[Closed] Symantec Endpoint Protection/Reoccuring Tracking Cookie

wisniewskiorthodontics Topic Starter

Post #1June 2, 2009, 2:39 AM UTC

I am a college student running Microsoft Windows Vista. My University has me running Symantec Endpoint Protection for anti-virus software. Since I've returned home for the summer I've noticed some issues.

1.)While online their are occasional pop-ups.
2.)The internet speed has greatly slowed.
3.)When anti-virus scan is ran, "Tracking Cookie" is always found and always "deleted."
4.)The computer freezes/and or runs very slow while runninng multiple programs.

My computer is a roughly 3 year old Dell E1505. I know it may be a litle old, but I feel I take great care to keep it up to date and junk free. While home though my brothers have had access to the computer without my supervision. I'm aware that some of these issues could be hardware. Being that these issues have only come about recently, I'm thinking it may be virus related. My internet connection is wireless now that I am home. And the local wireless router is connected to a high-speed cable line. The two other computers in the household (one PC directly connected to modem one MacBook Pro wireless as well) have seen no change in connection speeds. They do connect/surf VERY swiftly, and I find no lag in their processing via the internet or just basic word documents, audio/video playback, and so on.

The "Tracking Cookie" has been reappearing when I run a Virus scan for quite sometime. I did not feel it was that big of an issue until these recent changes in all over computer performance that I've noticed. Below I've included my Hijackthis Log and also a picture of the Anti-Virus scan results that I receive. Also the usage summary of my Hard Drive.

On top of all this I've noticed that I am using quite a bit of my Hard Drive Space. As a college student entering the field of journalism I write many long multipage papers for my classes. And other than some music, I don't believe I should be using as much disc space as it shows I am. Is there any way to see how this space is being used? If there are duplicates of files (audio: wma & Mp4 (iTunes) of the same song). And a way to clean it all up. Instead of defragment?

Ultimately I just want to figure out what is cause this poor performance. Is it I the user, Am I truly maxing out my Hard Drive Space and causing my machine to slow? ( I truly appreciate you help. And I hope that together we can resolve these issues. My computer has been good to me, and all I wish to do is return the favor.

Hijackthis Log, Reoccuring "Tracking Cookie", and C Drive Properties

📎prntscrn.jpg 📎prntscrn1.jpg

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:33:38 PM, on 6/1/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\Program Files\McAfee\SpamKiller\MSKDetct.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Windows\sttray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=3061106
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.live.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=3061106
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-174262077-1076774191-2093782839-501\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Guest')
O4 - Global Startup: Clean Access Agent.lnk = C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: QuickSet.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\Windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\Windows\Network Diagnostic\xpnetdiag.exe
O13 - Gopher Prefix:
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/…NPUplden-us.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/4058/ftp…abs/Coupons.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\Windows\System32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 9391 bytes

CatByte

Post #2June 7, 2009, 10:54 AM UTC

Hi and Welcome,

NOTE:

Malware removal is NOT instantaneous.
Most infections require more than one round to properly eradicate.
Absence of symptoms does not always mean the job is complete.
You can be certain that I will advise you when the computer is clean.
Kindly follow my instructions in the order posted.
Please resist the urge to run further scans or fix items on your own without my direction.

Please do the following:

STEP #1

Please download DDS and save it to your desktop.

Disable any script blocking protection
Double click dds.pif to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.

STEP #2

Download the GMER Rootkit Scanner. Unzip it to your Desktop.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
Double-click gmer.exe. The program will begin to run.
**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!
If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

Please describe how your computer is behaving at the moment, listing any symptoms and problems that you are experiencing.

wisniewskiorthodontics

Post #3June 8, 2009, 2:09 PM UTC

Thank you so much for getting back to me. Here are the three logs that you requested I apply with. I look forward to your next reply

DDS (Ver_09-05-14.01) - NTFSx86
Run by [removed] at 21:23:53.34 on Sun 06/07/2009
Internet Explorer: 8.0.6001.18702
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2046.1061 [GMT -4:00]

AV: Symantec Endpoint Protection *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Updated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Symantec Endpoint Protection *enabled* (Updated) {6C85A515-B91D-4D2B-AF18-40984A4A8493}
SP: Windows Defender *disabled* (Outdated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: Kaspersky Internet Security *disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Symantec Endpoint Protection *enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}
FW: Kaspersky Internet Security *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Ati2evxx.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\System32\LEXBCES.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\LEXPPS.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\Program Files\McAfee\SpamKiller\MSKDetct.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Windows\sttray.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Sarah Robinson\Desktop\dds.pif
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uDefault_Page_URL = www.google.com/ig/dell?hl=en&client;=dell-usuk&channel;=us&ibd;=3061106
uSearch Bar = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us
uSearch Page = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us
uStart Page = hxxp://www.live.com/
uInternet Settings,ProxyOverride = *.local
mSearchAssistant = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
TB: {0BF43445-2F28-4351-9252-17FE6E806AA0} - No File
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [LDM] c:\program files\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
mRun: [PCMService] "c:\program files\dell\mediadirect\PCMService.exe"
mRun: [MSKDetectorExe] c:\program files\mcafee\spamkiller\MSKDetct.exe /uninstall
mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [Lexmark X1100 Series] "c:\program files\lexmark x1100 series\lxbkbmgr.exe"
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [SigmatelSysTrayApp] sttray.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [WPCUMI] c:\windows\system32\WpcUmi.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\cleana~1.lnk - c:\program files\cisco systems\clean access agent\CCAAgent.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\logite~2.lnk - c:\program files\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickset.lnk - c:\windows\installer\{53a01cc6-14b0-4512-a2e7-10d39bf83dc4}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport; to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~4\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL
LSP: c:\windows\system32\wpclsp.dll
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w2/resources/VistaMSNPUplden-us.cab
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - hxxp://a19.g.akamai.net/7/19/7125/4058/ftp.coupons.com/r3302/abbottlabs/Coupons.cab
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - %SystemRoot%\system32\wpdshserviceobj.dll

============= SERVICES / DRIVERS ===============

R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2006-12-25 3712]
R2 SSPORT;SSPORT;c:\windows\system32\drivers\SSPORT.SYS [2007-3-8 5120]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-3-1 101936]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-8-14 23888]

=============== Created Last 30 ================

2009-06-06 16:29 –d—– c:\program files\iPod
2009-06-06 16:29 –d—– c:\program files\iTunes
2009-06-01 21:28 –d—– c:\program files\Trend Micro
2009-05-30 21:39 –d—– c:\programdata\WindowsSearch
2009-05-26 17:18 90,112 a——- c:\windows\system32\QuickTimeVR.qtx
2009-05-26 17:18 57,344 a——- c:\windows\system32\QuickTime.qts

==================== Find3M ====================

2009-06-06 16:23 143,360 a——- c:\windows\inf\infstrng.dat
2009-06-06 16:23 86,016 a——- c:\windows\inf\infstor.dat
2009-06-06 16:23 51,200 a——- c:\windows\inf\infpub.dat
2009-03-16 23:38 40,960 a——- c:\windows\apppatch\apihex86.dll
2009-03-16 23:38 13,824 a——- c:\windows\system32\apilogen.dll
2009-03-16 23:38 24,064 a——- c:\windows\system32\amxread.dll
2008-11-09 19:31 174 a–sh— c:\program files\desktop.ini
2008-11-09 19:16 665,600 a——- c:\windows\inf\drvindex.dat
2008-09-03 15:19 542 a——- c:\users\sarahr~1\appdata\roaming\wklnhst.dat
2006-11-02 08:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 08:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 08:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 08:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 05:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 05:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 05:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 05:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat
2007-01-05 16:20 8,192 a–sh— c:\windows\users\default\NTUSER.DAT

============= FINISH: 21:31:28.24 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-05-14.01)

Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 3/3/2007 8:16:32 PM
System Uptime: 6/7/2009 10:37:39 AM (11 hours ago)

Motherboard: Dell Inc. | | 0XD720
Processor: Intel® Core™2 CPU T7200 @ 2.00GHz | Microprocessor | 1000/166mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 86 GiB total, 28.855 GiB free.
D: is CDROM (CDFS)
G: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP609: 5/28/2009 3:00:28 AM - Windows Update
RP610: 6/1/2009 9:38:56 PM - Windows Update
RP611: 6/6/2009 4:21:24 PM - Device Driver Package Install: Apple, Inc. Universal Serial Bus controllers
RP612: 6/6/2009 4:22:42 PM - Device Driver Package Install: Apple Network adapters

==== Installed Programs ======================

Adobe Flash Player 10 ActiveX
Adobe Reader 8.1.4
Apple Mobile Device Support
Apple Software Update
Bonjour
Canon iP1800 series
CDDRV_Installer
Cisco Clean Access Agent
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
iTunes
KhalInstallWrapper
LiveUpdate 3.3 (Symantec Corporation)
Logitech Desktop Messenger
Logitech SetPoint
Microsoft .NET Framework 3.5 SP1
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Small Business Edition 2003
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
MSXML 4.0 SP2 (KB954430)
QuickTime
Symantec Endpoint Protection

==== Event Viewer Messages From Past Week ========

6/6/2009 8:24:22 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WSearch service.
6/6/2009 8:23:52 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the NlaSvc service.
6/6/2009 8:20:17 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the idsvc service.
6/6/2009 4:23:59 PM, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
6/6/2009 4:20:23 PM, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
6/3/2009 1:30:02 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.
6/1/2009 9:50:25 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
6/1/2009 9:50:24 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
6/1/2009 9:50:24 PM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/1/2009 11:32:23 PM, Error: Service Control Manager [7000] - The DgiVecp service failed to start due to the following error: The system cannot find the device specified.
5/31/2009 2:22:26 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the PlugPlay service.

==== End Of File ===========================

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-06-08 10:03:44
Windows 6.0.6001 Service Pack 1

—- System - GMER 1.0.15 —-

SSDT 868998B0 ZwAlertResumeThread
SSDT 86899990 ZwAlertThread
SSDT 86905D10 ZwAllocateVirtualMemory
SSDT 85DE5008 ZwConnectPort
SSDT 86899600 ZwCreateMutant
SSDT 86905260 ZwCreateThread
SSDT 86905B30 ZwFreeVirtualMemory
SSDT 868996F0 ZwImpersonateAnonymousToken
SSDT 868997D0 ZwImpersonateThread
SSDT 86905A30 ZwMapViewOfSection
SSDT 86899520 ZwOpenEvent
SSDT 86905E00 ZwOpenProcessToken
SSDT 86899E68 ZwOpenThreadToken
SSDT \??\C:\Windows\system32\drivers\wpsdrvnt.sys ZwProtectVirtualMemory [0x8DDE22F0]
SSDT \SystemRoot\SYSTEM32\Drivers\SysPlant.sys (Symantec CMC Firewall SysPlant/Symantec Corporation) ZwQueryDefaultLocale [0x8F0C7830]
SSDT 86903220 ZwResumeThread
SSDT 86899D88 ZwSetContextThread
SSDT 86899F38 ZwSetInformationProcess
SSDT 86899C98 ZwSetInformationThread
SSDT 86899440 ZwSuspendProcess
SSDT 86899AD8 ZwSuspendThread
SSDT 86905360 ZwTerminateProcess
SSDT 86899BB8 ZwTerminateThread
SSDT 86905950 ZwUnmapViewOfSection
SSDT 86905C20 ZwWriteVirtualMemory
SSDT \SystemRoot\SYSTEM32\Drivers\SysPlant.sys (Symantec CMC Firewall SysPlant/Symantec Corporation) ZwCreateUserProcess [0x8F0C7780]

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwQueryLicenseValue + B8C 822619D4 5 Bytes JMP 8F0C8C30 \SystemRoot\SYSTEM32\Drivers\SysPlant.sys (Symantec CMC Firewall SysPlant/Symantec Corporation)
.text ntkrnlpa.exe!KeSetTimerEx + 350 822C2914 8 Bytes [B0, 98, 89, 86, 90, 99, 89, …] {MOV AL, 0x98; MOV [ESI-0x79766670], EAX}
.text ntkrnlpa.exe!KeSetTimerEx + 364 822C2928 4 Bytes [10, 5D, 90, 86]
.text ntkrnlpa.exe!KeSetTimerEx + 3F4 822C29B8 4 Bytes [08, 50, DE, 85]
.text ntkrnlpa.exe!KeSetTimerEx + 428 822C29EC 4 Bytes [00, 96, 89, 86]
.text ntkrnlpa.exe!KeSetTimerEx + 454 822C2A18 4 Bytes [60, 52, 90, 86]
.text …
.text ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0
.text ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A
.text ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E
.text ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8
.text ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412
.text ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C
.text ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486
.text ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0
.text ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA
.text ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534
.text ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E
.text ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364

—- User code sections - GMER 1.0.15 —-

.text C:\Windows\system32\taskeng.exe[272] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[272] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[272] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[272] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[272] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[272] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[272] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[272] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[272] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[272] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[272] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[272] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[308] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[308] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[308] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[308] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[308] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[308] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[308] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[308] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[308] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[308] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[308] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[308] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXPPS.EXE[348] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXPPS.EXE[348] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXPPS.EXE[348] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXPPS.EXE[348] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXPPS.EXE[348] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXPPS.EXE[348] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXPPS.EXE[348] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXPPS.EXE[348] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXPPS.EXE[348] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXPPS.EXE[348] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXPPS.EXE[348] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXPPS.EXE[348] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wininit.exe[640] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wininit.exe[640] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wininit.exe[640] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wininit.exe[640] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wininit.exe[640] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wininit.exe[640] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wininit.exe[640] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wininit.exe[640] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wininit.exe[640] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wininit.exe[640] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wininit.exe[640] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wininit.exe[640] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\services.exe[676] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\services.exe[676] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\services.exe[676] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\services.exe[676] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\services.exe[676] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\services.exe[676] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\services.exe[676] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\services.exe[676] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\services.exe[676] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\services.exe[676] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\services.exe[676] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\services.exe[676] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\Explorer.EXE[716] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\Explorer.EXE[716] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\Explorer.EXE[716] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\Explorer.EXE[716] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\Explorer.EXE[716] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\Explorer.EXE[716] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\Explorer.EXE[716] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\Explorer.EXE[716] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\Explorer.EXE[716] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\Explorer.EXE[716] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\Explorer.EXE[716] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\Explorer.EXE[716] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsass.exe[732] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsass.exe[732] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsass.exe[732] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsass.exe[732] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsass.exe[732] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsass.exe[732] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsass.exe[732] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsass.exe[732] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsass.exe[732] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsass.exe[732] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsass.exe[732] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsass.exe[732] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsm.exe[740] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsm.exe[740] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsm.exe[740] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsm.exe[740] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsm.exe[740] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsm.exe[740] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsm.exe[740] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsm.exe[740] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsm.exe[740] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsm.exe[740] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsm.exe[740] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\lsm.exe[740] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[888] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[888] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[888] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[888] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[888] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[888] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[888] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[888] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[888] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[888] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[888] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[888] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\sttray.exe[912] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\sttray.exe[912] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\sttray.exe[912] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\sttray.exe[912] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\sttray.exe[912] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\sttray.exe[912] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\sttray.exe[912] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\sttray.exe[912] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\sttray.exe[912] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\sttray.exe[912] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\sttray.exe[912] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\sttray.exe[912] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[972] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[972] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[972] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[972] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[972] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[972] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[972] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[972] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[972] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[972] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[972] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[972] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1088] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1088] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1088] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1088] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1088] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1088] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1088] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1088] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1088] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1088] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1088] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1088] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1128] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1128] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1128] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1128] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1128] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1128] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1128] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1128] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1128] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1128] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1128] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1128] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1176] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1176] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1176] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1176] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1176] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1176] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1176] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1176] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1176] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1176] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1176] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[1176] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehtray.exe[1196] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehtray.exe[1196] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehtray.exe[1196] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehtray.exe[1196] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehtray.exe[1196] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehtray.exe[1196] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehtray.exe[1196] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehtray.exe[1196] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehtray.exe[1196] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehtray.exe[1196] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehtray.exe[1196] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehtray.exe[1196] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1200] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1200] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1200] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1200] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1200] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1200] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1200] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1200] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1200] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1200] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1200] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1200] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\AUDIODG.EXE[1300] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\AUDIODG.EXE[1300] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\AUDIODG.EXE[1300] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\AUDIODG.EXE[1300] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\AUDIODG.EXE[1300] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\AUDIODG.EXE[1300] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\AUDIODG.EXE[1300] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\AUDIODG.EXE[1300] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\AUDIODG.EXE[1300] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\AUDIODG.EXE[1300] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\AUDIODG.EXE[1300] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\AUDIODG.EXE[1300] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1328] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1328] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1328] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1328] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1328] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1328] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1328] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1328] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1328] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1328] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1328] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1328] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1376] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1376] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1376] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1376] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1376] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1376] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1376] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1376] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1376] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1376] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1376] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1376] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehmsas.exe[1392] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehmsas.exe[1392] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehmsas.exe[1392] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehmsas.exe[1392] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehmsas.exe[1392] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehmsas.exe[1392] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehmsas.exe[1392] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehmsas.exe[1392] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehmsas.exe[1392] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehmsas.exe[1392] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehmsas.exe[1392] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\ehome\ehmsas.exe[1392] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1504] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1504] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1504] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1504] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1504] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1504] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1504] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1504] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1504] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1504] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1504] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Ati2evxx.exe[1504] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe[1572] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe[1572] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe[1572] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe[1572] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe[1572] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe[1572] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe[1572] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe[1572] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe[1572] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe[1572] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe[1572] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe[1572] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1656] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1656] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1656] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1656] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1656] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1656] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1656] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1656] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1656] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1656] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1656] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[1656] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe[1796] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe[1796] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe[1796] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe[1796] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe[1796] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe[1796] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe[1796] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe[1796] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe[1796] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe[1796] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe[1796] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe[1796] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXBCES.EXE[1976] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXBCES.EXE[1976] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXBCES.EXE[1976] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXBCES.EXE[1976] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXBCES.EXE[1976] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXBCES.EXE[1976] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXBCES.EXE[1976] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXBCES.EXE[1976] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXBCES.EXE[1976] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXBCES.EXE[1976] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXBCES.EXE[1976] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\LEXBCES.EXE[1976] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\spoolsv.exe[2044] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\spoolsv.exe[2044] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\spoolsv.exe[2044] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\spoolsv.exe[2044] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\spoolsv.exe[2044] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\spoolsv.exe[2044] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\spoolsv.exe[2044] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\spoolsv.exe[2044] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\spoolsv.exe[2044] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\spoolsv.exe[2044] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\spoolsv.exe[2044] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\spoolsv.exe[2044] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2164] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2164] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2164] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2164] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2164] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2164] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2164] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2164] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2164] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2164] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2164] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2164] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Bonjour\mDNSResponder.exe[2184] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Bonjour\mDNSResponder.exe[2184] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Bonjour\mDNSResponder.exe[2184] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Bonjour\mDNSResponder.exe[2184] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Bonjour\mDNSResponder.exe[2184] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Bonjour\mDNSResponder.exe[2184] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Bonjour\mDNSResponder.exe[2184] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Bonjour\mDNSResponder.exe[2184] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Bonjour\mDNSResponder.exe[2184] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Bonjour\mDNSResponder.exe[2184] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Bonjour\mDNSResponder.exe[2184] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Bonjour\mDNSResponder.exe[2184] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2220] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2220] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2220] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2220] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2220] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2220] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2220] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2220] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2220] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2220] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2220] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2220] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe[2260] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe[2260] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe[2260] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe[2260] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe[2260] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe[2260] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe[2260] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe[2260] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe[2260] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe[2260] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe[2260] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe[2260] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2408] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2408] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2408] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2408] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2408] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2408] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2408] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2408] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2408] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2408] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2408] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2408] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\wpcumi.exe[2424] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\wpcumi.exe[2424] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\wpcumi.exe[2424] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\wpcumi.exe[2424] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\wpcumi.exe[2424] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\wpcumi.exe[2424] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\wpcumi.exe[2424] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\wpcumi.exe[2424] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\wpcumi.exe[2424] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\wpcumi.exe[2424] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\wpcumi.exe[2424] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\wpcumi.exe[2424] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2640] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2640] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2640] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2640] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2640] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2640] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2640] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2640] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2640] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2640] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2640] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\svchost.exe[2640] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe[2656] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe[2656] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe[2656] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe[2656] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe[2656] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe[2656] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe[2656] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe[2656] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe[2656] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe[2656] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe[2656] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe[2656] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe[2676] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe[2676] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe[2676] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe[2676] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe[2676] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe[2676] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe[2676] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe[2676] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe[2676] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe[2676] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe[2676] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe[2676] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[2760] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[2760] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[2760] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[2760] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[2760] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[2760] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[2760] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[2760] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[2760] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[2760] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[2760] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\svchost.exe[2760] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\SearchIndexer.exe[2824] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\SearchIndexer.exe[2824] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\SearchIndexer.exe[2824] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\SearchIndexer.exe[2824] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\SearchIndexer.exe[2824] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\SearchIndexer.exe[2824] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\SearchIndexer.exe[2824] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\SearchIndexer.exe[2824] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\SearchIndexer.exe[2824] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\SearchIndexer.exe[2824] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\SearchIndexer.exe[2824] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\SearchIndexer.exe[2824] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\DRIVERS\xaudio.exe[2888] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\DRIVERS\xaudio.exe[2888] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\DRIVERS\xaudio.exe[2888] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\DRIVERS\xaudio.exe[2888] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\DRIVERS\xaudio.exe[2888] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\DRIVERS\xaudio.exe[2888] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\DRIVERS\xaudio.exe[2888] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\DRIVERS\xaudio.exe[2888] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\DRIVERS\xaudio.exe[2888] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\DRIVERS\xaudio.exe[2888] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\DRIVERS\xaudio.exe[2888] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\DRIVERS\xaudio.exe[2888] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\WUDFHost.exe[2936] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\WUDFHost.exe[2936] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\WUDFHost.exe[2936] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\WUDFHost.exe[2936] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\WUDFHost.exe[2936] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\WUDFHost.exe[2936] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\WUDFHost.exe[2936] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\WUDFHost.exe[2936] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\WUDFHost.exe[2936] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\WUDFHost.exe[2936] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\WUDFHost.exe[2936] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\WUDFHost.exe[2936] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Windows Sidebar\sidebar.exe[2996] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Windows Sidebar\sidebar.exe[2996] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Windows Sidebar\sidebar.exe[2996] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Windows Sidebar\sidebar.exe[2996] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Windows Sidebar\sidebar.exe[2996] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Windows Sidebar\sidebar.exe[2996] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Windows Sidebar\sidebar.exe[2996] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Windows Sidebar\sidebar.exe[2996] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Windows Sidebar\sidebar.exe[2996] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Windows Sidebar\sidebar.exe[2996] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Windows Sidebar\sidebar.exe[2996] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Windows Sidebar\sidebar.exe[2996] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Digital Line Detect\DLG.exe[3036] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Digital Line Detect\DLG.exe[3036] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Digital Line Detect\DLG.exe[3036] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Digital Line Detect\DLG.exe[3036] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Digital Line Detect\DLG.exe[3036] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Digital Line Detect\DLG.exe[3036] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Digital Line Detect\DLG.exe[3036] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Digital Line Detect\DLG.exe[3036] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Digital Line Detect\DLG.exe[3036] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Digital Line Detect\DLG.exe[3036] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Digital Line Detect\DLG.exe[3036] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Digital Line Detect\DLG.exe[3036] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\McAfee\SpamKiller\MSKDetct.exe[3188] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\McAfee\SpamKiller\MSKDetct.exe[3188] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\McAfee\SpamKiller\MSKDetct.exe[3188] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\McAfee\SpamKiller\MSKDetct.exe[3188] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\McAfee\SpamKiller\MSKDetct.exe[3188] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\McAfee\SpamKiller\MSKDetct.exe[3188] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\McAfee\SpamKiller\MSKDetct.exe[3188] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\McAfee\SpamKiller\MSKDetct.exe[3188] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\McAfee\SpamKiller\MSKDetct.exe[3188] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\McAfee\SpamKiller\MSKDetct.exe[3188] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\McAfee\SpamKiller\MSKDetct.exe[3188] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\McAfee\SpamKiller\MSKDetct.exe[3188] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Dwm.exe[3440] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Dwm.exe[3440] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Dwm.exe[3440] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Dwm.exe[3440] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Dwm.exe[3440] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Dwm.exe[3440] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Dwm.exe[3440] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Dwm.exe[3440] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Dwm.exe[3440] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Dwm.exe[3440] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Dwm.exe[3440] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\Dwm.exe[3440] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccApp.exe[3520] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccApp.exe[3520] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccApp.exe[3520] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccApp.exe[3520] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccApp.exe[3520] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccApp.exe[3520] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccApp.exe[3520] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccApp.exe[3520] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccApp.exe[3520] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccApp.exe[3520] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccApp.exe[3520] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Common Files\Symantec Shared\ccApp.exe[3520] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe[3740] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe[3740] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe[3740] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe[3740] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe[3740] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe[3740] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe[3740] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe[3740] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe[3740] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe[3740] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe[3740] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe[3740] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iTunes\iTunesHelper.exe[3812] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iTunes\iTunesHelper.exe[3812] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iTunes\iTunesHelper.exe[3812] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iTunes\iTunesHelper.exe[3812] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iTunes\iTunesHelper.exe[3812] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iTunes\iTunesHelper.exe[3812] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iTunes\iTunesHelper.exe[3812] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iTunes\iTunesHelper.exe[3812] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iTunes\iTunesHelper.exe[3812] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iTunes\iTunesHelper.exe[3812] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iTunes\iTunesHelper.exe[3812] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iTunes\iTunesHelper.exe[3812] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[3840] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[3840] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[3840] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[3840] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[3840] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[3840] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[3840] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[3840] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[3840] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[3840] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[3840] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\taskeng.exe[3840] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe[4132] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe[4132] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe[4132] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe[4132] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe[4132] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe[4132] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe[4132] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe[4132] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe[4132] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe[4132] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe[4132] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe[4132] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\wmiprvse.exe[4172] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\wmiprvse.exe[4172] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\wmiprvse.exe[4172] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\wmiprvse.exe[4172] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\wmiprvse.exe[4172] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\wmiprvse.exe[4172] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\wmiprvse.exe[4172] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\wmiprvse.exe[4172] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\wmiprvse.exe[4172] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\wmiprvse.exe[4172] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\wmiprvse.exe[4172] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\wmiprvse.exe[4172] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Dell\QuickSet\quickset.exe[4300] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Dell\QuickSet\quickset.exe[4300] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Dell\QuickSet\quickset.exe[4300] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Dell\QuickSet\quickset.exe[4300] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Dell\QuickSet\quickset.exe[4300] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Dell\QuickSet\quickset.exe[4300] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Dell\QuickSet\quickset.exe[4300] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Dell\QuickSet\quickset.exe[4300] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Dell\QuickSet\quickset.exe[4300] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Dell\QuickSet\quickset.exe[4300] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Dell\QuickSet\quickset.exe[4300] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\Dell\QuickSet\quickset.exe[4300] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Users\Sarah Robinson\Desktop\gmer.exe[4592] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Users\Sarah Robinson\Desktop\gmer.exe[4592] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Users\Sarah Robinson\Desktop\gmer.exe[4592] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Users\Sarah Robinson\Desktop\gmer.exe[4592] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Users\Sarah Robinson\Desktop\gmer.exe[4592] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Users\Sarah Robinson\Desktop\gmer.exe[4592] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Users\Sarah Robinson\Desktop\gmer.exe[4592] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Users\Sarah Robinson\Desktop\gmer.exe[4592] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Users\Sarah Robinson\Desktop\gmer.exe[4592] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Users\Sarah Robinson\Desktop\gmer.exe[4592] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Users\Sarah Robinson\Desktop\gmer.exe[4592] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Users\Sarah Robinson\Desktop\gmer.exe[4592] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\mobsync.exe[4900] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\mobsync.exe[4900] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\mobsync.exe[4900] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\mobsync.exe[4900] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\mobsync.exe[4900] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\mobsync.exe[4900] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\mobsync.exe[4900] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\mobsync.exe[4900] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\mobsync.exe[4900] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\mobsync.exe[4900] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\mobsync.exe[4900] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\System32\mobsync.exe[4900] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iPod\bin\iPodService.exe[5056] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iPod\bin\iPodService.exe[5056] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iPod\bin\iPodService.exe[5056] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iPod\bin\iPodService.exe[5056] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iPod\bin\iPodService.exe[5056] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iPod\bin\iPodService.exe[5056] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iPod\bin\iPodService.exe[5056] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iPod\bin\iPodService.exe[5056] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iPod\bin\iPodService.exe[5056] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iPod\bin\iPodService.exe[5056] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iPod\bin\iPodService.exe[5056] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Program Files\iPod\bin\iPodService.exe[5056] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\unsecapp.exe[5476] ntdll.dll!NtCreateFile + 5 77D0800D 5 Bytes JMP 6176A2F0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\unsecapp.exe[5476] ntdll.dll!NtCreateKey + 5 77D0804D 5 Bytes JMP 6176A32A C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\unsecapp.exe[5476] ntdll.dll!NtDeleteFile + 5 77D083ED 5 Bytes JMP 6176A39E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\unsecapp.exe[5476] ntdll.dll!NtDeleteValueKey + 5 77D0842D 5 Bytes JMP 6176A3D8 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\unsecapp.exe[5476] ntdll.dll!NtMapViewOfSection + 5 77D0875D 5 Bytes JMP 6176A412 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\unsecapp.exe[5476] ntdll.dll!NtOpenFile + 5 77D087ED 5 Bytes JMP 6176A44C C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\unsecapp.exe[5476] ntdll.dll!NtOpenKey + 5 77D0881D 5 Bytes JMP 6176A486 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\unsecapp.exe[5476] ntdll.dll!NtRenameKey + 5 77D08CFD 5 Bytes JMP 6176A4C0 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\unsecapp.exe[5476] ntdll.dll!NtSetInformationFile + 5 77D08F1D 5 Bytes JMP 6176A4FA C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\unsecapp.exe[5476] ntdll.dll!NtSetValueKey + 5 77D0908D 5 Bytes JMP 6176A534 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\unsecapp.exe[5476] ntdll.dll!NtTerminateProcess + 5 77D0912D 5 Bytes JMP 6176A56E C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)
.text C:\Windows\system32\wbem\unsecapp.exe[5476] ntdll.dll!NtCreateUserProcess + 5 77D0943D 5 Bytes JMP 6176A364 C:\Windows\SYSTEM32\SYSFER.DLL (Symantec CMC Firewall sysfer/Symantec Corporation)

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\tdx \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\tdx \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- EOF - GMER 1.0.15 —-

CatByte

Post #4June 8, 2009, 11:11 PM UTC

Hi,

Your system is showing you have symantec endpoint protection, zone alarm security suite, Kaspersky Internet security.

You should only have one antivirus, more than one can cause conficts, system crashes, false positives and slowdowns. choose one antivirus and uninstall the rest.

Please do the following:

Please download ATF Cleaner by Atribune.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
- If you use Firefox browser
- Click Firefox at the top and choose: Select All
Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
It's normal after running ATF cleaner that the PC will be slower to boot the first time.

NEXT

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Run an on-line scan with Kaspersky

Please do a scan with Kaspersky Online Scanner. Please note: Kaspersky requires Java Runtime Environment (JRE) be installed before scanning for malware, as ActiveX is no longer being used.)

If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Open the Kaspersky WebScanner
page.
Click on the 🖼Click to load external image (Posted Image) button on the main page.
The program will launch and fill in the Information section on the left.
Read the "Requirements and Limitations" then press the 🖼Click to load external image (Posted Image) button.
The program will begin downloading the latest program and definition files. It may take a while so please be patient and let it finish.

under the Scan section on the left:
Select My Computer
The program will now start and scan your system. This will run for a while, be patient and let it finish.
Once the scan is complete, click on View scan report
Now, click on the Save Report as button.
Save the file to your desktop.
Copy and paste that information in your next post.

You can refer to this animation by sundavis.

In your next reply please include

MBAM Log
Kaspersky report

CatByte

Post #5June 14, 2009, 12:37 AM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

[Closed] Symantec Endpoint Protection/Reoccuring Tracking Cookie

✨ Ask AI

Ask AI