[Resolved] Internet Explorer error message "Internet Explore

kbl Topic Starter

Post #1June 13, 2009, 9:50 PM UTC

Internet Explorer not connecting on desktop computer (AT&T wireless) . My laptop connects to Internet Explorer with no problem. Called AT&T tech support, but could not resolve the issue. No IP address on desktop computer. Disconnected modem for 30 minutes or so. Still no IP address. The problem occurred after a family member opened an unfamilar link from a MySpace page. May have a virus now.

ile of Trend Micro HijackThis v2.0.2
Scan saved at 5:07:33 PM, on 6/13/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Xobni\XobniService.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe
C:\Program Files\Dell Photo AIO Printer 942\memcard.exe
C:\Program Files\2Wire HomePortal Monitor\2PortalMon.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\eFax Messenger 4.0\J2GDllCmd.exe
C:\Program Files\eFax Messenger 4.0\J2GTray.exe
C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe
C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe
C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe
C:\Program Files\FastAccessDSL\HelpCenter43\agent\bin\bcont_nm.exe
C:\Program Files\EA Games\Command and Conquer Generals\worldbuilder.exe
C:\Documents and Settings\Kathi\Application Data\U3\0000161A527530ED\LaunchPad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bellsouth.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar1.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
O2 - BHO: (no name) - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
O2 - BHO: AIM Toolbar Loader - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: AIM Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar1.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [Dell Photo AIO Printer 942] "C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe"
O4 - HKLM\..\Run: [DellMCM] "C:\Program Files\Dell Photo AIO Printer 942\memcard.exe"
O4 - HKLM\..\Run: [2wSysTray] C:\Program Files\2Wire HomePortal Monitor\2PortalMon.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [HelpCenter4.1] C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe /P HelpCenter4.1
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [cftmon] C:\WINDOWS\system32\xcdk.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [kell] c:\program Files\Manson\liser.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [kell] c:\program Files\Manson\liser.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: eFax DllCmd 4.0.lnk = C:\Program Files\eFax Messenger 4.0\J2GDllCmd.exe
O4 - Global Startup: eFax Tray Menu 4.0.lnk = C:\Program Files\eFax Messenger 4.0\J2GTray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Xobni\Skype4Com.dll
O20 - AppInit_DLLs: c:\progra~1\Manson\liser.dll
O20 - Winlogon Notify: fbaead - C:\WINDOWS\system32\fbaead.dll (file missing)
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: XobniService - Xobni Corporation - C:\Program Files\Xobni\XobniService.exe

–
End of file - 10801 bytes

CatByte

Post #2June 14, 2009, 12:25 AM UTC

Hi and Welcome,

NOTE:

Malware removal is NOT instantaneous.
Most infections require more than one round to properly eradicate.
Absence of symptoms does not always mean the job is complete.
You can be certain that I will advise you when the computer is clean.
Kindly follow my instructions in the order posted.
Please resist the urge to run further scans or fix items on your own without my direction.

Please do the following:

STEP #1

Please download DDS and save it to your desktop.

Disable any script blocking protection
Double click dds.pif to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.

STEP #2

Download the GMER Rootkit Scanner. Unzip it to your Desktop.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
Double-click gmer.exe. The program will begin to run.
**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!
If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

Please describe how your computer is behaving at the moment, listing any symptoms and problems that you are experiencing.

kbl

Post #3June 14, 2009, 2:50 PM UTC

Hi and Thank you CatByte,

Here are the requested logs:

HDDS (Ver_09-05-14.01) - NTFSx86
Run by [removed] at 21:58:53.92 on Sat 06/13/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1270.674 [GMT -4:00]

AV: McAfee VirusScan *On-access scanning disabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Xobni\XobniService.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe
C:\Program Files\Dell Photo AIO Printer 942\memcard.exe
C:\Program Files\2Wire HomePortal Monitor\2PortalMon.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\tempie\ienet.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe
C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe
C:\Program Files\FastAccessDSL\HelpCenter43\agent\bin\bcont_nm.exe
C:\Documents and Settings\Justa notha\Application Data\U3\0000161A527530ED\LaunchPad.exe
G:\dds.pif

============== Pseudo HJT Report ===============

uStart Page = hxxp://my.att.net/
uDefault_Page_URL = hxxp://www.dell4me.com/myway
uSearch Bar = hxxp://bfc.myway.com/search/de_srchlft.html
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
mURLSearchHooks: H - No File
mWinlogon: Userinit=c:\windows\system32\userinit.exe
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar1.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO: {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - No File
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\progra~1\mcafee\viruss~1\scriptsn.dll
BHO: AIM Toolbar Loader: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - c:\program files\aim toolbar\aimtb.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar1.dll
TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [DellTransferAgent] "c:\documents and settings\all users\application data\dell\transferagent\TransferAgent.exe"
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
uRun: [ienet] c:\windows\tempie\ienet.exe
mRun: [IntelMeM] c:\program files\intel\modem event monitor\IntelMEM.exe
mRun: [Dell Photo AIO Printer 942] "c:\program files\dell photo aio printer 942\dlbubmgr.exe"
mRun: [DellMCM] "c:\program files\dell photo aio printer 942\memcard.exe"
mRun: [2wSysTray] c:\program files\2wire homeportal monitor\2PortalMon.exe
mRun: [MPFExe] c:\progra~1\mcafee.com\person~1\MpfTray.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [HelpCenter4.1] c:\program files\fastaccessdsl\helpcenter43\bin\sprtcmd.exe /P HelpCenter4.1
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [cftmon] c:\windows\system32\xcdk.exe
dRun: [kell] c:\program files\manson\liser.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\efaxdl~1.lnk - c:\program files\efax messenger 4.0\J2GDllCmd.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\efaxtr~1.lnk - c:\program files\efax messenger 4.0\J2GTray.exe
IE: &AIM Toolbar Search - c:\documents and settings\all users\application data\aim toolbar\ietoolbar\resources\en-us\local\search.html
IE: &Search - ?p=ZJxdm028MBUS
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {0b83c99c-1efa-4259-858f-bcb33e007a5b} - {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/9/b/d/9bdc68ef-6a9f-4505-8fb8-d0d2d160e512/LegitCheckControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\xobni\Skype4COM.dll
Notify: fbaead - c:\windows\system32\fbaead.dll
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\progra~1\manson\liser.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2008-11-11 213640]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2008-11-11 206112]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2008-11-11 359952]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-12-15 49228]
R2 XobniService;XobniService;c:\program files\xobni\XobniService.exe [2009-3-6 45288]
S0 6ac86315e2a71f7698b6d2aa07972ab9;6ac86315e2a71f7698b6d2aa07972ab9;c:\windows\system32\6ac86315e2a71f7698b6d2aa07972ab9.sys –> c:\windows\system32\6ac86315e2a71f7698b6d2aa07972ab9.sys [?]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\magix\common\database\bin\fbserver.exe [2009-4-1 1552476]
S3 isadisk;isadisk;c:\windows\system32\isadisk.sys [2004-8-4 2304]
S3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2008-11-11 606736]
S3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2008-11-11 79304]
S3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2008-11-11 35272]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2008-11-11 34216]
S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2008-11-11 40552]
S3 QtsDongle;USB Software Key;c:\windows\system32\qtsusk.sys [2008-3-30 10752]

=============== Created Last 30 ================

2009-06-13 17:05 –d—– c:\program files\Trend Micro
2009-06-10 22:33 67,584 a——- c:\windows\system32\10.tmp
2009-06-10 20:22 –d—– c:\windows\dhcp
2009-06-10 20:22 –d—– c:\windows\system32\3361
2009-06-10 20:22 108,336 a——- c:\windows\system32\MSWINSCK.OCX
2009-06-10 20:21 179,200 a——- c:\windows\system32\tpsaxyd.exe
2009-06-10 20:21 –dshr– c:\program files\Manson
2009-06-10 12:10 182,656 a——- c:\windows\system32\dllcache\ndis.sys
2009-06-10 12:09 0 a——- c:\windows\system32\3F.tmp
2009-06-10 12:09 67,584 a——- c:\windows\system32\3E.tmp
2009-06-10 12:08 80 a——- c:\windows\system32\3A.tmp
2009-06-09 20:34 217 a——- c:\windows\system32\winset.ini
2009-06-09 20:32 –d—– c:\windows\tempie
2009-06-07 13:55 54,156 a—h— c:\windows\QTFont.qfn
2009-06-07 13:55 1,409 a——- c:\windows\QTFont.for
2009-05-30 12:42 587 a——- c:\windows\system32\runrefog.lnk
2009-05-29 20:39 –d—– c:\windows\system32\scripting
2009-05-29 20:39 –d—– c:\windows\l2schemas
2009-05-29 20:39 –d—– c:\windows\system32\en
2009-05-29 20:39 –d—– c:\windows\system32\bits
2009-05-29 20:37 –d—– c:\windows\ServicePackFiles
2009-05-29 20:28 –d—– c:\windows\EHome
2009-05-19 15:30 -cd-h— c:\windows\ie8
2009-05-19 15:00 901 a——- c:\windows\Active Setup Log.BAK

==================== Find3M ====================

2009-06-10 12:10 182,656 a——- c:\windows\system32\drivers\ndis.sys
2009-05-29 20:43 78,199 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-05-14 14:05 530,083 a——- C:\HC4DecommissionScheduler.exe
2009-04-25 01:30 102,400 ——– c:\windows\system32\dllcache\iecompat.dll
2009-04-20 19:01 95,638 a——- c:\windows\scunin.dat
2009-04-20 19:01 118,784 a——- c:\windows\ScUnin.exe
2009-04-16 23:28 717,296 a——- c:\windows\system32\drivers\sptd.sys
2009-04-08 11:15 34 a——- c:\documents and settings\justa notha\jagex_runescape_preferences.dat
2009-03-21 10:06 989,696 ——– c:\windows\system32\dllcache\kernel32.dll
2005-11-14 19:17 856,220 ac—— c:\program files\QBASIC.exe
2005-09-12 20:33 848 ac-sh— c:\windows\system32\KGyGaAvL.sys
2008-07-31 23:31 32,768 a–sh— c:\windows\temp\history\history.ie5\mshist012008073120080801\index.dat

============= FINISH: 21:59:06.45 ==========

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-05-14.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 2/27/2005 6:33:00 PM
System Uptime: 6/13/2009 12:25:12 AM (21 hours ago)

Motherboard: Dell Inc. | | 0M3918
Processor: Intel® Pentium® 4 CPU 2.80GHz | Microprocessor | 2793/800mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 71 GiB total, 45.745 GiB free.
D: is CDROM ()
E: is CDROM (CDFS)
F: is CDROM ()
G: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1534: 3/16/2009 3:00:39 AM - Software Distribution Service 3.0
RP1535: 3/17/2009 3:17:21 AM - System Checkpoint
RP1536: 3/18/2009 4:17:21 AM - System Checkpoint
RP1537: 3/19/2009 5:17:05 AM - System Checkpoint
RP1538: 3/20/2009 5:39:59 AM - System Checkpoint
RP1539: 3/21/2009 9:48:57 AM - System Checkpoint
RP1540: 3/22/2009 10:20:58 AM - System Checkpoint
RP1541: 3/23/2009 11:20:57 AM - System Checkpoint
RP1542: 3/24/2009 11:32:58 AM - System Checkpoint
RP1543: 3/25/2009 11:40:10 AM - System Checkpoint
RP1544: 3/30/2009 11:09:45 AM - System Checkpoint
RP1545: 3/31/2009 11:44:21 AM - System Checkpoint
RP1546: 4/1/2009 12:20:28 PM - System Checkpoint
RP1547: 4/1/2009 10:34:27 PM - Installed Text-To-Speech-Runtime
RP1548: 4/2/2009 10:04:50 AM - Installed Java™ 6 Update 13
RP1549: 4/3/2009 10:21:33 AM - System Checkpoint
RP1550: 4/4/2009 11:20:28 AM - System Checkpoint
RP1551: 4/6/2009 4:00:32 PM - System Checkpoint
RP1552: 4/7/2009 5:24:31 PM - System Checkpoint
RP1553: 4/8/2009 6:13:29 PM - System Checkpoint
RP1554: 4/9/2009 6:30:53 PM - System Checkpoint
RP1555: 4/10/2009 7:13:28 PM - System Checkpoint
RP1556: 4/11/2009 8:13:27 PM - System Checkpoint
RP1557: 4/12/2009 9:06:11 PM - System Checkpoint
RP1558: 4/13/2009 9:13:27 PM - System Checkpoint
RP1559: 4/14/2009 10:56:12 PM - System Checkpoint
RP1560: 4/15/2009 11:32:57 PM - System Checkpoint
RP1561: 4/16/2009 3:00:28 AM - Software Distribution Service 3.0
RP1562: 4/16/2009 11:28:54 PM - SPTD setup V1.56
RP1563: 4/18/2009 1:58:04 AM - System Checkpoint
RP1564: 4/19/2009 2:21:33 AM - System Checkpoint
RP1565: 4/20/2009 3:17:38 AM - System Checkpoint
RP1566: 4/21/2009 4:17:37 AM - System Checkpoint
RP1567: 4/22/2009 4:53:56 AM - System Checkpoint
RP1568: 4/23/2009 4:55:45 AM - System Checkpoint
RP1569: 4/24/2009 4:59:26 AM - System Checkpoint
RP1570: 4/25/2009 11:18:00 AM - System Checkpoint
RP1571: 4/26/2009 4:02:19 PM - System Checkpoint
RP1572: 4/27/2009 4:59:18 PM - System Checkpoint
RP1573: 4/28/2009 5:00:23 PM - System Checkpoint
RP1574: 4/29/2009 3:00:27 AM - Software Distribution Service 3.0
RP1575: 4/30/2009 3:58:53 AM - System Checkpoint
RP1576: 5/1/2009 4:22:53 AM - System Checkpoint
RP1577: 5/2/2009 4:58:56 AM - System Checkpoint
RP1578: 5/3/2009 5:58:53 AM - System Checkpoint
RP1579: 5/4/2009 7:16:36 AM - System Checkpoint
RP1580: 5/5/2009 7:58:54 AM - System Checkpoint
RP1581: 5/6/2009 8:58:53 AM - System Checkpoint
RP1582: 5/7/2009 9:58:53 AM - System Checkpoint
RP1583: 5/8/2009 10:58:54 AM - System Checkpoint
RP1584: 5/9/2009 12:22:50 PM - System Checkpoint
RP1585: 5/10/2009 2:23:59 PM - System Checkpoint
RP1586: 5/11/2009 3:22:23 PM - System Checkpoint
RP1587: 5/12/2009 4:21:17 PM - System Checkpoint
RP1588: 5/13/2009 3:00:22 AM - Software Distribution Service 3.0
RP1589: 5/14/2009 3:21:19 AM - System Checkpoint
RP1590: 5/15/2009 3:57:18 AM - System Checkpoint
RP1591: 5/16/2009 4:21:18 AM - System Checkpoint
RP1592: 5/17/2009 4:56:57 AM - System Checkpoint
RP1593: 5/18/2009 5:56:57 AM - System Checkpoint
RP1594: 5/19/2009 6:56:57 AM - System Checkpoint
RP1595: 5/19/2009 3:31:15 PM - Installed Windows Internet Explorer 8.
RP1596: 5/19/2009 3:32:46 PM - Software Distribution Service 3.0
RP1597: 5/20/2009 7:57:53 PM - System Checkpoint
RP1598: 5/21/2009 11:28:52 PM - System Checkpoint
RP1599: 5/23/2009 12:17:22 AM - System Checkpoint
RP1600: 5/24/2009 1:11:26 AM - System Checkpoint
RP1601: 5/25/2009 1:54:37 AM - System Checkpoint
RP1602: 5/26/2009 2:40:30 AM - System Checkpoint
RP1603: 5/27/2009 3:40:30 AM - System Checkpoint
RP1604: 5/28/2009 4:40:30 AM - System Checkpoint
RP1605: 5/29/2009 7:05:50 AM - System Checkpoint
RP1606: 5/29/2009 8:21:05 PM - Software Distribution Service 3.0
RP1607: 5/30/2009 3:00:19 AM - Software Distribution Service 3.0
RP1608: 5/31/2009 3:22:31 AM - System Checkpoint
RP1609: 6/1/2009 4:22:31 AM - System Checkpoint
RP1610: 6/2/2009 5:22:31 AM - System Checkpoint
RP1611: 6/3/2009 6:34:31 AM - System Checkpoint
RP1612: 6/4/2009 8:46:33 AM - System Checkpoint
RP1613: 6/5/2009 11:15:40 AM - System Checkpoint
RP1614: 6/6/2009 3:48:25 PM - System Checkpoint
RP1615: 6/7/2009 4:06:57 PM - System Checkpoint
RP1616: 6/8/2009 6:23:12 PM - System Checkpoint
RP1617: 6/9/2009 10:14:48 PM - System Checkpoint
RP1618: 6/11/2009 9:20:01 AM - System Checkpoint
RP1619: 6/13/2009 12:50:05 AM - System Checkpoint

==== Installed Programs ======================

7-Zip 4.42
ABBYY FineReader 5.0 Sprint Plus
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Reader 7.0
Adobe Shockwave Player
AIM 6
Aim Plugin for QQ Games
AIM Toolbar
AIMTunes
AOL Explorer
AOL Instant Messenger
AOL Uninstaller (Choose which Products to Remove)
Ask Toolbar
Banctec Service Agreement
BitTorrent
BroadJump Client Foundation
Citrix Presentation Server Client - Web Only
Command & Conquer Generals
Critical Update for Windows Media Player 11 (KB959772)
DAEMON Tools Toolbar
Dell Digital Jukebox Driver
Dell Driver Reset Tool
Dell Media Experience
Dell Media Experience Update
Dell Photo AIO Printer 942
Dell System Restore
DellConnect
DellSupport
DNA
Download Updater (AOL LLC)
EarthLink setup files
eFax Messenger 4.0
FastAccess® DSL Help Center 4.3
Firebird SQL Server - MAGIX Edition
G10A942EN
Game Maker 7.0
GearPlayer
Get High Speed Internet!
Gimp 2.6.2 Debug
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
hp deskjet 5550 series
hp deskjet 5550 series (Remove only)
hp print screen utility
Intel® 537EP V9x DF PCI Modem
Intel® Graphics Media Accelerator Driver
Intel® PRO Network Adapters and Drivers
Intel® PROSet for Wired Connections
InterActual Player
Internet Explorer Default Page
J2SE Runtime Environment 5.0 Update 4
Jasc Paint Shop Photo Album
Jasc Paint Shop Pro 8 Dell Edition
Java 2 Runtime Environment, SE v1.4.2_03
Java 2 Runtime Environment, SE v1.4.2_06
Java™ 6 Update 13
Learn2 Player (Uninstall Only)
Machines at War Demo
MAGIX Music Maker 14 Trial 13.0.2.1 (US)
MAGIX Screenshare 4.3.6.1987 (US)
Malwarebytes' Anti-Malware
McAfee Personal Firewall Plus
McAfee SecurityCenter
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Modem Event Monitor
Modem Helper
Modem On Hold
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
My Way Search Assistant
Photo Click
Pivot Stickfigure Animator
Plaxo Toolbar for Outlook and Outlook Express
PowerDVD 5.3
QQ Games
QuickTime
RealPlayer
Roblox for Justa notha
School Tycoon
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
Sonic DLA
Sonic MyDVD
Sonic RecordNow!
Sonic Update Manager
Sound Club
Spybot - Search & Destroy
Starcraft
Stedman's Cardiovascular & Pulmonary Words 1.0
Text-To-Speech-Runtime
The Sims 2
The Weather Channel
Tradewinds 2 (remove only)
Typing Instructor Deluxe
Update for Windows Internet Explorer 8 (KB969497)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Viewpoint Media Player
Visual C++ 8.0 ATL (x86) WinSXS MSM
Visual C++ 8.0 CRT (x86) WinSXS MSM
Watchtower Library 2005 - English Edition
Watchtower Library 2007 - English
WebFldrs XP
Windows Defender Signatures
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 11
Windows XP Service Pack 3
WordPerfect Office 12
Xobni
Xobni Core

==== Event Viewer Messages From Past Week ========

6/9/2009 7:40:37 AM, error: Print [6161] - The document Microsoft Word - JohnCC.doc owned by Justa notha failed to print on printer Dell Photo AIO Printer 942. Data type: LEMF. Size of the spool file in bytes: 1920704. Number of bytes printed: 1920704. Total number of pages in the document: 2. Number of pages printed: 0. Client machine: \\TEENTITANS. Win32 error code returned by the print processor: 126 (0x7e).
6/9/2009 7:23:28 AM, error: Print [6161] - The document Microsoft Word - JohnCC.doc owned by Justa notha failed to print on printer Dell Photo AIO Printer 942. Data type: LEMF. Size of the spool file in bytes: 1920548. Number of bytes printed: 1920548. Total number of pages in the document: 2. Number of pages printed: 0. Client machine: \\TEENTITANS. Win32 error code returned by the print processor: 126 (0x7e).
6/9/2009 7:22:40 AM, error: Service Control Manager [7034] - The Windows Image Acquisition (WIA) service terminated unexpectedly. It has done this 1 time(s).
6/12/2009 12:08:16 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Fips intelppm mfehidk
6/11/2009 9:03:36 AM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume.
6/11/2009 9:03:36 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: abp480n5 adpu160m agp440 agpCPQ Aha154x aic78u2 aic78xx AliIde alim1541 amdagp amsint asc asc3350p asc3550 cbidf cd20xrnt CmdIde Cpqarray dac2w2k dac960nt dpti2o hpn i2omp ini910u IntelIde mraid35x perc2 perc2hib ql1080 Ql10wnt ql12160 ql1240 ql1280 sisagp Sparrow symc810 symc8xx sym_hi sym_u3 TosIde ultra viaagp ViaIde
6/11/2009 12:59:20 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
6/11/2009 12:47:55 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
6/11/2009 11:17:48 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service McNASvc with arguments "" in order to run the server: {24F616A1-B755-4053-8018-C3425DC8B68A}
6/11/2009 11:16:42 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec mfehidk MPFIREWL MPFP MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
6/11/2009 11:16:42 AM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
6/11/2009 11:16:42 AM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
6/11/2009 11:16:42 AM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
6/11/2009 11:16:20 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
6/11/2009 11:16:14 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
6/11/2009 1:10:53 PM, error: DCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {0C0A3666-30C9-11D0-8F20-00805F2CD064} to the user TEENTITANS\Family SID (S-1-5-21-3379101820-3252730855-79647382-1011). This security permission can be modified using the Component Services administrative tool.
6/11/2009 1:09:27 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Print Spooler service to connect.
6/11/2009 1:09:27 PM, error: Service Control Manager [7001] - The Fax service depends on the Print Spooler service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
6/11/2009 1:09:27 PM, error: Service Control Manager [7000] - The Print Spooler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2009 11:59:28 PM, error: Service Control Manager [7034] - The msncache service terminated unexpectedly. It has done this 1 time(s).
6/10/2009 11:59:09 PM, error: Service Control Manager [7003] - The DHCP Client service depends on the following nonexistent service: dhcpsrv
6/10/2009 11:52:45 PM, error: Service Control Manager [7034] - The sopidkc Service service terminated unexpectedly. It has done this 1 time(s).
6/10/2009 11:52:45 PM, error: Service Control Manager [7034] - The Dhcp server service terminated unexpectedly. It has done this 1 time(s).

==== End Of File ===========================

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-06-14 10:25:04
Windows 5.1.2600 Service Pack 3

—- System - GMER 1.0.15 —-

INT 0x62 ? 8A342BF8
INT 0x63 ? 8A120F00
INT 0x73 ? 8A342BF8
INT 0x94 ? 8A120F00
INT 0xA4 ? 8A120F00
INT 0xB4 ? 8A120F00

Code 8A1FA500 pIofCallDriver

—- Kernel code sections - GMER 1.0.15 —-

? spau.sys The system cannot find the file specified. !
.text USBPORT.SYS!DllUnload B96208AC 5 Bytes JMP 8A1204E0
.text av22mccn.SYS B92FF386 35 Bytes [00, 00, 00, 00, 00, 00, 20, …]
.text av22mccn.SYS B92FF3AA 24 Bytes [00, 00, 00, 00, 00, 00, 00, …]
.text av22mccn.SYS B92FF3C4 3 Bytes [00, 70, 02] {ADD [EAX+0x2], DH}
.text av22mccn.SYS B92FF3C9 1 Byte [2E]
.text av22mccn.SYS B92FF3C9 11 Bytes [2E, 00, 00, 00, 5C, 02, 00, …] {ADD CS:[EAX], AL; ADD [EDX+EAX+0x0], BL; ADD [EAX], AL; ADD [EAX], AL}
.text …

—- User code sections - GMER 1.0.15 —-

.text C:\Documents and Settings\Kathi\My Documents\gmer.exe[160] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Documents and Settings\Kathi\My Documents\gmer.exe[160] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Documents and Settings\Kathi\My Documents\gmer.exe[160] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Documents and Settings\Kathi\My Documents\gmer.exe[160] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Documents and Settings\Kathi\My Documents\gmer.exe[160] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Documents and Settings\Kathi\My Documents\gmer.exe[160] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\Program Files\McAfee\SiteAdvisor\McSACore.exe[164] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\McAfee\SiteAdvisor\McSACore.exe[164] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\McAfee\SiteAdvisor\McSACore.exe[164] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\McAfee\SiteAdvisor\McSACore.exe[164] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\McAfee\SiteAdvisor\McSACore.exe[164] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\McAfee\SiteAdvisor\McSACore.exe[164] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\Program Files\Common Files\Motive\McciCMService.exe[196] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\Common Files\Motive\McciCMService.exe[196] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\Common Files\Motive\McciCMService.exe[196] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\Common Files\Motive\McciCMService.exe[196] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\Common Files\Motive\McciCMService.exe[196] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\Common Files\Motive\McciCMService.exe[196] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[240] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[240] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[240] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[240] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[240] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[240] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe[272] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe[272] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe[272] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe[272] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe[272] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe[272] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[348] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[348] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[348] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[348] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[348] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[348] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[348] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0041C130 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[348] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 0041C1B0 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\Program Files\Viewpoint\Common\ViewpointService.exe[376] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\Viewpoint\Common\ViewpointService.exe[376] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\Viewpoint\Common\ViewpointService.exe[376] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\Viewpoint\Common\ViewpointService.exe[376] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\Viewpoint\Common\ViewpointService.exe[376] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\Viewpoint\Common\ViewpointService.exe[376] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\Program Files\McAfee\MSK\MskSrver.exe[388] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\McAfee\MSK\MskSrver.exe[388] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\McAfee\MSK\MskSrver.exe[388] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\McAfee\MSK\MskSrver.exe[388] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\McAfee\MSK\MskSrver.exe[388] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\McAfee\MSK\MskSrver.exe[388] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[428] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[428] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[428] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[428] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[428] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[428] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe[488] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe[488] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe[488] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe[488] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe[488] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe[488] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\Program Files\DellSupport\DSAgnt.exe[664] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\DellSupport\DSAgnt.exe[664] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\DellSupport\DSAgnt.exe[664] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\DellSupport\DSAgnt.exe[664] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\DellSupport\DSAgnt.exe[664] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\DellSupport\DSAgnt.exe[664] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\Program Files\FastAccessDSL\HelpCenter43\agent\bin\bcont_nm.exe[668] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\FastAccessDSL\HelpCenter43\agent\bin\bcont_nm.exe[668] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\FastAccessDSL\HelpCenter43\agent\bin\bcont_nm.exe[668] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\FastAccessDSL\HelpCenter43\agent\bin\bcont_nm.exe[668] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\FastAccessDSL\HelpCenter43\agent\bin\bcont_nm.exe[668] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\FastAccessDSL\HelpCenter43\agent\bin\bcont_nm.exe[668] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\WINDOWS\system32\svchost.exe[692] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\WINDOWS\system32\svchost.exe[692] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\WINDOWS\system32\svchost.exe[692] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\WINDOWS\system32\svchost.exe[692] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\WINDOWS\system32\svchost.exe[692] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\WINDOWS\system32\svchost.exe[692] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\WINDOWS\system32\igfxpers.exe[720] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\WINDOWS\system32\igfxpers.exe[720] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\WINDOWS\system32\igfxpers.exe[720] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\WINDOWS\system32\igfxpers.exe[720] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\WINDOWS\system32\igfxpers.exe[720] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\WINDOWS\system32\igfxpers.exe[720] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\WINDOWS\system32\winlogon.exe[840] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FF9479C
.text C:\WINDOWS\system32\winlogon.exe[840] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FF9482B
.text C:\WINDOWS\system32\winlogon.exe[840] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FF94838
.text C:\WINDOWS\system32\winlogon.exe[840] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FF94ABC
.text C:\WINDOWS\system32\winlogon.exe[840] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FF94821
.text C:\WINDOWS\system32\winlogon.exe[840] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FF94879
.text C:\WINDOWS\system32\services.exe[884] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\WINDOWS\system32\services.exe[884] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\WINDOWS\system32\services.exe[884] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\WINDOWS\system32\services.exe[884] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\WINDOWS\system32\services.exe[884] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\WINDOWS\system32\services.exe[884] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\WINDOWS\system32\lsass.exe[900] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FF9479C
.text C:\WINDOWS\system32\lsass.exe[900] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FF9482B
.text C:\WINDOWS\system32\lsass.exe[900] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FF94838
.text C:\WINDOWS\system32\lsass.exe[900] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FF94ABC
.text C:\WINDOWS\system32\lsass.exe[900] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FF94821
.text C:\WINDOWS\system32\lsass.exe[900] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FF94879
.text C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe[1048] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe[1048] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe[1048] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe[1048] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe[1048] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe[1048] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\WINDOWS\system32\svchost.exe[1088] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\WINDOWS\system32\svchost.exe[1088] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\WINDOWS\system32\svchost.exe[1088] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\WINDOWS\system32\svchost.exe[1088] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\WINDOWS\system32\svchost.exe[1088] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\WINDOWS\system32\svchost.exe[1088] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\WINDOWS\system32\svchost.exe[1140] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\WINDOWS\system32\svchost.exe[1140] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\WINDOWS\system32\svchost.exe[1140] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\WINDOWS\system32\svchost.exe[1140] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\WINDOWS\system32\svchost.exe[1140] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\WINDOWS\system32\svchost.exe[1140] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\WINDOWS\System32\svchost.exe[1204] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FF9479C
.text C:\WINDOWS\System32\svchost.exe[1204] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FF9482B
.text C:\WINDOWS\System32\svchost.exe[1204] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FF94838
.text C:\WINDOWS\System32\svchost.exe[1204] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FF94ABC
.text C:\WINDOWS\System32\svchost.exe[1204] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FF94821
.text C:\WINDOWS\System32\svchost.exe[1204] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FF94879
.text C:\Program Files\Xobni\XobniService.exe[1216] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\Xobni\XobniService.exe[1216] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\Xobni\XobniService.exe[1216] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\Xobni\XobniService.exe[1216] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\Xobni\XobniService.exe[1216] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\Xobni\XobniService.exe[1216] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\Documents and Settings\Justa notha\Application Data\U3\0000161A527530ED\LaunchPad.exe[1228] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Documents and Settings\Justa notha\Application Data\U3\0000161A527530ED\LaunchPad.exe[1228] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Documents and Settings\Justa notha\Application Data\U3\0000161A527530ED\LaunchPad.exe[1228] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Documents and Settings\Justa notha\Application Data\U3\0000161A527530ED\LaunchPad.exe[1228] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Documents and Settings\Justa notha\Application Data\U3\0000161A527530ED\LaunchPad.exe[1228] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Documents and Settings\Justa notha\Application Data\U3\0000161A527530ED\LaunchPad.exe[1228] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\WINDOWS\system32\svchost.exe[1248] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\WINDOWS\system32\svchost.exe[1248] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\WINDOWS\system32\svchost.exe[1248] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\WINDOWS\system32\svchost.exe[1248] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\WINDOWS\system32\svchost.exe[1248] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\WINDOWS\system32\svchost.exe[1248] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\WINDOWS\system32\svchost.exe[1356] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\WINDOWS\system32\svchost.exe[1424] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\WINDOWS\system32\svchost.exe[1424] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\WINDOWS\system32\svchost.exe[1424] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\WINDOWS\system32\svchost.exe[1424] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\WINDOWS\system32\svchost.exe[1424] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\WINDOWS\system32\svchost.exe[1424] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\Program Files\Java\jre6\bin\jusched.exe[1716] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\Java\jre6\bin\jusched.exe[1716] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\Java\jre6\bin\jusched.exe[1716] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\Java\jre6\bin\jusched.exe[1716] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\Java\jre6\bin\jusched.exe[1716] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\Java\jre6\bin\jusched.exe[1716] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\WINDOWS\system32\winlogon.exe[1732] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\WINDOWS\system32\winlogon.exe[1732] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\WINDOWS\system32\winlogon.exe[1732] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\WINDOWS\system32\winlogon.exe[1732] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\WINDOWS\system32\winlogon.exe[1732] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\WINDOWS\system32\winlogon.exe[1732] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\WINDOWS\system32\winlogon.exe[1732] ntdll.dll!DbgUiRemoteBreakin 7C951E13 5 Bytes JMP 7C81CB12 C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1812] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1812] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1812] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1812] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1812] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[1812] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\WINDOWS\Explorer.EXE[1848] Explorer.EXE 0101A57C 4 Bytes [FF, 15, 1C, 11]
.text C:\WINDOWS\Explorer.EXE[1848] C:\WINDOWS\Explorer.EXE section is writeable [0x01001000, 0x44C09, 0xE0000020]
.reloc C:\WINDOWS\Explorer.EXE[1848] C:\WINDOWS\Explorer.EXE section is executable [0x010FB000, 0x8800, 0xE0000040]
.text C:\WINDOWS\Explorer.EXE[1848] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\WINDOWS\Explorer.EXE[1848] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\WINDOWS\Explorer.EXE[1848] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\WINDOWS\Explorer.EXE[1848] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\WINDOWS\Explorer.EXE[1848] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\WINDOWS\Explorer.EXE[1848] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\WINDOWS\tempie\ienet.exe[1880] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\WINDOWS\tempie\ienet.exe[1880] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\WINDOWS\tempie\ienet.exe[1880] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\WINDOWS\tempie\ienet.exe[1880] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\WINDOWS\tempie\ienet.exe[1880] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\WINDOWS\tempie\ienet.exe[1880] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\Program Files\2Wire HomePortal Monitor\2PortalMon.exe[1916] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\2Wire HomePortal Monitor\2PortalMon.exe[1916] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\2Wire HomePortal Monitor\2PortalMon.exe[1916] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\2Wire HomePortal Monitor\2PortalMon.exe[1916] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\2Wire HomePortal Monitor\2PortalMon.exe[1916] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\2Wire HomePortal Monitor\2PortalMon.exe[1916] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\WINDOWS\system32\svchost.exe[1980] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\WINDOWS\system32\svchost.exe[1980] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\WINDOWS\system32\svchost.exe[1980] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\WINDOWS\system32\svchost.exe[1980] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\WINDOWS\system32\svchost.exe[1980] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\WINDOWS\system32\svchost.exe[1980] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\Program Files\Java\jre6\bin\jqs.exe[2036] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\Java\jre6\bin\jqs.exe[2036] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\Java\jre6\bin\jqs.exe[2036] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\Java\jre6\bin\jqs.exe[2036] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\Java\jre6\bin\jqs.exe[2036] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\Java\jre6\bin\jqs.exe[2036] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\Program Files\Messenger\msmsgs.exe[2112] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\Messenger\msmsgs.exe[2112] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\Messenger\msmsgs.exe[2112] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\Messenger\msmsgs.exe[2112] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\Messenger\msmsgs.exe[2112] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\Messenger\msmsgs.exe[2112] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text c:\PROGRA~1\mcafee.com\agent\mcagent.exe[2268] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text c:\PROGRA~1\mcafee.com\agent\mcagent.exe[2268] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text c:\PROGRA~1\mcafee.com\agent\mcagent.exe[2268] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text c:\PROGRA~1\mcafee.com\agent\mcagent.exe[2268] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text c:\PROGRA~1\mcafee.com\agent\mcagent.exe[2268] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text c:\PROGRA~1\mcafee.com\agent\mcagent.exe[2268] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe[2280] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe[2280] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe[2280] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe[2280] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe[2280] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe[2280] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\WINDOWS\system32\ctfmon.exe[2608] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\WINDOWS\system32\ctfmon.exe[2608] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\WINDOWS\system32\ctfmon.exe[2608] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\WINDOWS\system32\ctfmon.exe[2608] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\WINDOWS\system32\ctfmon.exe[2608] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\WINDOWS\system32\ctfmon.exe[2608] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text c:\PROGRA~1\mcafee\msc\mcupdmgr.exe[2616] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text c:\PROGRA~1\mcafee\msc\mcupdmgr.exe[2616] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text c:\PROGRA~1\mcafee\msc\mcupdmgr.exe[2616] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text c:\PROGRA~1\mcafee\msc\mcupdmgr.exe[2616] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text c:\PROGRA~1\mcafee\msc\mcupdmgr.exe[2616] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text c:\PROGRA~1\mcafee\msc\mcupdmgr.exe[2616] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe[2800] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe[2800] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe[2800] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe[2800] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe[2800] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe[2800] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\Program Files\DNA\btdna.exe[2852] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\DNA\btdna.exe[2852] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\DNA\btdna.exe[2852] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\DNA\btdna.exe[2852] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\DNA\btdna.exe[2852] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\DNA\btdna.exe[2852] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe[3112] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe[3112] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe[3112] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe[3112] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe[3112] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe[3112] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\Program Files\Dell Photo AIO Printer 942\memcard.exe[3296] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\Dell Photo AIO Printer 942\memcard.exe[3296] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\Dell Photo AIO Printer 942\memcard.exe[3296] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\Dell Photo AIO Printer 942\memcard.exe[3296] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\Dell Photo AIO Printer 942\memcard.exe[3296] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\Dell Photo AIO Printer 942\memcard.exe[3296] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\WINDOWS\system32\hkcmd.exe[3312] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\WINDOWS\system32\hkcmd.exe[3312] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\WINDOWS\system32\hkcmd.exe[3312] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\WINDOWS\system32\hkcmd.exe[3312] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\WINDOWS\system32\hkcmd.exe[3312] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\WINDOWS\system32\hkcmd.exe[3312] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\WINDOWS\system32\wscntfy.exe[3560] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\WINDOWS\system32\wscntfy.exe[3560] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\WINDOWS\system32\wscntfy.exe[3560] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\WINDOWS\system32\wscntfy.exe[3560] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\WINDOWS\system32\wscntfy.exe[3560] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\WINDOWS\system32\wscntfy.exe[3560] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe[4040] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe[4040] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe[4040] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe[4040] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe[4040] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe[4040] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879
.text C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe[4048] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes CALL 7FFA479C
.text C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe[4048] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes CALL 7FFA482B
.text C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe[4048] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes CALL 7FFA4838
.text C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe[4048] ntdll.dll!NtDeviceIoControlFile 7C90D27E 5 Bytes CALL 7FFA4ABC
.text C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe[4048] ntdll.dll!NtOpenFile 7C90D59E 5 Bytes CALL 7FFA4821
.text C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe[4048] ntdll.dll!NtQueryInformationProcess 7C90D7FE 5 Bytes CALL 7FFA4879

—- Kernel IAT/EAT - GMER 1.0.15 —-

IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [B9EA9040] spau.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [B9EA913C] spau.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [B9EA90BE] spau.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [B9EA97FC] spau.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [B9EA96D2] spau.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [B9EB9048] spau.sys
IAT \SystemRoot\System32\Drivers\av22mccn.SYS[HAL.dll!KfAcquireSpinLock] 4B8BDF8B
IAT \SystemRoot\System32\Drivers\av22mccn.SYS[HAL.dll!READ_PORT_UCHAR] 8D3F0304
IAT \SystemRoot\System32\Drivers\av22mccn.SYS[HAL.dll!KeGetCurrentIrql] CB033043
IAT \SystemRoot\System32\Drivers\av22mccn.SYS[HAL.dll!KfRaiseIrql] 0673C13B
IAT \SystemRoot\System32\Drivers\av22mccn.SYS[HAL.dll!KfLowerIrql] C13B0003
IAT \SystemRoot\System32\Drivers\av22mccn.SYS[HAL.dll!HalGetInterruptVector] 8366FA72
IAT \SystemRoot\System32\Drivers\av22mccn.SYS[HAL.dll!HalTranslateBusAddress] 75000E7B
IAT \SystemRoot\System32\Drivers\av22mccn.SYS[HAL.dll!KeStallExecutionProcessor] 0B7D80E3
IAT \SystemRoot\System32\Drivers\av22mccn.SYS[HAL.dll!KfReleaseSpinLock] 307B8D00
IAT \SystemRoot\System32\Drivers\av22mccn.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 00AA840F
IAT \SystemRoot\System32\Drivers\av22mccn.SYS[HAL.dll!READ_PORT_USHORT] 83660000
IAT \SystemRoot\System32\Drivers\av22mccn.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 6A000E7A
IAT \SystemRoot\System32\Drivers\av22mccn.SYS[HAL.dll!WRITE_PORT_UCHAR] C6647400
IAT \SystemRoot\System32\Drivers\av22mccn.SYS[WMILIB.SYS!WmiSystemControl] 4F8B0200
IAT \SystemRoot\System32\Drivers\av22mccn.SYS[WMILIB.SYS!WmiCompleteRequest] 968D5140

—- User IAT/EAT - GMER 1.0.15 —-

IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorA] [00401004] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!A_SHAInit] 6F420703
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!A_SHAUpdate] 61656C6F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!A_SHAFinal] 0000016E
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!LsaStorePrivateData] 00010000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!LsaRetrievePrivateData] 10000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!LsaNtStatusToWinError] 46050040
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CryptGetUserKey] 65736C61
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CryptGetKeyParam] 75725404
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CryptEncrypt] [00408D65] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CryptSetProvParam] [0040102C] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CryptSignHashW] 68430402
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CryptDeriveKey] 00017261
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CryptGetProvParam] FF000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!RegOpenCurrentUser] 90000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!RegDeleteKeyW] [00401040] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!AddAccessAllowedAceEx] 6E490701
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!RegSetKeySecurity] 65676574
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!I_ScSendTSMessage] 00000472
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!MD5Init] FFFF8000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!MD5Update] C08B7FFF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!MD5Final] [00401058] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!SetFileSecurityA] 79420401
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!AllocateLocallyUniqueId] 00016574
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!LsaOpenPolicy] FF000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!LsaQueryInformationPolicy] 90000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!LsaFreeMemory] [0040106C] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!LsaClose] 6F570401
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!RegNotifyChangeKeyValue] 00036472
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!QueryServiceConfigW] FF000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!SetKernelObjectSecurity] 900000FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!ConvertStringSecurityDescriptorToSecurityDescriptorW] [00401080] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!RegEnumKeyExW] 61430801
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!GetCurrentHwProfileW] 6E696472
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!RegCloseKey] 00056C61
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!RegQueryValueExW] FF000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!RegOpenKeyW] 90FFFFFF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!FreeSid] [00401098] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!SetSecurityDescriptorDacl] 65520404
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!InitializeSecurityDescriptor] 90016C61
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!AddAccessAllowedAce] [004010A4] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!InitializeAcl] 6F570803
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!GetLengthSid] 6F426472
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!AllocateAndInitializeSid] 00026C6F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!RegOpenKeyExW] FF800000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CreateProcessAsUserW] A07FFFFF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!DuplicateTokenEx] 05004010
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CloseServiceHandle] 736C6146
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!ControlService] 72540465
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!StartServiceW] C08B6575
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!QueryServiceStatus] [004010CC] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!OpenServiceW] 6F4C0803
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!OpenSCManagerW] 6F42676E
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!EqualSid] 00046C6F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!GetTokenInformation] FF800000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!RegSetValueExW] C87FFFFF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!RegCreateKeyExW] 05004010
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CryptGenRandom] 736C6146
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CryptDestroyHash] 72540465
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CryptVerifySignatureW] C08B6575
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CryptSetHashParam] [004010F4] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CryptGetHashParam] 7453060A
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CryptHashData] 676E6972
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CryptCreateHash] [00401100] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CryptDecrypt] 69570A0B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!ReportEventW] 74536564
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!RegisterEventSourceW] 676E6972
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CryptImportKey] [00401110] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CryptAcquireContextW] 6156070C
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CryptReleaseContext] 6E616972
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CryptDestroyKey] [00408D74] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!RegEnumValueW] [00401120] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!RegQueryInfoKeyW] 6C4F0A0C
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!RegDeleteValueW] 72615665
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CredFree] 746E6169
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CredDeleteW] [00401130] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CredEnumerateW] 52480701
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CopySid] 4C555345
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!GetSidLengthRequired] 00000454
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!GetSidSubAuthority] FFFF8000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!GetSidSubAuthorityCount] C08B7FFF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!GetUserNameW] [00401190] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!OpenThreadToken] 00000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!EnumServicesStatusW] 00000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!ImpersonateLoggedOnUser] 00000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!RegQueryValueExA] 00000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!CheckTokenMembership] 00000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!DeregisterEventSource] 00000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!LsaGetUserName] 00000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!RevertToSelf] [00401190] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!LookupAccountSidW] 00000004
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!IsValidSid] 00000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!SetTokenInformation] [00403D50] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!LogonUserW] [00403D5C] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!LookupAccountNameW] [00403D60] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!OpenProcessToken] [00403D64] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!SynchronizeWindows31FilesAndWindowsNTRegistry] [00403D58] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!QueryWindows31FilesMigration] [00403A8C] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!AdjustTokenPrivileges] [00403AA8] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ADVAPI32.dll!RegQueryInfoKeyA] [00403AE4] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [GDI32.dll!RemoveFontResourceW] 90FFFF00
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [GDI32.dll!AddFontResourceW] 244483CC
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!WTSGetActiveConsoleSessionId] 83000052
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetTimeFormatW] F8042444
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetUserDefaultLCID] 00530FE9
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!FileTimeToSystemTime] 24448300
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!FileTimeToLocalFileTime] 19E9F804
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetProcAddress] CC000053
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!LoadLibraryW] 401219CC
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetModuleHandleW] 40122300
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!SystemTimeToFileTime] 40122D00
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetSystemTime] 00000100
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!TerminateProcess] 00000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetCurrentProcess] 0000C000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!CreateTimerQueueTimer] 00000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!CreateThread] 40123946
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!lstrcpynW] 00000800
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetShortPathNameW] 00000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetProfileStringW] [00408D00] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!FreeLibrary] [004012B4] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!ReleaseSemaphore] [00401245] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!CreateSemaphoreW] 00000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetSystemInfo] 00000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetComputerNameW] 00000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetEnvironmentVariableW] 00000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!WaitForSingleObjectEx] 00000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!LoadResource] 00000000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!FindResourceW] [004012B4] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!SetThreadExecutionState] 0000000C
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!DeleteTimerQueueTimer] [00401144] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!ResetEvent] [00403D50] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetSystemDirectoryW] [004064E8] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!TransactNamedPipe] [004064F4] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!SetNamedPipeHandleState] [00403D64] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetTickCount] [00403D58] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!CreateFileW] [00406504] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GlobalGetAtomNameW] [00403AA8] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!VirtualLock] [00403AE4] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!VirtualQuery] 6E495411
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetDriveTypeW] 66726574
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!Beep] 64656361
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!ExpandEnvironmentStringsW] 656A624F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!OpenMutexW] C08B7463
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!QueueUserWorkItem] [004012CC] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!DisconnectNamedPipe] [01656D69] C:\WINDOWS\system32\ieframe.dll (Internet Explorer/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!SearchPathW] 03DE25FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!lstrcatW] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!LocalReAlloc] 03C825FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!TerminateThread] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!ResumeThread] 03B225FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetDiskFreeSpaceExW] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GlobalMemoryStatusEx] 039C25FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!DeleteFileW] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!WriteProfileStringW] 038625FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!ReadFile] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!FindVolumeClose] 037025FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!FindNextVolumeW] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!FindFirstVolumeW] 035A25FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!FormatMessageW] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!SetPriorityClass] 034425FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!MoveFileExW] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!WaitForMultipleObjectsEx] 032E25FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetExitCodeProcess] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!SleepEx] 031825FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!InterlockedExchange] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!FindClose] 030225FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!FindFirstFileW] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetWindowsDirectoryW] 02EC25FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!SetTimerQueueTimer] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetComputerNameA] 043625FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetVersionExW] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!WriteFile] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!WaitNamedPipeW] 02C025FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!WaitForMultipleObjects] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!ConnectNamedPipe] 02AA25FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetVersionExA] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!DuplicateHandle] 042025FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!OpenProcess] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetOverlappedResult] 029425FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!lstrcmpW] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!SetEnvironmentVariableW] 027E25FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!UnregisterWait] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!CreateNamedPipeW] 026825FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!CreateRemoteThread] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!CreateActCtxW] 025225FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetModuleFileNameW] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!ExitProcess] 023C25FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!LoadLibraryExW] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!SetErrorMode] 022625FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!SetUnhandledExceptionFilter] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetPrivateProfileStringW] 021025FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!LocalSize] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!VirtualAlloc] 01FA25FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!VirtualQueryEx] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!DebugBreak] 01E425FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!CreateFileA] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!InitializeCriticalSection] 01CE25FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!ProcessIdToSessionId] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!SetInformationJobObject] 01B825FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!AssignProcessToJobObject] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!TerminateJobObject] 01A225FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!PostQueuedCompletionStatus] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!PulseEvent] 040A25FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetQueuedCompletionStatus] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!CreateIoCompletionPort] 018C25FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!CreateJobObjectW] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!ActivateActCtx] [017625FF] C:\WINDOWS\system32\ieframe.dll (Internet Explorer/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!DeactivateActCtx] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!InterlockedCompareExchange] [016025FF] C:\WINDOWS\system32\ieframe.dll (Internet Explorer/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!LoadLibraryA] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!QueryPerformanceCounter] 047825FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetSystemTimeAsFileTime] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!UnhandledExceptionFilter] 046225FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetModuleHandleA] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetStartupInfoA] 044C25FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetCurrentProcessId] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!SetThreadPriority] [014A25FF] C:\WINDOWS\system32\ieframe.dll (Internet Explorer/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetCurrentThreadId] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!lstrcmpiW] [013425FF] C:\WINDOWS\system32\ieframe.dll (Internet Explorer/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetProfileIntW] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!LoadLibraryExA] 04BA25FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!lstrcpyW] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!lstrlenW] 04A425FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!Sleep] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!LocalAlloc] 048E25FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!CreateEventW] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetExitCodeThread] [011E25FF] C:\WINDOWS\system32\ieframe.dll (Internet Explorer/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!SetThreadAffinityMask] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetProcessAffinityMask] [010825FF] C:\WINDOWS\system32\ieframe.dll (Internet Explorer/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!CreateWaitableTimerW] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!CreateMutexW] [00F225FF] C:\WINDOWS\system32\ieframe.dll (Internet Explorer/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!OpenEventW] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!RegisterWaitForSingleObject] 00DC25FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!WaitForSingleObject] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!CreateProcessW] 00C625FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!SetWaitableTimer] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!ReleaseMutex] 00B025FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!SetEvent] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!UnregisterWaitEx] BCC48353
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!CloseHandle] 00000ABB
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!lstrlenA] 49E85400
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!lstrcpyA] F6FFFFFF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!MultiByteToWideChar] [012C2444] C:\WINDOWS\system32\ieframe.dll (Internet Explorer/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetACP] B70F0574
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!WideCharToMultiByte] 8B30245C
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetProcessHeap] C08BC35B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!lstrcpynA] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!UnmapViewOfFile] 008425FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!MapViewOfFile] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!CreateFileMappingW] 006E25FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!lstrcmpiA] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetFileSize] 005825FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!SetFilePointer] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GlobalAlloc] [004225FF] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GlobalFree] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!LocalFree] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!lstrcatA] 001625FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!lstrcmpA] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetLogicalDriveStringsA] 000025FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetDriveTypeA] C08B009F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetVolumeInformationW] F4C48353
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GlobalMemoryStatus] 4A05E8BB
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!CreateMutexA] 003B8300
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!FindResourceExW] 44685975
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!LockResource] 6A000006
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!SizeofResource] FFA6E800
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!VerifyVersionInfoW] 4489FFFF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetSystemDirectoryA] [7C830824] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetCurrentThread] 75000824
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!DelayLoadFailureHook] 89C03307
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!BaseInitAppcompatCacheSupport] 50EB2404
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!OpenProfileUserMapping] 0824448B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!CloseProfileUserMapping] 05E4158B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!BaseCleanupAppcompatCacheSupport] 1089004A
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!InitializeCriticalSectionAndSpinCount] 0824448B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!VirtualProtect] 4A05E4A3
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!CreateEventA] 8BC03300
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!TlsSetValue] 8BD203D0
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!TlsGetValue] 8D08244C
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!TlsAlloc] 8B042454
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!VirtualFree] 8B042454
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!TlsFree] 8B0A890B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!wcslen] F8834013
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_vsnwprintf] 8BDC7564
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!wcsncpy] 24448903
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!wcsstr] 24448B04
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!atoi] 89008B04
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!wcstok] 24448B03
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!memmove] 24048904
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!wcschr] 8324048B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!swprintf] C35B0CC4
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!swscanf] 40890089
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_local_unwind2] C08BC304
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_wcslwr] C4835653
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!wcscmp] 8BF28BF8
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_snwprintf] FF66E8D8
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!malloc] 4489FFFF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_c_exit] [7C830424] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_exit] 75000424
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_XcptFilter] EBC03304
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_cexit] 8B068B3A
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!exit] 89042454
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_acmdln] 468B0842
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!__getmainargs] 24548B04
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_initterm] 0C428904
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!__setusermatherr] 0489038B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_adjust_fdiv] 24448B24
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!__p__commode] 24148B04
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!__p__fmode] 448B1089
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!__set_app_type] 58890424
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!??3@YAXPAX@Z] 24048B04
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!??2@YAPAXI@Z] 0424548B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!__CxxFrameHandler] 8B045089
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_itow] 89042444
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_snprintf] 5901B003
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_wtol] C35B5E5A
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_strnicmp] 8BF8C483
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!sscanf] 14890450
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!wcstombs] 89108B24
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!sprintf] 8B042454
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!strchr] 4C8B2414
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!strncmp] 0A890424
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!atof] 0424548B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_ftol] 89240C8B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!isspace] 158B044A
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!wcscpy] [004A05E8] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_controlfp] E8A31089
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!wcsncmp] 59004A05
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_wcsupr] C08BC35A
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!ceil] 55575653
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!wcscat] 8BF8C483
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_except_handler3] 8BF08BD9
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!free] 89068BFC
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [msvcrt.dll!_wcsicmp] 89028B07
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlSubAuthoritySid] 8B0C4D03
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlAllocateHeap] 75C83B03
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtPowerInformation] E8078B18
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtSetSystemPowerState] FFFFFF90
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtRaiseHardError] 408B078B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlDeleteCriticalSection] 8B038908
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtOpenSymbolicLinkObject] 0C408B07
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtReplyPort] EB044301
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtCompleteConnectPort] 04430316
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtReplyWaitReceivePort] 0F75D03B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtAcceptConnectPort] 71E8078B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtCreatePort] 8BFFFFFF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlConvertSidToUnicodeString] 0C408B07
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlFreeUnicodeString] 8B044301
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtLockProductActivationKeys] 89042444
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlTimeToTimeFields] 75373B07
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtUnmapViewOfSection] 8BD38BAE
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtMapViewOfSection] FEFAE8C6
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtOpenSection] C084FFFF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtQuerySymbolicLinkObject] C0330475
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtQueryVolumeInformationFile] 5A590389
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtSetSecurityObject] 5B5E5F5D
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlAdjustPrivilege] [00408DC3] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtOpenFile] 55575653
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtFsControlFile] 89F0C483
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlAllocateAndInitializeSid] F48B2404
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlDestroyEnvironment] 4489068B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlFreeHeap] 0A8B0C24
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtQueryInformationToken] 408B068B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtShutdownSystem] 0FC83B08
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlEnterCriticalSection] 00008682
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlLeaveCriticalSection] 8BD88B00
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlInitializeCriticalSection] 0C5F033E
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlCreateEnvironment] 7A03F98B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlQueryEnvironmentVariable_U] 72DF3B04
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlSetEnvironmentVariable] 75C83B76
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlInitUnicodeString] 04428B21
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtOpenKey] 41010E8B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtQueryValueKey] 04428B08
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlInitializeSid] 4229168B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlLengthRequiredSid] 83068B0C
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtAllocateLocallyUniqueId] 75000C78
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlGetDaclSecurityDescriptor] E8068B56
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlCopySid] FFFFFEF0
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlLengthSid] D88B4DEB
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtSetInformationThread] 5F033E8B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtDuplicateToken] 03F98B0C
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtDuplicateObject] DF3B047A
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlEqualSid] 428B0A75
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlSetDaclSecurityDescriptor] 29168B04
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlCreateSecurityDescriptor] 33EB0C42
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtClose] 5A031A8B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlOpenCurrentUser] 245C8904
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlAddAce] 8B3E8B04
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlCreateAcl] 2E8B087F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlNtStatusToDosError] 2B0C7D03
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtSetInformationProcess] 247C89FB
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtQuerySystemInformation] 8BC82B08
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtCreateEvent] 0C488906
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtCreatePagingFile] 0424548D
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlDosPathNameToNtPathName_U] 4DE8068B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlRegisterWait] 84FFFFFE
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtSetValueKey] 330475C0
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtCreateKey] B018EBC0
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlTimeToSecondsSince1980] 8B14EB01
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtQuerySystemTime] 89008B06
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtPrivilegeObjectAuditAlarm] 3B068B06
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtPrivilegeCheck] 0F0C2444
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtOpenThreadToken] FFFF5985
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtOpenProcessToken] 83C033FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlInitString] 5F5D10C4
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlUnhandledExceptionFilter] 90C35B5E
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtQueryInformationProcess] 8B575653
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!DbgBreakPoint] 81F08BDA
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlCheckProcessParameters] [100000FE] C:\Program Files\McAfee\SiteAdvisor\saHook.dll
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlSetThreadIsCritical] BE077D00
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlSetProcessIsCritical] 00100000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlGetNtProductType] C6810CEB
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtInitiatePowerAction] 0000FFFF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!DbgPrint] 0000E681
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtFilterToken] 7389FFFF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtQueryInformationJobObject] 68016A04
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtOpenEvent] 00002000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlGetAce] E8006A56
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlQueryInformationAcl] FFFFFD34
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtQuerySecurityObject] 3B89F88B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!RtlCompareUnicodeString] 2374FF85
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [ntdll.dll!NtOpenDirectoryObject] ECB8D38B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [RPCRT4.dll!RpcServerRegisterIfEx] 43C7E88B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [RPCRT4.dll!RpcServerUseProtseqEpW] [10000004] C:\Program Files\McAfee\SiteAdvisor\saHook.dll
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [RPCRT4.dll!RpcImpersonateClient] 68046A00
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [RPCRT4.dll!I_RpcMapWin32Status] 00002000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [RPCRT4.dll!RpcServerRegisterIf] [10000068] C:\Program Files\McAfee\SiteAdvisor\saHook.dll
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [RPCRT4.dll!RpcGetAuthorizationContextForClient] E1E85500
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [RPCRT4.dll!RpcFreeAuthorizationContext] 8BFFFFFC
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [RPCRT4.dll!RpcServerListen] 853B89F8
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [RPCRT4.dll!RpcRevertToSelf] 811F75FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [RPCRT4.dll!NdrServerCall2] [00FFFFC6] C:\WINDOWS\system32\ieframe.dll (Internet Explorer/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [RPCRT4.dll!UuidCreate] [00E68100] C:\WINDOWS\system32\ieframe.dll (Internet Explorer/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [Secur32.dll!LsaCallAuthenticationPackage] 046A0473
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [Secur32.dll!GetUserNameExW] 00200068
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [Secur32.dll!LsaLookupAuthenticationPackage] E8555600
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [Secur32.dll!LsaRegisterLogonProcess] FFFFFCBC
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SetFocus] 00008000
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!EnumWindows] 038B006A
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!CreateWindowStationW] FC9EE850
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!RegisterLogonProcess] C033FFFF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!RecordShutdownReason] 5F5D0389
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!LoadLocalFonts] 90C35B5E
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!UnhookWindowsHook] 55575653
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SetWindowsHookW] 8BE8C483
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!GetWindowTextW] C7F48BF9
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!CallNextHookEx] FF082444
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!DialogBoxParamW] 33FFFFFF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!GetWindowPlacement] 244C89C9
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!GetSystemMenu] 2444890C
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!DeleteMenu] 24540310
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SetWindowPlacement] 24548910
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SetUserObjectInformationW] 05ECA114
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!GetAsyncKeyState] 0689004A
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!PostThreadMessageW] 068B6BEB
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SetUserObjectSecurity] 4489008B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!CreateDesktopW] 068B0424
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!GetMessageTime] 3B08588B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SetTimer] 7210245C
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SetLogonNotifyWindow] 8BC38B52
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!UnlockWindowStation] 0C420316
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!ReplyMessage] 1424443B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!UnregisterHotKey] 5C3B4577
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!RegisterHotKey] 04730824
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!OpenInputDesktop] 08245C89
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!GetUserObjectInformationW] 688B068B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!CloseDesktop] 03068B08
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!RegisterDeviceNotificationW] 6C3B0C68
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SetThreadDesktop] 04760C24
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!CreateWindowExW] 0C246C89
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!GetMessageW] 00800068
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!TranslateMessage] 8B006A00
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!RegisterWindowMessageW] 08408B06
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!RegisterClassW] FC16E850
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SetCursor] C085FFFF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!FindWindowW] 05C70A75
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!MessageBoxW] [004A05C8] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SendNotifyMessageW] 00000001
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!PostQuitMessage] 11E8068B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!MsgWaitForMultipleObjects] 8BFFFFFD
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!GetWindowRect] 89042444
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!GetSystemMetrics] 05ECB806
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!PeekMessageW] 063B004A
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!DispatchMessageW] C0338C75
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!KillTimer] [7C830789] C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SetProcessWindowStation] 74000C24
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!UpdateWindow] 24448B11
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!ShowWindow] 8B078908
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SetWindowPos] 2B0C2444
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!PostMessageW] 89082444
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!ExitWindowsEx] C4830447
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!EnumDisplayMonitors] 5E5F5D18
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SystemParametersInfoW] C08BC35B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!GetDlgItem] 55575653
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SendMessageW] 8BE8C483
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!CreateDialogParamW] 241489D9
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!DestroyWindow] 0824748D
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!GetWindowLongW] 04247C8D
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!GetDlgItemTextW] 0C246C8D
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!EndDialog] CA8BD08B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SetWindowLongW] F000E181
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!LoadStringW] 4C89FFFF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SetWindowTextW] 14031024
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SetDlgItemTextW] FFC28124
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!wsprintfW] 8100000F
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!wsprintfA] FFF000E2
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!LockWindowStation] 245489FF
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!MBToWCSEx] 24448B14
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SetWindowStationUser] 8B038910
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!UpdatePerUserSystemParameters] 2B142444
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!DialogBoxIndirectParamW] 89102444
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!wvsprintfW] ECA10443
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SetLastErrorEx] 89004A05
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!LoadCursorW] 8B5BEB07
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!CheckDlgButton] 08408B07
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!IsDlgButtonChecked] 078B0689
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!DefWindowProcW] 030C408B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!CloseWindowStation] [00458906] C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!LoadImageW] 443B068B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!GetParent] 06731024
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!GetKeyState] 1024448B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!GetDesktopWindow] 458B0689
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SetForegroundWindow] 24443B00
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!SwitchDesktop] 8B077614
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [USER32.dll!OpenDesktopW] 89142444
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [VERSION.dll!GetFileVersionInfoSizeW] 5C8D0424
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [VERSION.dll!GetFileVersionInfoW] D08B0C24
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [VERSION.dll!VerQueryValueW] C581EA8B
IAT C:\WINDOWS\system32\winlogon.exe[1732] @ C:\WINDOWS\system32\winlogon.exe [WS2_32.dll!getaddrinfo] 05ECB807
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLHostManager.exe[2940] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT C:\Program Files\Common Files\AOL\1200531038\ee\AOLServiceHost.exe[3020] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 8A2BD1F8
Device \FileSystem\Fastfat \FatCdrom 899CC1F8
Device \Driver\NDIS \Device\Ndis [8A1D4984] NDIS.sys[.reloc]
Device \Driver\NetBT \Device\NetBT_Tcpip_{F4281CCC-C48F-473D-8F94-3DA009F5183A} 89D001F8

AttachedDevice \Driver\Tcpip \Device\Ip MpFirewall.sys (McAfee Personal Firewall Driver/McAfee)
AttachedDevice \Driver\Tcpip \Device\Ip ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation)

Device \Driver\usbuhci \Device\USBPDO-0 8A125500
Device \Driver\usbuhci \Device\USBPDO-1 8A125500
Device \Driver\usbuhci \Device\USBPDO-2 8A125500
Device \Driver\usbuhci \Device\USBPDO-3 8A125500
Device \Driver\usbehci \Device\USBPDO-4 8A122500

AttachedDevice \Driver\Tcpip \Device\Tcp MpFirewall.sys (McAfee Personal Firewall Driver/McAfee)
AttachedDevice \Driver\Tcpip \Device\Tcp ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation)

Device \Driver\Ftdisk \Device\HarddiskVolume1 8A3431F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 8A3431F8
Device \Driver\Cdrom \Device\CdRom0 8A03B1F8
Device \Driver\Cdrom \Device\CdRom1 8A03B1F8
Device \Driver\USBSTOR \Device\000000a5 895EC380
Device \Driver\Ftdisk \Device\HarddiskVolume3 8A3431F8
Device \Driver\USBSTOR \Device\000000a6 895EC380
Device \Driver\USBSTOR \Device\000000a7 895EC380
Device \Driver\Cdrom \Device\CdRom4 8A03B1F8
Device \Driver\NetBT \Device\NetBt_Wins_Export 89D001F8
Device \Driver\NetBT \Device\NetbiosSmb 89D001F8
Device \Driver\PCI_PNP3136 \Device\00000079 spau.sys
Device \Driver\sptd \Device\4095150636 spau.sys

AttachedDevice \Driver\Tcpip \Device\Udp MpFirewall.sys (McAfee Personal Firewall Driver/McAfee)
AttachedDevice \Driver\Tcpip \Device\Udp ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation)

Device \Driver\usbuhci \Device\USBFDO-0 8A125500
Device \Driver\usbuhci \Device\USBFDO-1 8A125500
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 89C6C1F8
Device \Driver\usbuhci \Device\USBFDO-2 8A125500
Device \FileSystem\MRxSmb \Device\LanmanRedirector 89C6C1F8
Device \Driver\usbuhci \Device\USBFDO-3 8A125500
Device \Driver\usbehci \Device\USBFDO-4 8A122500
Device \Driver\Ftdisk \Device\FtControl 8A3431F8
Device \Driver\av22mccn \Device\Scsi\av22mccn1 8A0AD1F8
Device \Driver\av22mccn \Device\Scsi\av22mccn1Port2Path0Target0Lun0 8A0AD1F8
Device \FileSystem\Fastfat \Fat 899CC1F8
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs 899EE1F8
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xAA 0xAB 0x60 0x7F …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xA1 0x9B 0xCF 0x0F …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xB3 0xFE 0x6C 0x94 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xAA 0xAB 0x60 0x7F …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xA1 0x9B 0xCF 0x0F …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xB3 0xFE 0x6C 0x94 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xAA 0xAB 0x60 0x7F …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xA1 0x9B 0xCF 0x0F …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xB3 0xFE 0x6C 0x94 …

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\SYSTEM32\DRIVERS\ndis.sys (size mismatch) 212224/182656 bytes executable
File C:\WINDOWS\SYSTEM32\DLLCACHE\ndis.sys (size mismatch) 212224/182656 bytes executable
File C:\WINDOWS\$NtServicePackUninstall$\ndis.sys (size mismatch) 182912/182656 bytes executable

—- EOF - GMER 1.0.15 —-

CatByte

Post #4June 14, 2009, 3:19 PM UTC

Hi,

Please download the following program on another computer and transfer it over - rename it before you transfer:

Please download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
- Tools->Options->Main tab
- Set to "Always ask me where to Save the files".
During the download, rename Combofix to Combo-Fix as follows:

[external image: Posted Image]

[external image: Posted Image]
It is important you rename Combofix during the download, but not after.
Please do not rename Combofix to other names, but only to the one indicated.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

———————————————————–
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  
  ———————————————————–
- Close any open browsers.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
———————————————————–
Double click on combo-Fix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\Combo-Fix.txt" for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

kbl

Post #5June 14, 2009, 6:37 PM UTC

Hi CatByte

Saved ComboFix (as Combo-Fix) to a flash drive from laptop. Ran Combo-Fix on laptop. Worked fine. Opened Combo-Fix from flash drive on desktop and this message popped up:
!!Alert!! It is NOT SAFE to continue! The contents of the ComboFix package has been compromised. Please download a fresh copy from http://www.bleepingcomputer.com/combofix/how to use combofix. Note: You may be infected with a file patching virus 'Virut.' Then Combo-Fix icon disappeared. I tried redoing the process a few times and kept getting the same message. Should I download from the bleeping computer site directly? Thanks.

CatByte

Post #6June 14, 2009, 7:08 PM UTC

Hi,

That is bad news I'm afraid

I am afraid you have the VIRUT FILE INFECTOR

VIRUTis a polymorphic file infector with some additional features. It spreads all around the drive and infects even files infected by another virus previously.

Unfortunately, the cleaning of this virus is not recommended.

The only thing we recommend is to do a full reformat and install.

We have an excellent tutorial on how to reformat here

Things to bear in mind, only back up data files (word, excell etc.) DO NOT backup any .exe/.scr/.htm/.html/.xml/.zip/.pif/.com/.rar files… as they could all be infected and will simply re-infect your system again, there is no way of being certain what this infection can do.

Read more about the VIRUT FILE INFECTOR HERE

If you don't have a Windows Installation Disk (if this came with Windows pre-installed), you may have a Manufacturer restore disk to restore the computer to its original state - this depends on the Manufacturer though. Otherwise, give the Manufacturer a call and ask them to send you a restore disk or Windows installation CD.

Here is a guide on backing up your data;
Although you can use whatever method you prefer.

Do not back up to another machine, as it may become compromised.

Burn to DVD/CD, or to an external drive which has nothing else on it, and which you can format should it happen to become infected from the backups.

Should you have any questions, please feel free to ask.

I am sorry there is nothing more that we can do.

More information:

http://free.avg.com/66558
There are bugs in the viral code. When the virus produces infected files, it also creates non-functional files that also contain the virus.

http://home.mcafee.com/VirusInfo/VirusProf…aspx?key=143034
W32/Virut.h is a polymorphic, entry point obscuring (EPO) file infector with IRC bot functionality. It can accept commands to download other malware on the compromised machine.
It appends to the end of the last section of executable (PE) files an encrypted copy of its code. The decryptor is polymorphic and can be located either:
Immediately before the encrypted code at the end of the last section
At the end of the code section of the infected host in 'slack-space' (assuming there is any)
At the original entry point of the host (overwriting the original host code)

Miekiemoes, a highly regarded expert in malware removal, and an MS-MVP,
has an extremely informative blog post about Virut. - she only ever recommends a total reformat.

At least this way, you have the best chance of having a clean machine once more.

For future protection read this very well written article Think Prevention.

kbl

Post #7June 14, 2009, 7:53 PM UTC

Thank you for all your effort and time CatByte. I'll follow the instructions given. Thanks again.

CatByte

Post #8June 14, 2009, 7:54 PM UTC

Hi, Sorry it turned out to be a reformat, but at least this way you'll have a reliable machine again stay safe CB

CatByte

Post #9June 14, 2009, 7:55 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

[Resolved] Internet Explorer error message "Internet Explore

✨ Ask AI

Ask AI