[Closed] hijackthis log posting

comet101 Topic Starter

Post #1April 15, 2009, 10:35 PM UTC

Hello!

A friend referred me to this site and said you guys really know your stuff so I thought i would give it a shot.
A few weeks ago my computer got a virus that poses as a fake antivirus program. I had a friend take my computer and clean it out for me. He said that all the infected files were cleaned up. For the most part he was right since it was no longer on my computer….
Recently I have been getting a random 'windows installer' window that pops up and starts installing something. This, I believe, is how the virus originally got on my computer. I can cancel the installation but it just pops up again and again. Sometimes twice, others 5 times in a row.

Any help would be much appreciated..

I scanned my computer with hijackthis and here is the log I got:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:16:06 PM, on 4/15/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
C:\PROGRA~1\PASSWO~1\tlpd.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\iolo\common\lib\ioloServiceManager.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\DllHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=5070110
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=5070110
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O1 - Hosts: 1.1.1.1 usa.kaspersky.com
O1 - Hosts: 1.1.1.1 www.bitdefender.com
O1 - Hosts: 1.1.1.1 download.bitdefender.com
O1 - Hosts: 1.1.1.1 www.paretologic.com
O1 - Hosts: 1.1.1.1 paretologic.com
O1 - Hosts: 1.1.1.1 services.google.com
O1 - Hosts: 1.1.1.1 www.webroot.com
O1 - Hosts: 1.1.1.1 webroot.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [Password Door Loader] C:\PROGRA~1\PASSWO~1\tlpd.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iolo AntiVirus] "C:\Program Files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe -silent
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O20 - AppInit_DLLs: karna.dat
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 10535 bytes

CatByte

Post #2April 16, 2009, 12:23 PM UTC

Hi,

Please do the following:

Download ComboFix from one of these locations:
Link 1
Link 2
Link 3

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please advise.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

comet101

Post #3April 17, 2009, 3:01 AM UTC

This is the log that I received afterward….

ComboFix 09-04-17.01 - Brian Tompson 04/16/2009 21:47.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3062.2398 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: iolo AntiVirus® *On-access scanning disabled* (Updated)
FW: Norton Internet Worm Protection *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\progra~1\COMMON~1\{342FD~1
c:\progra~1\COMMON~1\{342FD~1\Bar888.dll
c:\progra~1\COMMON~1\{342FD~1\UnInstall.exe
c:\progra~1\COMMON~1\{342FD~2
c:\progra~1\COMMON~1\{342FD~2\Bar888.dll
c:\progra~1\COMMON~1\{342FD~2\UnInstall.exe
c:\progra~1\COMMON~1\{542FD~1
c:\progra~1\COMMON~1\{542FD~2
c:\program files\Common Files\System\Uninstall
c:\windows\jestertb.dll
c:\windows\system32\_003042_.tmp.dll
c:\windows\system32\_003043_.tmp.dll
c:\windows\system32\_003044_.tmp.dll
c:\windows\system32\_003045_.tmp.dll
c:\windows\system32\_003052_.tmp.dll
c:\windows\system32\_003053_.tmp.dll
c:\windows\system32\_003054_.tmp.dll
c:\windows\system32\_003055_.tmp.dll
c:\windows\system32\_003057_.tmp.dll
c:\windows\system32\_003058_.tmp.dll
c:\windows\system32\_003061_.tmp.dll
c:\windows\system32\_003062_.tmp.dll
c:\windows\system32\_003064_.tmp.dll
c:\windows\system32\_003065_.tmp.dll
c:\windows\system32\_003066_.tmp.dll
c:\windows\system32\_003068_.tmp.dll
c:\windows\system32\_003071_.tmp.dll
c:\windows\system32\_003072_.tmp.dll
c:\windows\system32\_003076_.tmp.dll
c:\windows\system32\_003077_.tmp.dll
c:\windows\system32\_003079_.tmp.dll
c:\windows\system32\_003082_.tmp.dll
c:\windows\system32\_003084_.tmp.dll
c:\windows\system32\_003085_.tmp.dll
c:\windows\system32\_003086_.tmp.dll
c:\windows\system32\_003087_.tmp.dll
c:\windows\system32\_003088_.tmp.dll
c:\windows\system32\_003091_.tmp.dll
c:\windows\system32\_003092_.tmp.dll
c:\windows\system32\_003093_.tmp.dll
c:\windows\system32\_003094_.tmp.dll
c:\windows\system32\_003095_.tmp.dll
c:\windows\system32\_003100_.tmp.dll
c:\windows\system32\_003102_.tmp.dll
c:\windows\system32\_003103_.tmp.dll
c:\windows\system32\TDSSmtvd.dat
c:\windows\system32\x64

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_TDSSSERV.SYS
——-\Service_TDSSserv.sys

((((((((((((((((((((((((( Files Created from 2009-03-17 to 2009-04-17 )))))))))))))))))))))))))))))))
.

2009-04-10 17:18 . 2009-04-10 17:18 ——– d—–w c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-04-04 16:11 . 2009-04-04 16:11 ——– d—–w c:\documents and settings\Brian Tompson\Local Settings\Application Data\Mozilla
2009-03-25 19:36 . 2009-03-25 19:36 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\Malwarebytes
2009-03-25 19:36 . 2009-02-11 15:19 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-03-25 19:36 . 2009-02-11 15:19 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-25 19:36 . 2009-03-25 19:36 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-17 02:50 . 2007-02-13 19:45 70824 —-a-w c:\windows\system32\PDoor.dat
2009-04-17 02:50 . 2006-11-13 15:04 16655 —-a-w c:\windows\system32\drivers\PDoor.sys
2009-04-15 22:15 . 2009-04-15 22:15 ——– d—–w c:\program files\Trend Micro
2009-04-12 17:06 . 2007-01-12 21:52 2672 –sha-w c:\windows\system32\KGyGaAvL.sys
2009-04-12 17:06 . 2007-01-12 21:52 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\Corel
2009-04-10 17:37 . 2007-01-10 07:25 ——– d—–w c:\program files\Google
2009-04-09 18:29 . 2007-01-13 03:26 ——– d—–w c:\program files\Warcraft III
2009-04-08 18:04 . 2007-01-12 18:40 66680 —-a-w c:\documents and settings\Brian Tompson\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-07 05:06 . 2008-07-21 04:51 77550 —-a-w c:\windows\War3Unin.dat
2009-03-31 12:43 . 2008-08-31 18:29 ——– d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-30 23:06 . 2007-01-12 22:35 ——– d—–w c:\program files\World of Warcraft
2009-03-25 21:44 . 2009-02-22 22:25 936288 —-a-w c:\windows\system32\Incinerator.dll
2009-03-25 19:39 . 2007-02-22 18:44 ——– d—–w c:\program files\Spybot - Search & Destroy
2009-03-25 19:39 . 2007-02-22 18:44 ——– d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-25 19:38 . 2009-03-25 19:37 ——– d—–w c:\program files\SpywareBlaster
2009-03-25 19:36 . 2009-03-25 19:36 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-03-14 04:11 . 2009-03-13 02:43 ——– d—–w c:\program files\Spyware Doctor
2009-03-14 04:11 . 2009-03-14 04:11 ——– d—–w c:\documents and settings\Administrator\Application Data\PC Tools
2009-03-13 02:43 . 2009-03-13 02:43 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\PC Tools
2009-02-25 22:27 . 2004-08-10 19:03 77859 —-a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-02-25 22:19 . 2004-08-10 18:51 250048 –sha-r C:\ntldr
2009-02-23 12:28 . 2009-02-22 21:49 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\iolo
2009-02-22 22:29 . 2009-02-22 21:49 ——– d—–w c:\documents and settings\All Users\Application Data\iolo
2009-02-22 22:27 . 2007-01-10 07:22 ——– d—–w c:\documents and settings\All Users\Application Data\Symantec
2009-02-22 22:27 . 2007-01-10 07:22 ——– d—–w c:\program files\Common Files\Symantec Shared
2009-02-22 22:25 . 2009-02-22 22:25 ——– d—–w c:\documents and settings\LocalService\Application Data\iolo
2009-02-22 22:25 . 2009-02-22 22:25 ——– d—–w c:\program files\Common Files\Authentium
2009-02-22 22:25 . 2009-02-22 22:25 ——– d—–w c:\program files\iolo
2009-02-22 22:01 . 2007-01-10 07:22 ——– d—–w c:\program files\Symantec
2009-02-22 21:51 . 2009-02-22 21:51 74703 —-a-w c:\windows\system32\mfc45.dll
2009-02-22 21:48 . 2009-02-11 18:27 ——– d—–w c:\documents and settings\All Users\Application Data\McAfee
2009-02-22 21:44 . 2009-02-22 21:44 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\SiteAdvisor
2009-02-21 16:13 . 2008-10-23 10:21 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\SPORE
2009-02-17 16:31 . 2009-02-22 22:25 28672 —-a-w c:\windows\system32\iolobtdfg.exe
2009-02-17 16:26 . 2009-02-22 22:25 8192 —-a-w c:\windows\system32\smrgdf.exe
2009-01-17 03:35 . 2006-07-28 10:28 3594752 —-a-w c:\windows\system32\dllcache\mshtml.dll
2008-10-30 15:56 . 2008-10-30 15:56 17353 —-a-w c:\documents and settings\All Users\Application Data\wolyroci.exe
2008-10-30 15:56 . 2008-10-30 15:56 15747 —-a-w c:\program files\Common Files\tugityho.sys
2008-10-30 15:56 . 2008-10-30 15:56 14486 —-a-w c:\documents and settings\All Users\Application Data\anyramubiz.dat
2008-10-30 15:56 . 2008-10-30 15:56 13020 —-a-w c:\program files\Common Files\ekyxexo.scr
2008-10-30 15:56 . 2008-10-30 15:56 12119 —-a-w c:\documents and settings\All Users\Application Data\etena.scr
2008-10-30 15:56 . 2008-10-30 15:56 10387 —-a-w c:\program files\Common Files\oqazodi.db
2008-10-28 01:02 . 2007-05-18 01:55 5760 —-a-w c:\documents and settings\Brian Tompson\Application Data\wklnhst.dat
2007-01-15 22:10 . 2007-01-15 22:10 136 —-a-w c:\documents and settings\Brian Tompson\Local Settings\Application Data\fusioncache.dat
2007-01-10 07:33 . 2009-03-14 04:08 65584 —-a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

——- Sigcheck ——-

[-] 2005-03-02 18:19 577024 1800F293BCCC8EDE8A70E12B88D80036 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2007-03-08 15:48 578048 7AA4F6C00405DFC4B70ED4214E7D687B c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\$NtServicePackUninstall$\user32.dll
[7] 2004-08-04 11:00 577024 C72661F8552ACE7C5C85E16A3CF505C4 c:\windows\$NtUninstallKB890859$\user32.dll
[-] 2005-03-02 18:09 577024 DE2DB164BBB35DB061AF0997E4499054 c:\windows\$NtUninstallKB925902$\user32.dll
[7] 2008-04-14 00:12 578560 B26B135FF1B9F60C9388B4A7D16F600B c:\windows\ServicePackFiles\i386\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\system32\user32.dll

[-] 2007-06-13 10:23 1033216 97BD6515465659FF8F3B7BE375B2EA87 c:\windows\explorer.exe
[-] 2007-06-13 11:26 1033216 7712DF0CDDE3A5AC89843E61CD5B3658 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2007-06-13 10:23 1033216 97BD6515465659FF8F3B7BE375B2EA87 c:\windows\$NtServicePackUninstall$\explorer.exe
[7] 2004-08-04 11:00 1032192 A0732187050030AE399B241436565E64 c:\windows\$NtUninstallKB938828$\explorer.exe
[7] 2008-04-14 00:12 1033728 12896823FB95BFB3DC9B46BCAEDC9923 c:\windows\ServicePackFiles\i386\explorer.exe

[-] 2005-06-11 00:17 57856 AD3D9D191AEA7B5445FE1D82FFBB4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\$NtServicePackUninstall$\spoolsv.exe
[7] 2008-04-14 00:12 57856 D8E14A61ACC1D4A6CD0D38AEBAC7FA3B c:\windows\ServicePackFiles\i386\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\system32\spoolsv.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"= "c:\windows\system32\ieframe.dll" [2008-12-20 6066688]

[HKEY_CLASSES_ROOT\clsid\{cfbfae00-17a6-11d0-99cb-00c04fd64497}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
2006-12-08 12:11 98304 —-a-w c:\program files\BAE\BAE.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2006-08-29 395776]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"CurseClient"="c:\program files\Curse\CurseClient.exe" [2008-10-10 4789760]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-02-06 3325952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-07-21 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-07-21 86016]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-07-21 81920]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"Corel Photo Downloader"="c:\program files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe" [2006-08-14 462336]
"Lexmark X1100 Series"="c:\program files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 57344]
"Password Door Loader"="c:\progra~1\PASSWO~1\tlpd.exe" [2006-11-13 30208]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-10 16384]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-26 185896]
"iolo AntiVirus"="c:\program files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe" [2008-12-16 1106784]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-07-24 282624]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WebCheck"= {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - c:\windows\system32\webcheck.dll [2008-12-20 233472]
"WPDShServiceObj"= {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll [2006-10-19 133632]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Empire at War Forces of Corruption\\swfoc.exe"=
"c:\\Program Files\\Curse\\CurseClient.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\iolo\\System Mechanic Professional\\AntiVirus\\ioloAV.exe"=
"c:\\Program Files\\iolo\\System Mechanic Professional\\AntiVirus\\iAVEmailScanner.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader
"6112:TCP"= 6112:TCP:Blizzard Downloader

R0 uiddthnw;uiddthnw; [x]
R3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-06-13 356920]
S1 PasswordDoor;PasswordDoor;c:\windows\system32\drivers\PDoor.sys [2009-04-17 16655]
S2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2009-02-06 712048]
S2 ioloSystemService;iolo System Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2009-02-06 712048]

— Other Services/Drivers In Memory —

*Deregistered* - mchInjDrv
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{C4069E3A-68F1-403E-B40E-20066696354B} - (no file)
SSODL-CDBurn-{fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: {{e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\Messenger\msmsgs.exe
IE: {{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
LSP: c:\windows\system32\iavlsp.dll
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - c:\windows\system32\itss.dll
Handler: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - c:\windows\system32\itss.dll
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - c:\windows\system32\msvidctl.dll
Name-Space Handler: mk\* - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - c:\windows\system32\itss.dll
FF - ProfilePath - c:\documents and settings\Brian Tompson\Application Data\Mozilla\Firefox\Profiles\5v56vu61.default\
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.
.
——- File Associations ——-
.
JSEFile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-16 21:52
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Password Door Loader = c:\progra~1\PASSWO~1\tlpd.exe??????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1022652870-2597154559-1221656813-1007\Software\SecuROM\License information*]
"datasecu"=hex:01,78,5b,1d,98,f7,57,ce,a5,e5,bb,43,7c,78,a5,df,b1,cf,47,97,0c,
c9,c5,8c,5f,f4,4d,7f,e7,c4,e4,10,75,f5,16,4a,9c,d5,f3,9b,04,80,d7,0d,36,dd,\
"rkeysecu"=hex:3e,80,9e,c4,40,b4,90,83,87,8e,33,49,64,ac,f8,d9
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(764)
c:\windows\system32\iavlsp.dll

- - - - - - - > 'explorer.exe'(2356)
c:\windows\system32\tlpd.dll
c:\windows\system32\wpdshext.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\Audiodev.dll
c:\windows\system32\WMVCore.DLL
c:\windows\system32\WMASF.DLL
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Lexmark X1100 Series\lxbkbmon.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Common Files\Authentium\AntiVirus\dvpapi.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-04-17 21:55 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-17 02:55

Pre-Run: 104,420,102,144 bytes free
Post-Run: 104,313,446,400 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

292 — E O F — 2009-04-15 21:01

CatByte

Post #4April 17, 2009, 5:01 AM UTC

Hi,

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

KillAll::

File::
c:\documents and settings\All Users\Application Data\wolyroci.exe
c:\program files\Common Files\tugityho.sys
c:\documents and settings\All Users\Application Data\anyramubiz.dat
c:\program files\Common Files\ekyxexo.scr
c:\documents and settings\All Users\Application Data\etena.scr
c:\program files\Common Files\oqazodi.db

Driver::
uiddthnw

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

* Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
* ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
* When finished, it shall produce a log for you.
* Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NOTE: CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

NEXT

Please download the GMER Rootkit Scanner. Unzip it to your Desktop.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
Double-click gmer.exe. The program will begin to run.
**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!
If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
In the right panel, you will see a number of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

Include in your next reply

ComboFix log
Gmer Log

comet101

Post #5April 18, 2009, 11:43 PM UTC

ComboFix:

ComboFix 09-04-18.01 - Brian Tompson 04/17/2009 18:29.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3062.2481 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: iolo AntiVirus® *On-access scanning disabled* (Updated)
FW: Norton Internet Worm Protection *disabled*
.

((((((((((((((((((((((((( Files Created from 2009-03-18 to 2009-04-18 )))))))))))))))))))))))))))))))
.

2009-04-10 17:18 . 2009-04-10 17:18 ——– d—–w c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-04-04 16:11 . 2009-04-04 16:11 ——– d—–w c:\documents and settings\Brian Tompson\Local Settings\Application Data\Mozilla
2009-03-25 19:36 . 2009-03-25 19:36 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\Malwarebytes
2009-03-25 19:36 . 2009-02-11 15:19 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-03-25 19:36 . 2009-02-11 15:19 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-25 19:36 . 2009-03-25 19:36 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-17 22:58 . 2007-02-13 19:45 70824 —-a-w c:\windows\system32\PDoor.dat
2009-04-17 22:58 . 2006-11-13 15:04 16655 —-a-w c:\windows\system32\drivers\PDoor.sys
2009-04-15 22:15 . 2009-04-15 22:15 ——– d—–w c:\program files\Trend Micro
2009-04-12 17:06 . 2007-01-12 21:52 2672 –sha-w c:\windows\system32\KGyGaAvL.sys
2009-04-12 17:06 . 2007-01-12 21:52 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\Corel
2009-04-10 17:37 . 2007-01-10 07:25 ——– d—–w c:\program files\Google
2009-04-09 18:29 . 2007-01-13 03:26 ——– d—–w c:\program files\Warcraft III
2009-04-08 18:04 . 2007-01-12 18:40 66680 —-a-w c:\documents and settings\Brian Tompson\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-07 05:06 . 2008-07-21 04:51 77550 —-a-w c:\windows\War3Unin.dat
2009-03-31 12:43 . 2008-08-31 18:29 ——– d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-30 23:06 . 2007-01-12 22:35 ——– d—–w c:\program files\World of Warcraft
2009-03-25 21:44 . 2009-02-22 22:25 936288 —-a-w c:\windows\system32\Incinerator.dll
2009-03-25 19:39 . 2007-02-22 18:44 ——– d—–w c:\program files\Spybot - Search & Destroy
2009-03-25 19:39 . 2007-02-22 18:44 ——– d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-25 19:38 . 2009-03-25 19:37 ——– d—–w c:\program files\SpywareBlaster
2009-03-25 19:36 . 2009-03-25 19:36 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-03-14 04:11 . 2009-03-13 02:43 ——– d—–w c:\program files\Spyware Doctor
2009-03-14 04:11 . 2009-03-14 04:11 ——– d—–w c:\documents and settings\Administrator\Application Data\PC Tools
2009-03-13 02:43 . 2009-03-13 02:43 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\PC Tools
2009-02-25 22:27 . 2004-08-10 19:03 77859 —-a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-02-25 22:19 . 2004-08-10 18:51 250048 –sha-r C:\ntldr
2009-02-23 12:28 . 2009-02-22 21:49 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\iolo
2009-02-22 22:29 . 2009-02-22 21:49 ——– d—–w c:\documents and settings\All Users\Application Data\iolo
2009-02-22 22:27 . 2007-01-10 07:22 ——– d—–w c:\documents and settings\All Users\Application Data\Symantec
2009-02-22 22:27 . 2007-01-10 07:22 ——– d—–w c:\program files\Common Files\Symantec Shared
2009-02-22 22:25 . 2009-02-22 22:25 ——– d—–w c:\documents and settings\LocalService\Application Data\iolo
2009-02-22 22:25 . 2009-02-22 22:25 ——– d—–w c:\program files\Common Files\Authentium
2009-02-22 22:25 . 2009-02-22 22:25 ——– d—–w c:\program files\iolo
2009-02-22 22:01 . 2007-01-10 07:22 ——– d—–w c:\program files\Symantec
2009-02-22 21:51 . 2009-02-22 21:51 74703 —-a-w c:\windows\system32\mfc45.dll
2009-02-22 21:48 . 2009-02-11 18:27 ——– d—–w c:\documents and settings\All Users\Application Data\McAfee
2009-02-22 21:44 . 2009-02-22 21:44 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\SiteAdvisor
2009-02-21 16:13 . 2008-10-23 10:21 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\SPORE
2009-02-17 16:31 . 2009-02-22 22:25 28672 —-a-w c:\windows\system32\iolobtdfg.exe
2009-02-17 16:26 . 2009-02-22 22:25 8192 —-a-w c:\windows\system32\smrgdf.exe
2008-10-28 01:02 . 2007-05-18 01:55 5760 —-a-w c:\documents and settings\Brian Tompson\Application Data\wklnhst.dat
2007-01-15 22:10 . 2007-01-15 22:10 136 —-a-w c:\documents and settings\Brian Tompson\Local Settings\Application Data\fusioncache.dat
2007-01-10 07:33 . 2009-03-14 04:08 65584 —-a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

——- Sigcheck ——-

[-] 2005-03-02 18:19 577024 1800F293BCCC8EDE8A70E12B88D80036 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2007-03-08 15:48 578048 7AA4F6C00405DFC4B70ED4214E7D687B c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\$NtServicePackUninstall$\user32.dll
[7] 2004-08-04 11:00 577024 C72661F8552ACE7C5C85E16A3CF505C4 c:\windows\$NtUninstallKB890859$\user32.dll
[-] 2005-03-02 18:09 577024 DE2DB164BBB35DB061AF0997E4499054 c:\windows\$NtUninstallKB925902$\user32.dll
[7] 2008-04-14 00:12 578560 B26B135FF1B9F60C9388B4A7D16F600B c:\windows\ServicePackFiles\i386\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\system32\user32.dll

[-] 2007-06-13 10:23 1033216 97BD6515465659FF8F3B7BE375B2EA87 c:\windows\explorer.exe
[-] 2007-06-13 11:26 1033216 7712DF0CDDE3A5AC89843E61CD5B3658 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2007-06-13 10:23 1033216 97BD6515465659FF8F3B7BE375B2EA87 c:\windows\$NtServicePackUninstall$\explorer.exe
[7] 2004-08-04 11:00 1032192 A0732187050030AE399B241436565E64 c:\windows\$NtUninstallKB938828$\explorer.exe
[7] 2008-04-14 00:12 1033728 12896823FB95BFB3DC9B46BCAEDC9923 c:\windows\ServicePackFiles\i386\explorer.exe

[-] 2005-06-11 00:17 57856 AD3D9D191AEA7B5445FE1D82FFBB4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\$NtServicePackUninstall$\spoolsv.exe
[7] 2008-04-14 00:12 57856 D8E14A61ACC1D4A6CD0D38AEBAC7FA3B c:\windows\ServicePackFiles\i386\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\system32\spoolsv.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"= "c:\windows\system32\ieframe.dll" [2008-12-20 6066688]

[HKEY_CLASSES_ROOT\clsid\{cfbfae00-17a6-11d0-99cb-00c04fd64497}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-09-25 07:11 501136 —-a-w c:\program files\Java\jre1.6.0_03\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
2007-09-20 15:30 328752 —-a-w c:\program files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
2006-12-08 12:11 98304 —-a-w c:\program files\BAE\BAE.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2006-08-29 395776]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"CurseClient"="c:\program files\Curse\CurseClient.exe" [2008-10-10 4789760]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-02-06 3325952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-07-21 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-07-21 86016]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-07-21 81920]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"Corel Photo Downloader"="c:\program files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe" [2006-08-14 462336]
"Lexmark X1100 Series"="c:\program files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 57344]
"Password Door Loader"="c:\progra~1\PASSWO~1\tlpd.exe" [2006-11-13 30208]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-10 16384]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-26 185896]
"iolo AntiVirus"="c:\program files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe" [2008-12-16 1106784]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-07-24 282624]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WebCheck"= {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - c:\windows\system32\webcheck.dll [2008-12-20 233472]
"WPDShServiceObj"= {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll [2006-10-19 133632]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Empire at War Forces of Corruption\\swfoc.exe"=
"c:\\Program Files\\Curse\\CurseClient.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\iolo\\System Mechanic Professional\\AntiVirus\\ioloAV.exe"=
"c:\\Program Files\\iolo\\System Mechanic Professional\\AntiVirus\\iAVEmailScanner.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader
"6112:TCP"= 6112:TCP:Blizzard Downloader

R3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-06-13 356920]
S1 PasswordDoor;PasswordDoor;c:\windows\system32\drivers\PDoor.sys [2009-04-17 16655]
S2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2009-02-06 712048]
S2 ioloSystemService;iolo System Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2009-02-06 712048]

— Other Services/Drivers In Memory —

*Deregistered* - mchInjDrv
.
- - - - ORPHANS REMOVED - - - -

BHO-{7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
SharedTaskScheduler-{8C7461EF-2B13-11d2-BE35-3078302C2030} - %SystemRoot%\system32\browseui.dll
SSODL-PostBootReminder-{7849596a-48ea-486e-8937-a2a3009f31a9} - %SystemRoot%\system32\SHELL32.dll

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: {{e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\Messenger\msmsgs.exe
IE: {{92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\MI1933~1\OFFICE11\REFIEBAR.DLL
IE: {{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
LSP: c:\windows\system32\iavlsp.dll
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - c:\windows\system32\urlmon.dll
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - c:\windows\system32\urlmon.dll
Filter: lzdhtml - {8f6b0360-b80d-11d0-a9b3-006097942311} - c:\windows\system32\urlmon.dll
Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} -
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
Handler: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - c:\windows\system32\itss.dll
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - c:\progra~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
Handler: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - c:\windows\system32\itss.dll
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - c:\progra~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
Handler: sysimage - {76E67A63-06E9-11D2-A840-006008059382} -
Handler: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - c:\windows\system32\msvidctl.dll
Name-Space Handler: mk\* - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - c:\windows\system32\itss.dll
FF - ProfilePath - c:\documents and settings\Brian Tompson\Application Data\Mozilla\Firefox\Profiles\5v56vu61.default\
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.
.
——- File Associations ——-
.
JSEFile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-17 18:31
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Password Door Loader = c:\progra~1\PASSWO~1\tlpd.exe??????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1022652870-2597154559-1221656813-1007\Software\SecuROM\License information*]
"datasecu"=hex:01,78,5b,1d,98,f7,57,ce,a5,e5,bb,43,7c,78,a5,df,b1,cf,47,97,0c,
c9,c5,8c,5f,f4,4d,7f,e7,c4,e4,10,75,f5,16,4a,9c,d5,f3,9b,04,80,d7,0d,36,dd,\
"rkeysecu"=hex:3e,80,9e,c4,40,b4,90,83,87,8e,33,49,64,ac,f8,d9
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(764)
c:\windows\system32\iavlsp.dll

- - - - - - - > 'explorer.exe'(2436)
c:\windows\system32\tlpd.dll
c:\windows\system32\wpdshext.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\Audiodev.dll
c:\windows\system32\WMVCore.DLL
c:\windows\system32\WMASF.DLL
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
.
Completion time: 2009-04-17 18:33
ComboFix-quarantined-files.txt 2009-04-17 23:32
ComboFix2.txt 2009-04-17 23:03
ComboFix3.txt 2009-04-17 02:55

Pre-Run: 104,274,366,464 bytes free
Post-Run: 104,263,061,504 bytes free

230 — E O F — 2009-04-17 21:02

GMER:

GMER 1.0.15.14966 - http://www.gmer.net
Rootkit scan 2009-04-18 18:41:35
Windows 5.1.2600 Service Pack 3

—- System - GMER 1.0.15 —-

Code 89887D28 ZwDuplicateObject
Code 896E9940 ZwSetInformationFile
Code 897B15B0 ZwSetSystemInformation
Code 89874EE8 ZwWriteFile
Code \??\C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\catchme.sys pIofCallDriver
Code 89887D27 NtDuplicateObject
Code 896E993F NtSetInformationFile
Code 89874EE7 NtWriteFile

—- Kernel code sections - GMER 1.0.15 —-

PAGE ntkrnlpa.exe!IoGetBootDiskInformation + 66F 80576917 7 Bytes JMP 8978C544
PAGE ntkrnlpa.exe!NtSetInformationFile 8057B010 7 Bytes JMP 896E9944
PAGE ntkrnlpa.exe!NtWriteFile 8057CEF2 7 Bytes JMP 89874EEC
PAGE ntkrnlpa.exe!ObCloseHandle + 17 805BC4F3 7 Bytes JMP 89814784
PAGE ntkrnlpa.exe!NtDuplicateObject 805BDFD0 7 Bytes JMP 89887D2C
PAGE ntkrnlpa.exe!ZwSetSystemInformation 8060F3C6 5 Bytes JMP 897B15B4
PAGE Fastfat.SYS 9D36C9C8 7 Bytes JMP 89880D2C
? C:\WINDOWS\system32\Drivers\mchInjDrv.sys The system cannot find the file specified. !
? C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\catchme.sys The system cannot find the file specified. !
? C:\WINDOWS\system32\Drivers\PROCEXP90.SYS The system cannot find the file specified. !

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\system32\hkcmd.exe[376] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\hkcmd.exe[376] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\hkcmd.exe[376] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\hkcmd.exe[376] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\hkcmd.exe[376] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\hkcmd.exe[376] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\hkcmd.exe[376] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\hkcmd.exe[376] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\hkcmd.exe[376] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\hkcmd.exe[376] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\hkcmd.exe[376] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 011C0001
.text C:\WINDOWS\system32\igfxpers.exe[568] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\igfxpers.exe[568] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\igfxpers.exe[568] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\igfxpers.exe[568] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\igfxpers.exe[568] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\igfxpers.exe[568] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\igfxpers.exe[568] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\igfxpers.exe[568] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\igfxpers.exe[568] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\igfxpers.exe[568] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\igfxpers.exe[568] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01270001
.text C:\WINDOWS\stsystra.exe[628] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[628] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\stsystra.exe[628] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[628] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\stsystra.exe[628] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[628] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\stsystra.exe[628] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[628] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\stsystra.exe[628] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[628] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\stsystra.exe[628] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01770001
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\csrss.exe[684] KERNEL32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01660001
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[688] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[688] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[688] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[688] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[688] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[688] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[688] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[688] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[688] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[688] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[688] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00C30001
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\winlogon.exe[708] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01330001
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\services.exe[752] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00D50001
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\lsass.exe[764] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00BC0001
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[768] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[768] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[768] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[768] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[768] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[768] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[768] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[768] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[768] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[768] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[768] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00FF0001
.text C:\WINDOWS\system32\svchost.exe[920] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[920] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\svchost.exe[920] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[920] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\svchost.exe[920] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[920] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\svchost.exe[920] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[920] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\svchost.exe[920] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[920] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\svchost.exe[920] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00DE0001
.text C:\WINDOWS\system32\svchost.exe[1000] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1000] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\svchost.exe[1000] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1000] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\svchost.exe[1000] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1000] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\svchost.exe[1000] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1000] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\svchost.exe[1000] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1000] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01110001
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1044] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1044] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1044] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1044] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1044] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1044] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1044] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1044] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1044] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1044] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1044] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01230001
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1072] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1072] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1072] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1072] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1072] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1072] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1072] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1072] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1072] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1072] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1072] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 003F0001
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1096] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1096] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1096] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1096] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1096] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1096] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1096] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1096] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1096] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1096] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1096] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 003E0001
.text C:\WINDOWS\System32\svchost.exe[1104] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\svchost.exe[1104] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\System32\svchost.exe[1104] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\svchost.exe[1104] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\System32\svchost.exe[1104] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\svchost.exe[1104] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\System32\svchost.exe[1104] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\svchost.exe[1104] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\System32\svchost.exe[1104] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\svchost.exe[1104] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\System32\svchost.exe[1104] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 020D0001
.text C:\WINDOWS\system32\svchost.exe[1148] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1148] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\svchost.exe[1148] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1148] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\svchost.exe[1148] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1148] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\svchost.exe[1148] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1148] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\svchost.exe[1148] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1148] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\svchost.exe[1148] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00640001
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1156] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1156] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1156] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1156] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1156] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1156] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1156] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1156] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1156] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1156] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1156] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 04790001
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1212] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1212] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1212] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1212] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1212] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1212] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1212] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1212] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1212] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1212] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1212] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 012E0001
.text C:\WINDOWS\system32\svchost.exe[1236] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1236] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\svchost.exe[1236] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1236] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\svchost.exe[1236] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1236] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\svchost.exe[1236] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1236] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\svchost.exe[1236] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1236] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00C10001
.text C:\Program Files\Dell Support\DSAgnt.exe[1268] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support\DSAgnt.exe[1268] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Dell Support\DSAgnt.exe[1268] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support\DSAgnt.exe[1268] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Dell Support\DSAgnt.exe[1268] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support\DSAgnt.exe[1268] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Dell Support\DSAgnt.exe[1268] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support\DSAgnt.exe[1268] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Dell Support\DSAgnt.exe[1268] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support\DSAgnt.exe[1268] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Dell Support\DSAgnt.exe[1268] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01A40001
.text C:\WINDOWS\system32\ctfmon.exe[1292] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\ctfmon.exe[1292] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\ctfmon.exe[1292] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\ctfmon.exe[1292] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\ctfmon.exe[1292] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\ctfmon.exe[1292] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\ctfmon.exe[1292] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\ctfmon.exe[1292] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\ctfmon.exe[1292] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\ctfmon.exe[1292] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\ctfmon.exe[1292] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00C20001
.text C:\WINDOWS\system32\svchost.exe[1348] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1348] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\svchost.exe[1348] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1348] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\svchost.exe[1348] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1348] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\svchost.exe[1348] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1348] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\svchost.exe[1348] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1348] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\svchost.exe[1348] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 009E0001
.text C:\WINDOWS\system32\LEXBCES.EXE[1536] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXBCES.EXE[1536] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\LEXBCES.EXE[1536] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXBCES.EXE[1536] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\LEXBCES.EXE[1536] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXBCES.EXE[1536] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\LEXBCES.EXE[1536] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXBCES.EXE[1536] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\LEXBCES.EXE[1536] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXBCES.EXE[1536] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\LEXBCES.EXE[1536] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01160001
.text C:\WINDOWS\system32\spoolsv.exe[1584] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\spoolsv.exe[1584] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\spoolsv.exe[1584] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\spoolsv.exe[1584] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\spoolsv.exe[1584] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\spoolsv.exe[1584] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\spoolsv.exe[1584] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\spoolsv.exe[1584] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\spoolsv.exe[1584] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\spoolsv.exe[1584] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\spoolsv.exe[1584] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00C00001
.text C:\WINDOWS\system32\LEXPPS.EXE[1616] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXPPS.EXE[1616] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\LEXPPS.EXE[1616] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXPPS.EXE[1616] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\LEXPPS.EXE[1616] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXPPS.EXE[1616] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\LEXPPS.EXE[1616] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXPPS.EXE[1616] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\LEXPPS.EXE[1616] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXPPS.EXE[1616] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\LEXPPS.EXE[1616] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 008F0001
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1932] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1932] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1932] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1932] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1932] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1932] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1932] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1932] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1932] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1932] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1932] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01000001
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[1976] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[1976] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[1976] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[1976] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[1976] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[1976] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[1976] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[1976] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[1976] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[1976] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[1976] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00DC0001
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2072] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2072] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2072] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2072] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2072] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2072] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2072] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2072] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2072] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2072] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2072] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00A90001
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2108] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2108] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2108] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2108] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2108] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2108] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2108] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2108] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2108] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2108] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2108] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 02B50001
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00DF0001
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00900001
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\WINDOWS\explorer.exe[2436] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\explorer.exe[2436] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\explorer.exe[2436] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\explorer.exe[2436] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\explorer.exe[2436] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\explorer.exe[2436] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\explorer.exe[2436] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\explorer.exe[2436] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\explorer.exe[2436] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\explorer.exe[2436] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\explorer.exe[2436] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00C80001
.text C:\WINDOWS\explorer.exe[2436] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2684] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2684] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2684] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2684] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2684] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2684] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2684] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2684] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2684] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2684] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2684] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00AA0001
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2684] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\WINDOWS\system32\svchost.exe[2788] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[2788] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\svchost.exe[2788] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[2788] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\svchost.exe[2788] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[2788] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\svchost.exe[2788] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[2788] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\svchost.exe[2788] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[2788] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\svchost.exe[2788] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00770001
.text C:\WINDOWS\system32\svchost.exe[2788] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2812] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2812] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2812] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2812] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2812] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2812] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2812] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2812] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2812] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2812] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2812] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 003C0001
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2812] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 2 for gmer.zip\gmer.exe[2968] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 2 for gmer.zip\gmer.exe[2968] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 2 for gmer.zip\gmer.exe[2968] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 2 for gmer.zip\gmer.exe[2968] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 2 for gmer.zip\gmer.exe[2968] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 2 for gmer.zip\gmer.exe[2968] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 2 for gmer.zip\gmer.exe[2968] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 2 for gmer.zip\gmer.exe[2968] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 2 for gmer.zip\gmer.exe[2968] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 2 for gmer.zip\gmer.exe[2968] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 2 for gmer.zip\gmer.exe[2968] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 003C0001
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 2 for gmer.zip\gmer.exe[2968] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\WINDOWS\system32\wscntfy.exe[3032] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wscntfy.exe[3032] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\wscntfy.exe[3032] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wscntfy.exe[3032] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\wscntfy.exe[3032] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wscntfy.exe[3032] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\wscntfy.exe[3032] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wscntfy.exe[3032] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\wscntfy.exe[3032] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wscntfy.exe[3032] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\wscntfy.exe[3032] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00970001
.text C:\WINDOWS\system32\wscntfy.exe[3032] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\WINDOWS\system32\wuauclt.exe[3260] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wuauclt.exe[3260] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\wuauclt.exe[3260] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wuauclt.exe[3260] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\wuauclt.exe[3260] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wuauclt.exe[3260] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\wuauclt.exe[3260] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wuauclt.exe[3260] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\wuauclt.exe[3260] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wuauclt.exe[3260] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\wuauclt.exe[3260] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 009F0001
.text C:\WINDOWS\system32\wuauclt.exe[3260] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[3288] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[3288] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[3288] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[3288] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[3288] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[3288] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[3288] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[3288] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[3288] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[3288] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[3288] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00BC0001
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[3288] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\Program Files\Mozilla Firefox\firefox.exe[3304] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Mozilla Firefox\firefox.exe[3304] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Mozilla Firefox\firefox.exe[3304] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Mozilla Firefox\firefox.exe[3304] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Mozilla Firefox\firefox.exe[3304] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Mozilla Firefox\firefox.exe[3304] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Mozilla Firefox\firefox.exe[3304] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Mozilla Firefox\firefox.exe[3304] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Mozilla Firefox\firefox.exe[3304] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Mozilla Firefox\firefox.exe[3304] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Mozilla Firefox\firefox.exe[3304] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00B30001
.text C:\Program Files\Mozilla Firefox\firefox.exe[3304] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\WINDOWS\system32\wuauclt.exe[3404] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wuauclt.exe[3404] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\wuauclt.exe[3404] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wuauclt.exe[3404] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\wuauclt.exe[3404] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wuauclt.exe[3404] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\wuauclt.exe[3404] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wuauclt.exe[3404] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\wuauclt.exe[3404] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wuauclt.exe[3404] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\wuauclt.exe[3404] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00770001
.text C:\WINDOWS\system32\wuauclt.exe[3404] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\WINDOWS\System32\alg.exe[4016] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\alg.exe[4016] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\System32\alg.exe[4016] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\alg.exe[4016] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\System32\alg.exe[4016] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\alg.exe[4016] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\System32\alg.exe[4016] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\alg.exe[4016] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\System32\alg.exe[4016] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\alg.exe[4016] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\System32\alg.exe[4016] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 006D0001
.text C:\WINDOWS\System32\alg.exe[4016] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Fastfat \FatCdrom Code 89880D28
Device \FileSystem\Fastfat \Fat Code 89880D28

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 2
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 7
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 35
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 7
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\Services\MRxDAV\EncryptedDirectories@
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys@imagepath \systemroot\system32\drivers\TDSSmqlt.sys
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@TDSSserv \systemroot\system32\drivers\TDSSmqlt.sys
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@TDSSl \systemroot\system32\TDSSoiqt.dll
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdssservers \systemroot\system32\TDSSmtvd.dat
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdssmain \systemroot\system32\TDSShrxm.dll
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdsslog \systemroot\system32\TDSSmtql.dll
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdssadw \systemroot\system32\TDSSxfum.dll
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdssinit \systemroot\system32\TDSSlxwp.dll
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdssurls \systemroot\system32\TDSSnmxh.log
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdsspanels \systemroot\system32\TDSSsahc.dll
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdsserrors \systemroot\system32\TDSSrhyp.log
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@TDSSproc \systemroot\system32\TDSSkkai.log

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl (size mismatch) 8192/4096 bytes

—- EOF - GMER 1.0.15 —-

CatByte

Post #6April 19, 2009, 12:00 AM UTC

Hi

Please do the following:

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

>>>NEXT<<<

Go to Kaspersky website and perform an online antivirus scan. (Use Internet Explorer for this scan)

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

In your next reply please include

MBAM Log
Kaspersky report
Fresh HJT log

comet101

Post #7April 19, 2009, 5:46 PM UTC

Malwarebytes' Anti-Malware 1.36
Database version: 2009
Windows 5.1.2600 Service Pack 3

4/19/2009 10:44:31 AM
mbam-log-2009-04-19 (10-44-31).txt

Scan type: Quick Scan
Objects scanned: 74224
Time elapsed: 1 minute(s), 48 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CLASSES_ROOT\scrfile\shell\open\command\ (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ("%1" /S) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\regfile\shell\open\command\ (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0 REPORT
Sunday, April 19, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Sunday, April 19, 2009 18:04:00
Records in database: 2060871
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Files scanned: 64148
Threat name: 1
Infected objects: 1
Suspicious objects: 0
Duration of the scan: 00:55:28

File name / Threat name / Threats count
C:\Program Files\Dell Support Center\HWDiag\bin\pcd5srvc.pkms Infected: Trojan.Win32.DNSChanger.ojr 1

The selected area was scanned.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:44:08 PM, on 4/19/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\PROGRA~1\PASSWO~1\tlpd.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Electronic Arts\EADM\Core.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\iolo\common\lib\ioloServiceManager.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=5070110
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [Password Door Loader] C:\PROGRA~1\PASSWO~1\tlpd.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iolo AntiVirus] "C:\Program Files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe -silent
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 10031 bytes

CatByte

Post #8April 19, 2009, 6:50 PM UTC

Hi,
Please do the following:

Please download OTMoveIt3 by OldTimer.

Save it to your desktop.
Please click OTMoveIt3 and then click >> run.
Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Services

:Reg

:Files
C:\Program Files\Dell Support Center\HWDiag\bin\pcd5srvc.pkms

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Return to OTMoveIt3, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

>>>NEXT<<<

Open HiJackThis
Click on Do a system scan only
Check the boxes next to ONLY the entries listed below (if still present):

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

Close all windows except Hijackthis and click Fix Checked
Click Yes when prompted
Close HijackThis.

>>>NEXT<<<

Please download JavaRa to your desktop and unzip it to its own folder.

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button.
Download and install the latest Java Runtime Environment (JRE) version for your computer. (version 6, update 13)

Now please post a fresh HJT log and describe any issues that may be remaining on your computer.

comet101

Post #9April 22, 2009, 12:02 AM UTC

Thank you for working so hard! I really appreciate you're guys effort.

while i was doing the last few things you told me to do I got the 'windows installer' pop-up rapid fire like 3 in a row. Since then I have yet see one appear. Which is a good sign…
Here is the information you requested

OTMove:

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Program Files\Dell Support Center\HWDiag\bin\pcd5srvc.pkms moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\etilqs_e0VU3eAspJZnzEYvggsF scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\~DFE390.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\Brian Tompson\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\fb_1760.lck scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Brian Tompson\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v56vu61.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Brian Tompson\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v56vu61.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Brian Tompson\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v56vu61.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Brian Tompson\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v56vu61.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Brian Tompson\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v56vu61.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Brian Tompson\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v56vu61.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04212009_183612

Files moved on Reboot…
File C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\etilqs_e0VU3eAspJZnzEYvggsF not found!
File C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\~DFE390.tmp not found!
File C:\WINDOWS\temp\fb_1760.lck not found!
C:\Documents and Settings\Brian Tompson\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v56vu61.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\Brian Tompson\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v56vu61.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\Brian Tompson\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v56vu61.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\Brian Tompson\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v56vu61.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\Brian Tompson\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v56vu61.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\Brian Tompson\Local Settings\Application Data\Mozilla\Firefox\Profiles\5v56vu61.default\XUL.mfl moved successfully.

HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:59:18 PM, on 4/21/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\iolo\common\lib\ioloServiceManager.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\PROGRA~1\PASSWO~1\tlpd.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Electronic Arts\EADM\Core.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=5070110
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [Password Door Loader] C:\PROGRA~1\PASSWO~1\tlpd.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iolo AntiVirus] "C:\Program Files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe -silent
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iavlsp.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 9858 bytes

CatByte

Post #10April 22, 2009, 12:48 AM UTC

Hi,

Please do the following

I would like you to uninstall the version of Combo Fix that you have and downloading a fresh copy and doing another run with ComboFix as the program has been updated.
I want to make sure we have removed all traces of the rootkit that was indicated.

Please do this:

Follow these steps to uninstall Combofix

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

NEXT:

Download ComboFix from one of these locations:
Link 1
Link 2
Link 3

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please advise.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

comet101

Post #11April 23, 2009, 2:45 AM UTC

I have received the same Windows Installer pop-up since the last update. But it doesn't seem to be occurring as often.
Computer is running at normal speeds, but that really wasn't the issue to begin with.

ComboFix 09-04-22.A23 - Brian Tompson 04/22/2009 6:52.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3062.2340 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: iolo AntiVirus® *On-access scanning disabled* (Updated)
FW: Norton Internet Worm Protection *disabled*
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-03-22 to 2009-04-22 )))))))))))))))))))))))))))))))
.

2009-04-21 23:50 . 2009-04-21 23:58 ——– d—–w c:\documents and settings\Brian Tompson\.SunDownloadManager
2009-04-20 11:21 . 2009-04-20 11:21 ——– d—–w c:\documents and settings\Brian Tompson\Local Settings\Application Data\CCP
2009-04-20 06:34 . 2007-07-19 23:14 3727720 —-a-w c:\windows\system32\d3dx9_35.dll
2009-04-20 02:32 . 2009-04-20 02:32 ——– d—–w c:\documents and settings\All Users\Application Data\CCP
2009-04-10 17:18 . 2009-04-10 17:18 ——– d—–w c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-04-04 16:11 . 2009-04-04 16:11 ——– d—–w c:\documents and settings\Brian Tompson\Local Settings\Application Data\Mozilla
2009-03-25 19:36 . 2009-03-25 19:36 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\Malwarebytes
2009-03-25 19:36 . 2009-04-06 20:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-03-25 19:36 . 2009-04-06 20:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-25 19:36 . 2009-03-25 19:36 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-21 23:57 . 2009-04-21 23:51 16283032 —-a-w c:\program files\jre-6u13-windows-i586-p.exe
2009-04-21 23:38 . 2007-02-13 19:45 70824 —-a-w c:\windows\system32\PDoor.dat
2009-04-21 23:38 . 2006-11-13 15:04 16655 —-a-w c:\windows\system32\drivers\PDoor.sys
2009-04-20 02:32 . 2009-04-20 02:32 ——– d—–w c:\program files\CCP
2009-04-19 15:41 . 2009-03-25 19:36 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-15 22:15 . 2009-04-15 22:15 ——– d—–w c:\program files\Trend Micro
2009-04-12 17:06 . 2007-01-12 21:52 2672 –sha-w c:\windows\system32\KGyGaAvL.sys
2009-04-12 17:06 . 2007-01-12 21:52 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\Corel
2009-04-10 17:37 . 2007-01-10 07:25 ——– d—–w c:\program files\Google
2009-04-09 18:29 . 2007-01-13 03:26 ——– d—–w c:\program files\Warcraft III
2009-04-08 18:04 . 2007-01-12 18:40 66680 —-a-w c:\documents and settings\Brian Tompson\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-07 05:06 . 2008-07-21 04:51 77550 —-a-w c:\windows\War3Unin.dat
2009-03-31 12:43 . 2008-08-31 18:29 ——– d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-30 23:06 . 2007-01-12 22:35 ——– d—–w c:\program files\World of Warcraft
2009-03-25 21:44 . 2009-02-22 22:25 936288 —-a-w c:\windows\system32\Incinerator.dll
2009-03-25 19:39 . 2007-02-22 18:44 ——– d—–w c:\program files\Spybot - Search & Destroy
2009-03-25 19:39 . 2007-02-22 18:44 ——– d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-25 19:38 . 2009-03-25 19:37 ——– d—–w c:\program files\SpywareBlaster
2009-03-14 04:11 . 2009-03-13 02:43 ——– d—–w c:\program files\Spyware Doctor
2009-03-14 04:11 . 2009-03-14 04:11 ——– d—–w c:\documents and settings\Administrator\Application Data\PC Tools
2009-03-13 02:43 . 2009-03-13 02:43 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\PC Tools
2009-02-25 22:27 . 2004-08-10 19:03 77859 —-a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-02-25 22:19 . 2004-08-10 18:51 250048 –sha-r C:\ntldr
2009-02-23 12:28 . 2009-02-22 21:49 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\iolo
2009-02-22 22:29 . 2009-02-22 21:49 ——– d—–w c:\documents and settings\All Users\Application Data\iolo
2009-02-22 22:27 . 2007-01-10 07:22 ——– d—–w c:\documents and settings\All Users\Application Data\Symantec
2009-02-22 22:27 . 2007-01-10 07:22 ——– d—–w c:\program files\Common Files\Symantec Shared
2009-02-22 22:25 . 2009-02-22 22:25 ——– d—–w c:\documents and settings\LocalService\Application Data\iolo
2009-02-22 22:25 . 2009-02-22 22:25 ——– d—–w c:\program files\Common Files\Authentium
2009-02-22 22:25 . 2009-02-22 22:25 ——– d—–w c:\program files\iolo
2009-02-22 22:01 . 2007-01-10 07:22 ——– d—–w c:\program files\Symantec
2009-02-22 21:51 . 2009-02-22 21:51 74703 —-a-w c:\windows\system32\mfc45.dll
2009-02-22 21:48 . 2009-02-11 18:27 ——– d—–w c:\documents and settings\All Users\Application Data\McAfee
2009-02-22 21:44 . 2009-02-22 21:44 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\SiteAdvisor
2009-02-21 16:13 . 2008-10-23 10:21 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\SPORE
2009-02-17 16:31 . 2009-02-22 22:25 28672 —-a-w c:\windows\system32\iolobtdfg.exe
2009-02-17 16:26 . 2009-02-22 22:25 8192 —-a-w c:\windows\system32\smrgdf.exe
2008-10-28 01:02 . 2007-05-18 01:55 5760 —-a-w c:\documents and settings\Brian Tompson\Application Data\wklnhst.dat
2007-01-15 22:10 . 2007-01-15 22:10 136 —-a-w c:\documents and settings\Brian Tompson\Local Settings\Application Data\fusioncache.dat
2007-01-10 07:33 . 2009-03-14 04:08 65584 —-a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

——- Sigcheck ——-

[-] 2005-03-02 18:19 577024 1800F293BCCC8EDE8A70E12B88D80036 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2007-03-08 15:48 578048 7AA4F6C00405DFC4B70ED4214E7D687B c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\$NtServicePackUninstall$\user32.dll
[7] 2004-08-04 11:00 577024 C72661F8552ACE7C5C85E16A3CF505C4 c:\windows\$NtUninstallKB890859$\user32.dll
[-] 2005-03-02 18:09 577024 DE2DB164BBB35DB061AF0997E4499054 c:\windows\$NtUninstallKB925902$\user32.dll
[7] 2008-04-14 00:12 578560 B26B135FF1B9F60C9388B4A7D16F600B c:\windows\ServicePackFiles\i386\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\system32\user32.dll

[-] 2007-06-13 10:23 1033216 97BD6515465659FF8F3B7BE375B2EA87 c:\windows\explorer.exe
[-] 2007-06-13 11:26 1033216 7712DF0CDDE3A5AC89843E61CD5B3658 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2007-06-13 10:23 1033216 97BD6515465659FF8F3B7BE375B2EA87 c:\windows\$NtServicePackUninstall$\explorer.exe
[7] 2004-08-04 11:00 1032192 A0732187050030AE399B241436565E64 c:\windows\$NtUninstallKB938828$\explorer.exe
[7] 2008-04-14 00:12 1033728 12896823FB95BFB3DC9B46BCAEDC9923 c:\windows\ServicePackFiles\i386\explorer.exe

[-] 2005-06-11 00:17 57856 AD3D9D191AEA7B5445FE1D82FFBB4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\$NtServicePackUninstall$\spoolsv.exe
[7] 2008-04-14 00:12 57856 D8E14A61ACC1D4A6CD0D38AEBAC7FA3B c:\windows\ServicePackFiles\i386\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\system32\spoolsv.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
2009-01-26 20:31 1879896 —-a-w c:\progra~1\SPYBOT~1\SDHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-09-25 07:11 501136 —-a-w c:\program files\Java\jre1.6.0_03\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
2007-09-20 15:30 328752 —-a-w c:\program files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
2006-12-08 12:11 98304 —-a-w c:\program files\BAE\BAE.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2006-08-29 395776]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"CurseClient"="c:\program files\Curse\CurseClient.exe" [2008-10-10 4789760]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-02-06 3325952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-07-21 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-07-21 86016]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-07-21 81920]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"Corel Photo Downloader"="c:\program files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe" [2006-08-14 462336]
"Lexmark X1100 Series"="c:\program files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 57344]
"Password Door Loader"="c:\progra~1\PASSWO~1\tlpd.exe" [2006-11-13 30208]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-10 16384]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-26 185896]
"iolo AntiVirus"="c:\program files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe" [2008-12-16 1106784]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-07-24 282624]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WebCheck"= {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - c:\windows\system32\webcheck.dll [2008-12-20 233472]
"WPDShServiceObj"= {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll [2006-10-19 133632]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0autocheck smrgdf c:\documents and settings\Brian Tompson\Application Data\iolo"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Empire at War Forces of Corruption\\swfoc.exe"=
"c:\\Program Files\\Curse\\CurseClient.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\iolo\\System Mechanic Professional\\AntiVirus\\ioloAV.exe"=
"c:\\Program Files\\iolo\\System Mechanic Professional\\AntiVirus\\iAVEmailScanner.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\CCP\\EVE\\bin\\ExeFile.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader
"6112:TCP"= 6112:TCP:Blizzard Downloader

R3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-06-13 356920]
S1 PasswordDoor;PasswordDoor;c:\windows\system32\drivers\PDoor.sys [2009-04-21 16655]
S2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2009-02-06 712048]
S2 ioloSystemService;iolo System Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2009-02-06 712048]

— Other Services/Drivers In Memory —

*Deregistered* - mchInjDrv
.
- - - - ORPHANS REMOVED - - - -

SharedTaskScheduler-{438755C2-A8BA-11D1-B96B-00A0C90312E1} - %SystemRoot%\system32\browseui.dll
SSODL-SysTray-{35CEC8A3-2BE6-11D2-8773-92E220524153} - %systemroot%\system32\stobject.dll

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: {{e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\Messenger\msmsgs.exe
IE: {{92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\MI1933~1\OFFICE11\REFIEBAR.DLL
IE: {{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\SPYBOT~1\SDHelper.dll
LSP: c:\windows\system32\iavlsp.dll
Filter: Class Install Handler - {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - c:\windows\system32\urlmon.dll
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - c:\windows\system32\urlmon.dll
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - c:\windows\system32\urlmon.dll
Filter: lzdhtml - {8f6b0360-b80d-11d0-a9b3-006097942311} - c:\windows\system32\urlmon.dll
Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} -
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
Handler: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - c:\windows\system32\mshtml.dll
Handler: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - c:\windows\system32\urlmon.dll
Handler: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - c:\windows\system32\itss.dll
Handler: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - c:\windows\system32\mshtml.dll
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - c:\progra~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
Handler: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - c:\windows\system32\mshtml.dll
Handler: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - c:\windows\system32\itss.dll
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - c:\progra~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
Handler: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
Handler: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - c:\windows\system32\mshtml.dll
Handler: sysimage - {76E67A63-06E9-11D2-A840-006008059382} -
Handler: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - c:\windows\system32\msvidctl.dll
Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - c:\windows\system32\mshtml.dll
Name-Space Handler: mk\* - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - c:\windows\system32\itss.dll
FF - ProfilePath - c:\documents and settings\Brian Tompson\Application Data\Mozilla\Firefox\Profiles\5v56vu61.default\
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.
.
——- File Associations ——-
.
JSEFile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-22 06:53
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Password Door Loader = c:\progra~1\PASSWO~1\tlpd.exe??????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1022652870-2597154559-1221656813-1007\Software\SecuROM\License information*]
"datasecu"=hex:7a,9f,1a,47,f0,ad,2a,f9,70,3e,3d,66,9c,0f,b0,fa,23,e0,cf,70,8f,
08,cd,e0,3c,97,b0,56,68,ac,1a,85,4e,14,fd,ac,fe,0c,d2,45,0c,c3,67,fd,89,66,\
"rkeysecu"=hex:3e,80,9e,c4,40,b4,90,83,87,8e,33,49,64,ac,f8,d9
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(764)
c:\windows\system32\iavlsp.dll

- - - - - - - > 'explorer.exe'(3052)
c:\windows\system32\tlpd.dll
c:\windows\system32\wpdshext.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\Audiodev.dll
c:\windows\system32\WMVCore.DLL
c:\windows\system32\WMASF.DLL
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
.
Completion time: 2009-04-22 6:55
ComboFix-quarantined-files.txt 2009-04-22 11:55
ComboFix2.txt 2009-04-17 23:33

Pre-Run: 100,201,910,272 bytes free
Post-Run: 100,188,663,808 bytes free

244 — E O F — 2009-04-21 03:50

CatByte

Post #12April 23, 2009, 11:28 PM UTC

Hi,

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

Rootkit::
c:\windows\systemroot\system32\drivers\TDSSmqlt.sys
c:\windows\system32\TDSSoiqt.dll
c:\windows\system32\TDSSmtvd.dat
c:\windows\system32\TDSShrxm.dll
c:\windows\system32\TDSSmtql.dll
c:\windows\system32\TDSSxfum.dll
c:\windows\system32\TDSSlxwp.dll
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSsahc.dll
c:\windows\system32\TDSSrhyp.log
c:\windows\system32\TDSSkkai.log

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

* Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
* ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
* When finished, it shall produce a log for you.
* Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NOTE: CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Next

Please run another scan with GMER and post that log along with the resulting log from the ComboFix script

Thanks

CB

comet101

Post #13April 26, 2009, 4:08 PM UTC

I received the 'Windows Installer' message a few times during the scans and after. The pop-up doesn't seem to be doing anything bad but it worrys me that it might bring the Anitvirus360 virus back.
Here are the reports…

ComboFix 09-04-25.A3 - Brian Tompson 04/26/2009 10:56.7 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3062.2407 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Brian Tompson\Desktop\CFscript.txt
AV: iolo AntiVirus® *On-access scanning disabled* (Updated)
FW: Norton Internet Worm Protection *disabled*
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-05-26 to 2009-4-26 )))))))))))))))))))))))))))))))
.

2009-04-15 22:15 . 2009-04-15 22:15 ——– d—–w c:\program files\Trend Micro
2009-04-10 17:18 . 2009-04-10 17:18 ——– d—–w c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-04-04 16:11 . 2009-04-04 16:11 ——– d—–w c:\documents and settings\Brian Tompson\Local Settings\Application Data\Mozilla

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-26 15:59 . 2007-02-13 19:45 70824 —-a-w c:\windows\system32\PDoor.dat
2009-04-26 15:59 . 2006-11-13 15:04 16655 —-a-w c:\windows\system32\drivers\PDoor.sys
2009-04-25 04:44 . 2007-01-16 21:29 ——– d—–w c:\program files\LimeWire
2009-04-23 11:27 . 2007-01-12 18:40 66680 —-a-w c:\documents and settings\Brian Tompson\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-21 23:57 . 2009-04-21 23:51 16283032 —-a-w c:\program files\jre-6u13-windows-i586-p.exe
2009-04-20 02:32 . 2009-04-20 02:32 ——– d—–w c:\program files\CCP
2009-04-20 02:32 . 2009-04-20 02:32 ——– d—–w c:\documents and settings\All Users\Application Data\CCP
2009-04-19 15:41 . 2009-03-25 19:36 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-12 17:06 . 2007-01-12 21:52 2672 –sha-w c:\windows\system32\KGyGaAvL.sys
2009-04-12 17:06 . 2007-01-12 21:52 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\Corel
2009-04-10 17:37 . 2007-01-10 07:25 ——– d—–w c:\program files\Google
2009-04-09 18:29 . 2007-01-13 03:26 ——– d—–w c:\program files\Warcraft III
2009-04-07 05:06 . 2008-07-21 04:51 77550 —-a-w c:\windows\War3Unin.dat
2009-04-06 20:32 . 2009-03-25 19:36 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 20:32 . 2009-03-25 19:36 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-03-31 12:43 . 2008-08-31 18:29 ——– d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-30 23:06 . 2007-01-12 22:35 ——– d—–w c:\program files\World of Warcraft
2009-03-25 21:44 . 2009-02-22 22:25 936288 —-a-w c:\windows\system32\Incinerator.dll
2009-03-25 19:39 . 2007-02-22 18:44 ——– d—–w c:\program files\Spybot - Search & Destroy
2009-03-25 19:39 . 2007-02-22 18:44 ——– d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-25 19:38 . 2009-03-25 19:37 ——– d—–w c:\program files\SpywareBlaster
2009-03-25 19:36 . 2009-03-25 19:36 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\Malwarebytes
2009-03-25 19:36 . 2009-03-25 19:36 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-14 04:11 . 2009-03-13 02:43 ——– d—–w c:\program files\Spyware Doctor
2009-03-14 04:11 . 2009-03-14 04:11 ——– d—–w c:\documents and settings\Administrator\Application Data\PC Tools
2009-03-13 02:43 . 2009-03-13 02:43 ——– d—–w c:\documents and settings\Brian Tompson\Application Data\PC Tools
2009-02-25 22:27 . 2004-08-10 19:03 77859 —-a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-02-25 22:19 . 2004-08-10 18:51 250048 –sha-r C:\ntldr
2009-02-22 21:51 . 2009-02-22 21:51 74703 —-a-w c:\windows\system32\mfc45.dll
2009-02-17 16:31 . 2009-02-22 22:25 28672 —-a-w c:\windows\system32\iolobtdfg.exe
2009-02-17 16:26 . 2009-02-22 22:25 8192 —-a-w c:\windows\system32\smrgdf.exe
2008-10-28 01:02 . 2007-05-18 01:55 5760 —-a-w c:\documents and settings\Brian Tompson\Application Data\wklnhst.dat
2007-01-15 22:10 . 2007-01-15 22:10 136 —-a-w c:\documents and settings\Brian Tompson\Local Settings\Application Data\fusioncache.dat
2007-01-10 07:33 . 2009-03-14 04:08 65584 —-a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

——- Sigcheck ——-

[-] 2005-03-02 18:19 577024 1800F293BCCC8EDE8A70E12B88D80036 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2007-03-08 15:48 578048 7AA4F6C00405DFC4B70ED4214E7D687B c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\$NtServicePackUninstall$\user32.dll
[7] 2004-08-04 11:00 577024 C72661F8552ACE7C5C85E16A3CF505C4 c:\windows\$NtUninstallKB890859$\user32.dll
[-] 2005-03-02 18:09 577024 DE2DB164BBB35DB061AF0997E4499054 c:\windows\$NtUninstallKB925902$\user32.dll
[7] 2008-04-14 00:12 578560 B26B135FF1B9F60C9388B4A7D16F600B c:\windows\ServicePackFiles\i386\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\system32\user32.dll

[-] 2007-06-13 10:23 1033216 97BD6515465659FF8F3B7BE375B2EA87 c:\windows\explorer.exe
[-] 2007-06-13 11:26 1033216 7712DF0CDDE3A5AC89843E61CD5B3658 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2007-06-13 10:23 1033216 97BD6515465659FF8F3B7BE375B2EA87 c:\windows\$NtServicePackUninstall$\explorer.exe
[7] 2004-08-04 11:00 1032192 A0732187050030AE399B241436565E64 c:\windows\$NtUninstallKB938828$\explorer.exe
[7] 2008-04-14 00:12 1033728 12896823FB95BFB3DC9B46BCAEDC9923 c:\windows\ServicePackFiles\i386\explorer.exe

[-] 2005-06-11 00:17 57856 AD3D9D191AEA7B5445FE1D82FFBB4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\$NtServicePackUninstall$\spoolsv.exe
[7] 2008-04-14 00:12 57856 D8E14A61ACC1D4A6CD0D38AEBAC7FA3B c:\windows\ServicePackFiles\i386\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\system32\spoolsv.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
2009-01-26 20:31 1879896 —-a-w c:\progra~1\SPYBOT~1\SDHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-09-25 07:11 501136 —-a-w c:\program files\Java\jre1.6.0_03\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
2007-09-20 15:30 328752 —-a-w c:\program files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
2006-12-08 12:11 98304 —-a-w c:\program files\BAE\BAE.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2006-08-29 395776]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"CurseClient"="c:\program files\Curse\CurseClient.exe" [2008-10-10 4789760]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-02-06 3325952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-07-21 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-07-21 86016]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-07-21 81920]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"Corel Photo Downloader"="c:\program files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe" [2006-08-14 462336]
"Lexmark X1100 Series"="c:\program files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 57344]
"Password Door Loader"="c:\progra~1\PASSWO~1\tlpd.exe" [2006-11-13 30208]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-10 16384]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-26 185896]
"iolo AntiVirus"="c:\program files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe" [2008-12-16 1106784]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-07-24 282624]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WebCheck"= {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - c:\windows\system32\webcheck.dll [2008-12-20 233472]
"WPDShServiceObj"= {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll [2006-10-19 133632]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Empire at War Forces of Corruption\\swfoc.exe"=
"c:\\Program Files\\Curse\\CurseClient.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\iolo\\System Mechanic Professional\\AntiVirus\\ioloAV.exe"=
"c:\\Program Files\\iolo\\System Mechanic Professional\\AntiVirus\\iAVEmailScanner.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\CCP\\EVE\\bin\\ExeFile.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader
"6112:TCP"= 6112:TCP:Blizzard Downloader

R3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-06-13 356920]
S1 PasswordDoor;PasswordDoor;c:\windows\system32\drivers\PDoor.sys [2009-04-26 16655]
S2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2009-02-06 712048]
S2 ioloSystemService;iolo System Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2009-02-06 712048]

— Other Services/Drivers In Memory —

*Deregistered* - mchInjDrv
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: {{e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\Messenger\msmsgs.exe
IE: {{92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\MI1933~1\OFFICE11\REFIEBAR.DLL
IE: {{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\SPYBOT~1\SDHelper.dll
LSP: c:\windows\system32\iavlsp.dll
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - c:\windows\system32\urlmon.dll
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - c:\windows\system32\urlmon.dll
Filter: lzdhtml - {8f6b0360-b80d-11d0-a9b3-006097942311} - c:\windows\system32\urlmon.dll
Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} -
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
Handler: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - c:\windows\system32\itss.dll
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - c:\progra~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
Handler: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - c:\windows\system32\urlmon.dll
Handler: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - c:\windows\system32\itss.dll
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - c:\progra~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
Handler: sysimage - {76E67A63-06E9-11D2-A840-006008059382} -
Handler: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - c:\windows\system32\msvidctl.dll
Name-Space Handler: mk\* - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - c:\windows\system32\itss.dll
FF - ProfilePath - c:\documents and settings\Brian Tompson\Application Data\Mozilla\Firefox\Profiles\5v56vu61.default\
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-26 11:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Password Door Loader = c:\progra~1\PASSWO~1\tlpd.exe??????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1022652870-2597154559-1221656813-1007\Software\SecuROM\License information*]
"datasecu"=hex:7a,9f,1a,47,f0,ad,2a,f9,70,3e,3d,66,9c,0f,b0,fa,23,e0,cf,70,8f,
08,cd,e0,3c,97,b0,56,68,ac,1a,85,4e,14,fd,ac,fe,0c,d2,45,0c,c3,67,fd,89,66,\
"rkeysecu"=hex:3e,80,9e,c4,40,b4,90,83,87,8e,33,49,64,ac,f8,d9
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(764)
c:\windows\system32\iavlsp.dll

- - - - - - - > 'explorer.exe'(2244)
c:\windows\system32\tlpd.dll
c:\windows\system32\wpdshext.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\Audiodev.dll
c:\windows\system32\WMVCore.DLL
c:\windows\system32\WMASF.DLL
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Lexmark X1100 Series\lxbkbmon.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Common Files\Authentium\AntiVirus\dvpapi.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-04-26 11:04 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-26 16:04
ComboFix2.txt 2009-04-25 23:07
ComboFix3.txt 2009-04-22 12:02
ComboFix4.txt 2009-04-22 11:55
ComboFix5.txt 2009-04-26 15:56

Pre-Run: 99,820,417,024 bytes free
Post-Run: 99,806,142,464 bytes free

230 — E O F — 2009-04-26 03:23

GMER 1.0.15.14966 - http://www.gmer.net
Rootkit scan 2009-04-25 22:20:53
Windows 5.1.2600 Service Pack 3

—- System - GMER 1.0.15 —-

Code 896A8590 ZwDuplicateObject
Code 896A92E0 ZwSetInformationFile
Code 89813DD0 ZwSetSystemInformation
Code 8969E330 ZwWriteFile
Code \??\C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\catchme.sys pIofCallDriver
Code 896A858F NtDuplicateObject
Code 896A92DF NtSetInformationFile
Code 8969E32F NtWriteFile

—- Kernel code sections - GMER 1.0.15 —-

PAGE ntkrnlpa.exe!IoGetBootDiskInformation + 66F 80576917 7 Bytes JMP 8969EEEC
PAGE ntkrnlpa.exe!NtSetInformationFile 8057B010 7 Bytes JMP 896A92E4
PAGE ntkrnlpa.exe!NtWriteFile 8057CEF2 7 Bytes JMP 8969E334
PAGE ntkrnlpa.exe!ObCloseHandle + 17 805BC4F3 7 Bytes JMP 8969E864
PAGE ntkrnlpa.exe!NtDuplicateObject 805BDFD0 7 Bytes JMP 896A8594
PAGE ntkrnlpa.exe!ZwSetSystemInformation 8060F3C6 5 Bytes JMP 89813DD4
PAGE Fastfat.SYS 9D6849C8 7 Bytes JMP 897F4D2C
? C:\WINDOWS\system32\Drivers\mchInjDrv.sys The system cannot find the file specified. !
? C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\catchme.sys The system cannot find the file specified. !
? C:\WINDOWS\system32\Drivers\PROCEXP90.SYS The system cannot find the file specified. !

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Mozilla Firefox\firefox.exe[456] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Mozilla Firefox\firefox.exe[456] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Mozilla Firefox\firefox.exe[456] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Mozilla Firefox\firefox.exe[456] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Mozilla Firefox\firefox.exe[456] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Mozilla Firefox\firefox.exe[456] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Mozilla Firefox\firefox.exe[456] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Mozilla Firefox\firefox.exe[456] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Mozilla Firefox\firefox.exe[456] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Mozilla Firefox\firefox.exe[456] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Mozilla Firefox\firefox.exe[456] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00B30001
.text C:\Program Files\Mozilla Firefox\firefox.exe[456] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\WINDOWS\system32\hkcmd.exe[608] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\hkcmd.exe[608] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\hkcmd.exe[608] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\hkcmd.exe[608] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\hkcmd.exe[608] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\hkcmd.exe[608] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\hkcmd.exe[608] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\hkcmd.exe[608] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\hkcmd.exe[608] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\hkcmd.exe[608] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\hkcmd.exe[608] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 011C0001
.text C:\WINDOWS\system32\igfxpers.exe[616] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\igfxpers.exe[616] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\igfxpers.exe[616] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\igfxpers.exe[616] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\igfxpers.exe[616] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\igfxpers.exe[616] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\igfxpers.exe[616] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\igfxpers.exe[616] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\igfxpers.exe[616] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\igfxpers.exe[616] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\igfxpers.exe[616] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01370001
.text C:\WINDOWS\stsystra.exe[660] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[660] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\stsystra.exe[660] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[660] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\stsystra.exe[660] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[660] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\stsystra.exe[660] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[660] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\stsystra.exe[660] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[660] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\stsystra.exe[660] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01770001
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\csrss.exe[684] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\csrss.exe[684] KERNEL32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01380001
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\winlogon.exe[708] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\winlogon.exe[708] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00FC0001
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\services.exe[752] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\services.exe[752] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00D50001
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\lsass.exe[764] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00E40001
.text C:\WINDOWS\system32\svchost.exe[928] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[928] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\svchost.exe[928] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[928] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\svchost.exe[928] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[928] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\svchost.exe[928] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[928] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\svchost.exe[928] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[928] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\svchost.exe[928] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00DE0001
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[944] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[944] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[944] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[944] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[944] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[944] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[944] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[944] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[944] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[944] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[944] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00C30001
.text C:\WINDOWS\system32\svchost.exe[1008] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1008] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\svchost.exe[1008] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1008] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\svchost.exe[1008] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1008] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\svchost.exe[1008] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1008] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\svchost.exe[1008] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1008] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\svchost.exe[1008] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00FC0001
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[1064] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[1064] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[1064] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[1064] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[1064] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[1064] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[1064] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[1064] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[1064] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[1064] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[1064] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 010A0001
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1076] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1076] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1076] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1076] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1076] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1076] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1076] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1076] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1076] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1076] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe[1076] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01230001
.text C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe[1084] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe[1084] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe[1084] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe[1084] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe[1084] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe[1084] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe[1084] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe[1084] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe[1084] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe[1084] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe[1084] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00BD0001
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1092] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1092] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1092] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1092] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1092] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1092] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1092] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1092] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1092] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1092] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\PROGRA~1\PASSWO~1\tlpd.exe[1092] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 003F0001
.text C:\WINDOWS\System32\svchost.exe[1112] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\svchost.exe[1112] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\System32\svchost.exe[1112] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\svchost.exe[1112] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\System32\svchost.exe[1112] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\svchost.exe[1112] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\System32\svchost.exe[1112] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\svchost.exe[1112] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\System32\svchost.exe[1112] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\svchost.exe[1112] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\System32\svchost.exe[1112] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01BB0001
.text C:\WINDOWS\system32\svchost.exe[1156] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1156] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\svchost.exe[1156] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1156] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\svchost.exe[1156] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1156] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\svchost.exe[1156] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1156] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\svchost.exe[1156] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1156] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\svchost.exe[1156] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00640001
.text C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe[1164] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe[1164] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe[1164] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe[1164] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe[1164] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe[1164] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe[1164] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe[1164] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe[1164] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe[1164] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe[1164] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00BB0001
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1192] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1192] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1192] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1192] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1192] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1192] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1192] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1192] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1192] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1192] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1192] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 012E0001
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1204] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1204] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1204] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1204] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1204] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1204] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1204] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1204] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1204] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1204] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[1204] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 003E0001
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1228] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1228] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1228] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1228] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1228] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1228] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1228] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1228] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1228] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1228] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Dell Support Center\bin\sprtcmd.exe[1228] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 04790001
.text C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00990001
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe[1260] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe[1260] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe[1260] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe[1260] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe[1260] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe[1260] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe[1260] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe[1260] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe[1260] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe[1260] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\ioloAV.exe[1260] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 013F0001
.text C:\WINDOWS\system32\svchost.exe[1332] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1332] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\svchost.exe[1332] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1332] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\svchost.exe[1332] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1332] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\svchost.exe[1332] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1332] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\svchost.exe[1332] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1332] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\svchost.exe[1332] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 009E0001
.text C:\Program Files\Dell Support\DSAgnt.exe[1352] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support\DSAgnt.exe[1352] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Dell Support\DSAgnt.exe[1352] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support\DSAgnt.exe[1352] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Dell Support\DSAgnt.exe[1352] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support\DSAgnt.exe[1352] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Dell Support\DSAgnt.exe[1352] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support\DSAgnt.exe[1352] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Dell Support\DSAgnt.exe[1352] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support\DSAgnt.exe[1352] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Dell Support\DSAgnt.exe[1352] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 02060001
.text C:\WINDOWS\system32\ctfmon.exe[1368] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\ctfmon.exe[1368] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\ctfmon.exe[1368] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\ctfmon.exe[1368] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\ctfmon.exe[1368] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\ctfmon.exe[1368] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\ctfmon.exe[1368] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\ctfmon.exe[1368] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\ctfmon.exe[1368] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\ctfmon.exe[1368] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\ctfmon.exe[1368] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00C20001
.text C:\Program Files\Electronic Arts\EADM\Core.exe[1448] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Electronic Arts\EADM\Core.exe[1448] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Electronic Arts\EADM\Core.exe[1448] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Electronic Arts\EADM\Core.exe[1448] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Electronic Arts\EADM\Core.exe[1448] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Electronic Arts\EADM\Core.exe[1448] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Electronic Arts\EADM\Core.exe[1448] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Electronic Arts\EADM\Core.exe[1448] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Electronic Arts\EADM\Core.exe[1448] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Electronic Arts\EADM\Core.exe[1448] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Electronic Arts\EADM\Core.exe[1448] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 03120001
.text C:\WINDOWS\system32\LEXBCES.EXE[1560] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXBCES.EXE[1560] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\LEXBCES.EXE[1560] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXBCES.EXE[1560] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\LEXBCES.EXE[1560] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXBCES.EXE[1560] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\LEXBCES.EXE[1560] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXBCES.EXE[1560] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\LEXBCES.EXE[1560] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXBCES.EXE[1560] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\LEXBCES.EXE[1560] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01160001
.text C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\spoolsv.exe[1596] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\spoolsv.exe[1596] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00C00001
.text C:\WINDOWS\system32\LEXPPS.EXE[1632] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXPPS.EXE[1632] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\LEXPPS.EXE[1632] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXPPS.EXE[1632] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\LEXPPS.EXE[1632] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXPPS.EXE[1632] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\LEXPPS.EXE[1632] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXPPS.EXE[1632] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\LEXPPS.EXE[1632] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\LEXPPS.EXE[1632] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\LEXPPS.EXE[1632] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 008F0001
.text C:\Program Files\Windows Media Player\wmplayer.exe[1656] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Media Player\wmplayer.exe[1656] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Windows Media Player\wmplayer.exe[1656] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Media Player\wmplayer.exe[1656] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Windows Media Player\wmplayer.exe[1656] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Media Player\wmplayer.exe[1656] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Windows Media Player\wmplayer.exe[1656] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Media Player\wmplayer.exe[1656] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Windows Media Player\wmplayer.exe[1656] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Media Player\wmplayer.exe[1656] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Windows Media Player\wmplayer.exe[1656] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00960001
.text C:\Program Files\Windows Media Player\wmplayer.exe[1656] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1984] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1984] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1984] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1984] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1984] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1984] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1984] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1984] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1984] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1984] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe[1984] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01000001
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[2020] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[2020] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[2020] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[2020] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[2020] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[2020] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[2020] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[2020] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[2020] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[2020] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe[2020] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00DC0001
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2052] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2052] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2052] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2052] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2052] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2052] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2052] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2052] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2052] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2052] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[2052] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00A90001
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2084] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2084] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2084] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2084] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2084] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2084] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2084] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2084] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2084] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2084] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\iolo\common\lib\ioloServiceManager.exe[2084] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 02A40001
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe[2188] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00DF0001
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2212] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01040001
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[2408] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[2408] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[2408] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[2408] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[2408] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[2408] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[2408] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[2408] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[2408] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[2408] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[2408] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00BC0001
.text C:\Program Files\iolo\System Mechanic Professional\AntiVirus\iAVEmailScanner.exe[2408] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[2428] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[2428] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[2428] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[2428] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[2428] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[2428] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[2428] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[2428] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[2428] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[2428] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[2428] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 003C0001
.text C:\DOCUME~1\BRIANT~1\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[2428] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2664] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2664] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2664] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2664] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2664] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2664] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2664] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2664] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2664] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2664] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2664] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00AA0001
.text C:\Program Files\Dell Support Center\bin\sprtsvc.exe[2664] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\WINDOWS\system32\svchost.exe[2760] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[2760] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\svchost.exe[2760] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[2760] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\svchost.exe[2760] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[2760] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\svchost.exe[2760] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[2760] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\svchost.exe[2760] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[2760] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\svchost.exe[2760] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00770001
.text C:\WINDOWS\system32\svchost.exe[2760] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2780] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2780] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2780] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2780] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2780] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2780] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2780] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2780] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2780] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2780] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2780] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 003C0001
.text C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe[2780] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\WINDOWS\explorer.exe[3080] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\explorer.exe[3080] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\explorer.exe[3080] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\explorer.exe[3080] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\explorer.exe[3080] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\explorer.exe[3080] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\explorer.exe[3080] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\explorer.exe[3080] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\explorer.exe[3080] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\explorer.exe[3080] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\explorer.exe[3080] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00C80001
.text C:\WINDOWS\explorer.exe[3080] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\WINDOWS\system32\DllHost.exe[3340] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\DllHost.exe[3340] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\DllHost.exe[3340] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\DllHost.exe[3340] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\DllHost.exe[3340] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\DllHost.exe[3340] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\DllHost.exe[3340] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\DllHost.exe[3340] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\DllHost.exe[3340] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\DllHost.exe[3340] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\DllHost.exe[3340] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 009F0001
.text C:\WINDOWS\system32\DllHost.exe[3340] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\WINDOWS\system32\wuauclt.exe[3484] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wuauclt.exe[3484] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\wuauclt.exe[3484] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wuauclt.exe[3484] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\wuauclt.exe[3484] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wuauclt.exe[3484] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\wuauclt.exe[3484] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wuauclt.exe[3484] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\wuauclt.exe[3484] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wuauclt.exe[3484] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\wuauclt.exe[3484] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 009F0001
.text C:\WINDOWS\system32\wuauclt.exe[3484] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\WINDOWS\system32\notepad.exe[3568] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\notepad.exe[3568] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\system32\notepad.exe[3568] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\notepad.exe[3568] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\system32\notepad.exe[3568] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\notepad.exe[3568] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\notepad.exe[3568] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\notepad.exe[3568] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\system32\notepad.exe[3568] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\notepad.exe[3568] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\notepad.exe[3568] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 009F0001
.text C:\WINDOWS\system32\notepad.exe[3568] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D
.text C:\WINDOWS\System32\alg.exe[4040] ntdll.dll!NtCreateProcess 7C90D130 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\alg.exe[4040] ntdll.dll!NtCreateProcess + 4 7C90D134 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\System32\alg.exe[4040] ntdll.dll!NtCreateProcessEx 7C90D140 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\alg.exe[4040] ntdll.dll!NtCreateProcessEx + 4 7C90D144 2 Bytes [11, 5F]
.text C:\WINDOWS\System32\alg.exe[4040] ntdll.dll!NtResumeThread 7C90DB20 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\alg.exe[4040] ntdll.dll!NtResumeThread + 4 7C90DB24 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\System32\alg.exe[4040] ntdll.dll!NtSuspendProcess 7C90DE10 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\alg.exe[4040] ntdll.dll!NtSuspendProcess + 4 7C90DE14 2 Bytes [0B, 5F]
.text C:\WINDOWS\System32\alg.exe[4040] ntdll.dll!NtTerminateProcess 7C90DE50 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\alg.exe[4040] ntdll.dll!NtTerminateProcess + 4 7C90DE54 2 Bytes [05, 5F]
.text C:\WINDOWS\System32\alg.exe[4040] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 006D0001
.text C:\WINDOWS\System32\alg.exe[4040] kernel32.dll!FreeLibrary + 15 7C80AC83 4 Bytes CALL 7170003D

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Fastfat \FatCdrom Code 897F4D28
Device \FileSystem\Fastfat \Fat Code 897F4D28

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 2
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 7
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 35
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 7
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\Services\MRxDAV\EncryptedDirectories@
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys@imagepath \systemroot\system32\drivers\TDSSmqlt.sys
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@TDSSserv \systemroot\system32\drivers\TDSSmqlt.sys
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@TDSSl \systemroot\system32\TDSSoiqt.dll
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdssservers \systemroot\system32\TDSSmtvd.dat
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdssmain \systemroot\system32\TDSShrxm.dll
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdsslog \systemroot\system32\TDSSmtql.dll
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdssadw \systemroot\system32\TDSSxfum.dll
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdssinit \systemroot\system32\TDSSlxwp.dll
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdssurls \systemroot\system32\TDSSnmxh.log
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdsspanels \systemroot\system32\TDSSsahc.dll
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@tdsserrors \systemroot\system32\TDSSrhyp.log
Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys\modules@TDSSproc \systemroot\system32\TDSSkkai.log

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl (size mismatch) 8192/4096 bytes

—- EOF - GMER 1.0.15 —-

CatByte

Post #14April 26, 2009, 4:58 PM UTC

Hi,

please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

RootKit::
c:\windows\system32\drivers\TDSSmqlt.sys
c:\windows\system32\TDSSoiqt.dll
c:\windows\system32\TDSSmtvd.dat
c:\windows\system32\TDSShrxm.dll
c:\windows\system32\TDSSmtql.dll
c:\windows\system32\TDSSxfum.dll
c:\windows\system32\TDSSlxwp.dll
c:\windows\system32\TDSSsahc.dll
c:\windows\system32\TDSSrhyp.log
c:\windows\system32\TDSSkkai.log

Registry::
[-Reg HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys]

Driver::

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

* Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
* ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
* When finished, it shall produce a log for you.
* Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NOTE: CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

CatByte

Post #15May 1, 2009, 9:00 AM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

✨ Ask AI

Ask AI