYS
0xF459C000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF7CB1000 \SystemRoot\System32\Drivers\PQNTDrv.SYS
0xF7AEF000 \SystemRoot\SYSTEM32\DRIVERS\OMCI.SYS
0xF452C000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF77DF000 \SystemRoot\System32\Drivers\Fips.SYS
0xF6A4C000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF444B000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7B79000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF690C000 \SystemRoot\System32\drivers\Dxapi.sys
0xF78CF000 \SystemRoot\System32\watchdog.sys
0xBD000000 \SystemRoot\System32\drivers\dxg.sys
0xF7D4A000 \SystemRoot\System32\drivers\dxgthk.sys
0xBD012000 \SystemRoot\System32\nv4_disp.dll
0xB8790000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB85CB000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF7BBB000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB8483000 \SystemRoot\system32\DRIVERS\srv.sys
0xB86B8000 \SystemRoot\system32\DRIVERS\secdrv.sys
0xB800E000 \SystemRoot\system32\drivers\wdmaud.sys
0xB82FB000 \SystemRoot\system32\drivers\sysaudio.sys
0xB7C51000 \SystemRoot\System32\Drivers\HTTP.sys
0xB7B55000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0xB6701000 \??\C:\DOKUME~1\XXXXX\LOKALE~1\Temp\fftdapow.sys
0xB66DD000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xB668A000 \SystemRoot\system32\drivers\kmixer.sys
0x7C910000 \WINDOWS\system32\ntdll.dll
Processes (total 38):
0 System Idle Process
4 System
924 C:\WINDOWS\system32\smss.exe
972 csrss.exe
996 C:\WINDOWS\system32\winlogon.exe
1040 C:\WINDOWS\system32\services.exe
1052 C:\WINDOWS\system32\lsass.exe
1212 C:\WINDOWS\system32\nvsvc32.exe
1260 C:\WINDOWS\system32\svchost.exe
1328 svchost.exe
1440 C:\WINDOWS\system32\svchost.exe
1536 svchost.exe
1684 svchost.exe
1788 C:\WINDOWS\system32\spoolsv.exe
1884 svchost.exe
1916 C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1932 C:\Programme\Bonjour\mDNSResponder.exe
476 D:\Tobit Radio.fx\Server\rfx-server.exe
836 C:\Programme\Sunbelt Software\Personal Firewall\SbPFLnch.exe
952 C:\WINDOWS\system32\svchost.exe
964 C:\Programme\TomTom HOME 2\TomTomHOMEService.exe
256 alg.exe
408 C:\WINDOWS\explorer.exe
2456 C:\WINDOWS\LOGI_MWX.EXE
2472 C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
2496 C:\WINDOWS\system32\rundll32.exe
2524 C:\Programme\iTunes\iTunesHelper.exe
2540 C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
2568 C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe
2752 C:\Programme\Logitech\SetPoint\KEM.exe
2808 C:\Programme\Logitech\SetPoint\KHALMNPR.exe
3180 C:\Programme\iPod\bin\iPodService.exe
2932 C:\WINDOWS\system32\ctfmon.exe
3552 C:\Programme\Sunbelt Software\Personal Firewall\SbPFSvc.exe
3532 C:\Programme\Sunbelt Software\Personal Firewall\SbPFCl.exe
2720 C:\Programme\Google\Update\GoogleUpdate.exe
260 C:\Programme\Google\Update\GoogleUpdate.exe
3748 C:\Dokumente und Einstellungen\XXXXX\Desktop\MBRCheck.exe
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`02738a00 (NTFS)
\\.\D: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)
PhysicalDrive0 Model Number: WDCWD300EB-75CPF0, Rev: 06.04G06
PhysicalDrive1 Model Number: WDCWD2000BB-00GUC0, Rev: 08.02D08
Size Device Name MBR Status
--------------------------------------------
27 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: ADFE55CD0C6ED2E00B22375835E4C2736CE9AD11
186 GB \\.\PhysicalDrive1 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A
Done!
| |
