What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Google Redirect Virus

57 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi,

Please do the following:

  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT



Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply


In your next reply please include
  • MBAM Log
  • Kaspersky report
Post #17
MBAM log Malwarebytes' Anti-Malware 1.44 Database version: 3697 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 2/6/2010 11:42:00 AM mbam-log-2010-02-06 (11-42-00).txt Scan type: Quick Scan Objects scanned: 127108 Time elapsed: 6 minute(s), 38 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Kaspersky ran for 4 1/2 hrs and came back with no threat forund. McAfee ran last night and did find and quarentine 31 items. Am I now clean or just hiding?
Post #18
Hi,

I'd like to see another OTL log

  • Double click on the OTL icon to run it.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Under the Custom Scan box paste this in


    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    ahcix86s.sys
    nvrd32.sys
    symmpi.sys
    adp3132.sys
    /md5stop
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\System32\config\*.sav
    CREATERESTOREPOINT

  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them in your next reply.
Post #19
OTL log

OTL logfile created on: 2/6/2010 5:42:45 PM - Run 2
OTL by OldTimer - Version 3.1.27.1 Folder = C:\Documents and Settings\test\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

959.00 Mb Total Physical Memory | 529.00 Mb Available Physical Memory | 55.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 70.00% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 80.66 Gb Total Space | 46.44 Gb Free Space | 57.57% Space Free | Partition Type: NTFS
Drive D: | 11.46 Gb Total Space | 1.09 Gb Free Space | 9.53% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YOUR-0CDC4F5844
Current User Name: test
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\test\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files\Trend Micro\RUBotted\TMRUBottedLite.exe ()
PRC - C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\system32\mqtgsvc.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\mqsvc.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
PRC - C:\WINDOWS\system32\hasplms.exe (Aladdin Knowledge Systems Ltd.)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation)
PRC - C:\Program Files\HP\QuickPlay\QPService.exe (CyberLink Corp.)
PRC - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe ( Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
PRC - C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
PRC - C:\Program Files\Google\Gmail Notifier\gnotify.exe (Google Inc.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\test\Desktop\OTL.exe (OldTimer Tools)


========== Win32 Services (SafeList) ==========

SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (MpfService) – C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV - (McSysmon) – C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (gupdate1ca204bad189b6c) Google Update Service (gupdate1ca204bad189b6c) – C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (gusvc) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (mcmscsvc) – C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (McProxy) – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (McNASvc) – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (RUBotted) – C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe (Trend Micro Inc.)
SRV - (MSMQTriggers) – C:\WINDOWS\system32\mqtgsvc.exe (Microsoft Corporation)
SRV - (MSMQ) – C:\WINDOWS\system32\mqsvc.exe (Microsoft Corporation)
SRV - (hasplms) – C:\WINDOWS\System32\hasplms.exe (Aladdin Knowledge Systems Ltd.)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (NVSvc) – C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation)
SRV - (AddFiltr) – C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe (Hewlett-Packard Development Company, L.P.)
SRV - (LightScribeService) – C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (hpqwmiex) – C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe (Hewlett-Packard Development Company, L.P.)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://groups.yahoo.com/group/DFWpaddlers/
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/01/20 19:46:05 | 000,000,000 | —D | M]


O1 HOSTS File: ([2010/01/28 19:43:26 | 000,377,755 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 13022 more lines…
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe (Google Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\Cpqset.exe ()
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\CHDAudPropShortcut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpWirelessAssistant] C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe (Macrovision Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [McENUI] C:\Program Files\McAfee\MHN\McENUI.exe (McAfee, Inc.)
O4 - HKLM..\Run: [MsmqIntCert] C:\WINDOWS\System32\mqrt.dll (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [QlbCtrl] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe ( Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [QPService] C:\Program Files\HP\QuickPlay\QPService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [RecGuard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [Reminder] C:\WINDOWS\CREATOR\Remind_XP.exe (SoftThinks)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TMRUBottedTray] C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe (Trend Micro Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\StartUp\HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Development Company, L.P.)
O4 - Startup: C:\Documents and Settings\test\Start Menu\Programs\StartUp\OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &ieSpell Options - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Check &Spelling - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files\ieSpell\wikipedia.HTM ()
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 64 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: 63 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} http://h50203.www5.hp.com/HPISWeb/Customer…DataManager.CAB (Hewlett-Packard Online Support Services)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1244681197328 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: Garmin Communicator Plug-In https://my.garmin.com/static/m/cab/2.8.3/GarminAxControl.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Wave.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Wave.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/07/27 22:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2006/09/19 22:40:03 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17173366603513856)

========== Files/Folders - Created Within 14 Days ==========

[2010/02/05 21:28:33 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/02/04 22:24:08 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/02/04 22:24:08 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/02/04 22:24:08 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/02/04 22:24:08 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/02/04 22:23:56 | 000,000,000 | —D | C] – C:\ComboFix
[2010/02/04 22:23:21 | 000,000,000 | —D | C] – C:\Qoobox
[2010/02/03 22:08:54 | 000,000,000 | —D | C] – C:\WINDOWS\System32\XPSViewer
[2010/02/03 22:08:48 | 000,000,000 | —D | C] – C:\Program Files\MSBuild
[2010/02/03 22:08:37 | 000,000,000 | —D | C] – C:\Program Files\Reference Assemblies
[2010/02/03 22:08:04 | 000,000,000 | —D | C] – C:\25ca33317abf00ac4eb404e5903d
[2010/02/03 21:42:27 | 000,548,864 | —- | C] (OldTimer Tools) – C:\Documents and Settings\test\Desktop\OTL.exe
[2010/02/03 21:02:00 | 000,417,136 | —- | C] (Sysinternals) – C:\WINDOWS\handle.exe
[2010/02/02 19:35:23 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/02/02 19:34:44 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2010/02/02 19:33:51 | 000,791,393 | —- | C] (Lars Hederer ) – C:\Documents and Settings\test\Desktop\erunt_setup.exe
[2010/02/02 19:30:11 | 000,021,504 | —- | C] (Doug Knox) – C:\Documents and Settings\test\Desktop\SysRestorePoint.exe
[2010/02/01 20:18:43 | 000,000,000 | —D | C] – C:\Documents and Settings\test\Application Data\Malwarebytes
[2010/02/01 20:18:33 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/02/01 20:18:31 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/02/01 20:18:28 | 000,019,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/02/01 20:18:27 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/01/29 20:01:17 | 000,000,000 | —D | C] – C:\Documents and Settings\test\log
[2010/01/28 22:52:36 | 000,064,288 | —- | C] (Lavasoft AB) – C:\WINDOWS\System32\drivers\Lbd.sys
[2010/01/28 22:51:11 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
[2010/01/28 22:50:36 | 000,000,000 | —D | C] – C:\Program Files\Lavasoft
[2010/01/28 22:50:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Lavasoft
[2010/01/28 20:03:13 | 000,000,000 | —D | C] – C:\Documents and Settings\test\Calibre Library
[2010/01/28 20:03:08 | 000,000,000 | —D | C] – C:\Documents and Settings\test\Application Data\calibre
[2010/01/28 20:00:41 | 000,000,000 | —D | C] – C:\Program Files\Calibre2
[2010/01/28 19:02:38 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/01/28 19:02:38 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2010/01/26 22:34:08 | 000,000,000 | —D | C] – C:\Program Files\TrendMicro
[2010/01/26 22:32:43 | 000,206,608 | —- | C] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\TMPassthru.sys
[2010/01/26 22:32:41 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/01/25 23:43:46 | 000,000,000 | —D | C] – C:\Documents and Settings\test\Local Settings\Application Data\ICS
[2009/09/15 18:17:16 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\McAfee
[2009/09/11 19:16:27 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\SACore
[2009/08/19 10:47:34 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2009/08/18 15:34:36 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2009/08/11 19:42:20 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2009/08/11 19:42:17 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2009/07/09 18:50:53 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\StumbleUpon
[2009/07/09 18:26:59 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2009/07/03 11:40:01 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2009/04/03 22:33:01 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\SACore
[2006/09/19 23:44:52 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2006/09/19 23:44:51 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2005/09/24 09:49:16 | 000,012,288 | —- | C] (Hewlett-Packard Development Company, L.P.) – C:\WINDOWS\Fonts\RandFont.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2010/02/06 16:53:01 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/02/06 16:52:21 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
[2010/02/06 16:18:49 | 000,023,065 | —- | M] () – C:\WINDOWS\System32\Config.MPF
[2010/02/06 12:07:46 | 000,001,915 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/02/06 11:40:12 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/02/06 11:25:16 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/02/06 11:25:14 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
[2010/02/06 11:25:14 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
[2010/02/06 11:25:13 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
[2010/02/06 11:20:19 | 000,001,405 | —- | M] () – C:\hpqp.ini
[2010/02/06 11:18:48 | 000,000,039 | —- | M] () – C:\XP_TV.ini
[2010/02/06 11:18:47 | 000,051,048 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2010/02/06 11:18:44 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/02/06 11:18:43 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/02/06 11:18:41 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/02/06 11:18:38 | 1005,170,688 | -HS- | M] () – C:\hiberfil.sys
[2010/02/05 23:17:06 | 007,864,320 | -H– | M] () – C:\Documents and Settings\test\NTUSER.DAT
[2010/02/05 23:17:06 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\test\ntuser.ini
[2010/02/04 22:33:46 | 000,000,274 | —- | M] () – C:\WINDOWS\system.ini
[2010/02/04 22:05:58 | 000,516,130 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/02/04 22:05:58 | 000,452,412 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/02/04 22:05:58 | 000,074,420 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/02/04 21:22:23 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/02/04 21:22:17 | 000,278,152 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/02/03 22:20:00 | 000,101,154 | —- | M] () – C:\handle.zip
[2010/02/03 21:42:37 | 000,548,864 | —- | M] (OldTimer Tools) – C:\Documents and Settings\test\Desktop\OTL.exe
[2010/02/03 21:08:20 | 000,077,312 | —- | M] () – C:\Documents and Settings\test\Desktop\mbr.exe
[2010/02/03 21:01:46 | 000,802,800 | —- | M] () – C:\Documents and Settings\test\Desktop\maxhandle.exe
[2010/02/02 21:01:44 | 000,359,929 | —- | M] () – C:\Documents and Settings\test\Desktop\dds.scr
[2010/02/02 19:37:54 | 000,284,915 | —- | M] () – C:\Documents and Settings\test\Desktop\gmer.zip
[2010/02/02 19:34:46 | 000,000,611 | —- | M] () – C:\Documents and Settings\test\Desktop\NTREGOPT.lnk
[2010/02/02 19:34:46 | 000,000,592 | —- | M] () – C:\Documents and Settings\test\Desktop\ERUNT.lnk
[2010/02/02 19:33:56 | 000,791,393 | —- | M] (Lars Hederer ) – C:\Documents and Settings\test\Desktop\erunt_setup.exe
[2010/02/02 19:30:27 | 000,021,504 | —- | M] (Doug Knox) – C:\Documents and Settings\test\Desktop\SysRestorePoint.exe
[2010/02/01 20:18:37 | 000,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/01 01:40:16 | 000,000,330 | —- | M] () – C:\WINDOWS\tasks\McQcTask.job
[2010/02/01 01:39:30 | 000,001,460 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Media Center.lnk
[2010/01/31 18:58:31 | 000,000,000 | —- | M] () – C:\Documents and Settings\test\settings.dat
[2010/01/31 13:22:26 | 000,002,439 | —- | M] () – C:\Documents and Settings\test\Desktop\HiJackThis.lnk
[2010/01/29 18:19:18 | 000,001,813 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2010/01/28 22:52:14 | 000,015,880 | —- | M] () – C:\WINDOWS\System32\lsdelete.exe
[2010/01/28 22:51:09 | 000,000,867 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2010/01/28 20:02:26 | 000,000,717 | —- | M] () – C:\Documents and Settings\All Users\Desktop\calibre - E-book management.lnk
[2010/01/28 19:43:26 | 000,377,755 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/01/28 19:02:44 | 000,000,933 | —- | M] () – C:\Documents and Settings\test\Desktop\Spybot - Search & Destroy.lnk
[2010/01/26 22:54:02 | 000,000,036 | —- | M] () – C:\Documents and Settings\test\Local Settings\Application Data\housecall.guid.cache
[2010/01/26 19:15:47 | 000,000,031 | —- | M] () – C:\WINDOWS\QUICKEN.INI
[2010/01/25 22:57:08 | 000,000,210 | RHS- | M] () – C:\boot.ini
[2010/01/25 21:44:41 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/02/06 12:07:45 | 000,001,915 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/02/05 20:11:03 | 000,000,868 | —- | C] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/02/04 22:24:08 | 000,261,632 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/02/04 22:24:08 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/02/04 22:24:08 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/02/04 22:24:08 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/02/04 22:24:08 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/02/03 22:20:00 | 000,101,154 | —- | C] () – C:\handle.zip
[2010/02/03 21:07:58 | 000,077,312 | —- | C] () – C:\Documents and Settings\test\Desktop\mbr.exe
[2010/02/03 21:01:35 | 000,802,800 | —- | C] () – C:\Documents and Settings\test\Desktop\maxhandle.exe
[2010/02/02 21:01:43 | 000,359,929 | —- | C] () – C:\Documents and Settings\test\Desktop\dds.scr
[2010/02/02 19:37:40 | 000,284,915 | —- | C] () – C:\Documents and Settings\test\Desktop\gmer.zip
[2010/02/02 19:34:46 | 000,000,611 | —- | C] () – C:\Documents and Settings\test\Desktop\NTREGOPT.lnk
[2010/02/02 19:34:46 | 000,000,592 | —- | C] () – C:\Documents and Settings\test\Desktop\ERUNT.lnk
[2010/02/01 20:18:37 | 000,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/31 18:58:31 | 000,000,000 | —- | C] () – C:\Documents and Settings\test\settings.dat
[2010/01/29 01:23:46 | 000,015,880 | —- | C] () – C:\WINDOWS\System32\lsdelete.exe
[2010/01/28 22:59:54 | 000,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/01/28 22:59:54 | 000,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
[2010/01/28 22:59:54 | 000,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
[2010/01/28 22:59:54 | 000,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
[2010/01/28 22:59:53 | 000,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
[2010/01/28 22:51:09 | 000,000,867 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2010/01/28 20:02:26 | 000,000,717 | —- | C] () – C:\Documents and Settings\All Users\Desktop\calibre - E-book management.lnk
[2010/01/28 19:02:44 | 000,000,933 | —- | C] () – C:\Documents and Settings\test\Desktop\Spybot - Search & Destroy.lnk
[2010/01/26 22:54:02 | 000,000,036 | —- | C] () – C:\Documents and Settings\test\Local Settings\Application Data\housecall.guid.cache
[2010/01/26 22:34:11 | 000,002,439 | —- | C] () – C:\Documents and Settings\test\Desktop\HiJackThis.lnk
[2010/01/01 14:20:51 | 000,000,097 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2009/11/15 11:50:34 | 000,001,274 | —- | C] () – C:\WINDOWS\4DQuickFontWizard.INI
[2009/08/18 11:19:41 | 000,000,141 | —- | C] () – C:\WINDOWS\asym.ini
[2009/04/03 21:12:13 | 000,005,632 | —- | C] () – C:\Documents and Settings\test\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/03/31 18:31:23 | 000,000,000 | —- | C] () – C:\Documents and Settings\test\Local Settings\Application Data\FnF4.txt
[2009/03/31 13:59:45 | 000,000,127 | —- | C] () – C:\Documents and Settings\test\Local Settings\Application Data\fusioncache.dat
[2009/03/31 13:59:45 | 000,000,000 | —- | C] () – C:\Documents and Settings\test\Local Settings\Application Data\DSwitch.txt
[2009/03/31 13:59:45 | 000,000,000 | —- | C] () – C:\Documents and Settings\test\Local Settings\Application Data\AtStart.txt
[2009/03/31 13:59:44 | 000,000,000 | —- | C] () – C:\Documents and Settings\test\Local Settings\Application Data\QSwitch.txt
[2008/01/14 16:47:06 | 000,099,712 | —- | C] () – C:\WINDOWS\HPBroker.dll
[2006/09/20 00:31:07 | 000,000,031 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2006/09/20 00:27:17 | 000,000,698 | —- | C] () – C:\WINDOWS\NSSetDefaultBrowser.ini
[2006/09/20 00:14:30 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/09/20 00:04:20 | 000,028,836 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2006/08/18 02:00:00 | 001,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/08/18 02:00:00 | 001,470,464 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/08/18 02:00:00 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/08/18 02:00:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/08/18 02:00:00 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2006/06/29 13:18:14 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/06/29 12:49:18 | 000,000,368 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2006/06/29 12:46:56 | 000,000,059 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/06/29 12:43:40 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2006/03/04 01:07:34 | 000,235,008 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2005/12/02 12:09:10 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/05/05 20:06:32 | 000,016,480 | —- | C] () – C:\WINDOWS\System32\rixdicon.dll
[2004/09/16 14:24:26 | 003,375,104 | —- | C] () – C:\WINDOWS\System32\qt-mt331.dll
[2003/01/07 16:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2010/01/01 14:20:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EPSON
[2009/08/19 19:20:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\kinoma
[2009/08/19 19:22:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Marlin
[2009/11/09 22:31:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Pulse
[2009/06/21 08:46:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/04/04 00:02:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/09/09 20:43:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/14 21:11:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/01/28 22:51:19 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
[2010/01/28 20:03:45 | 000,000,000 | —D | M] – C:\Documents and Settings\test\Application Data\calibre
[2009/12/25 18:09:44 | 000,000,000 | —D | M] – C:\Documents and Settings\test\Application Data\GARMIN
[2009/06/23 21:08:24 | 000,000,000 | —D | M] – C:\Documents and Settings\test\Application Data\ieSpell
[2009/04/03 21:23:00 | 000,000,000 | —D | M] – C:\Documents and Settings\test\Application Data\Leadertech
[2009/05/04 21:36:50 | 000,000,000 | —D | M] – C:\Documents and Settings\test\Application Data\OpenOffice.org
[2010/01/26 20:56:08 | 000,000,000 | —D | M] – C:\Documents and Settings\test\Application Data\StumbleUpon
[2009/05/26 19:23:21 | 000,000,000 | —D | M] – C:\Documents and Settings\test\Application Data\Viewpoint
[2010/02/06 11:25:13 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Daily 1).job
[2010/02/06 11:25:14 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Daily 2).job
[2010/02/06 11:25:14 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Daily 3).job
[2010/02/06 16:52:21 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Daily 4).job
[2010/02/06 11:25:16 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2009/04/03 23:00:32 | 000,000,338 | —- | M] () – C:\WINDOWS\Tasks\McDefragTask.job
[2010/02/01 01:40:16 | 000,000,330 | —- | M] () – C:\WINDOWS\Tasks\McQcTask.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2006/03/15 14:00:00 | 016,971,599 | —- | M] () .cab file – C:\I386\sp2.cab:AGP440.sys
[2006/03/15 22:00:00 | 016,971,599 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2009/06/10 19:11:37 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2009/06/10 19:11:37 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 12:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ERDNT\cache\agp440.sys
[2008/04/13 12:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 12:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/04 08:07:42 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: ATAPI.SYS >
[2006/03/15 14:00:00 | 016,971,599 | —- | M] () .cab file – C:\I386\sp2.cab:atapi.sys
[2006/03/15 22:00:00 | 016,971,599 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2009/06/10 19:11:37 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2009/06/10 19:11:37 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 12:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/04/13 12:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 12:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 07:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 18:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/13 18:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 18:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2006/03/15 22:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: IASTOR.SYS >
[2005/10/13 03:07:12 | 000,874,240 | —- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B – C:\SWSetup\HDD\iastor.sys
[2005/10/13 03:07:12 | 000,874,240 | —- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B – C:\WINDOWS\system32\drivers\iaStor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/13 18:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/13 18:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 18:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2006/03/15 22:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: NVATA.SYS >
[2006/01/26 18:04:16 | 000,099,584 | —- | M] (NVIDIA Corporation) MD5=3AC5EEDD35B7437D53960F3998BFA462 – C:\SWSetup\Chipset\IDE\Win2K\sata_ide\nvata.sys
[2006/01/26 18:04:16 | 000,099,584 | —- | M] (NVIDIA Corporation) MD5=3AC5EEDD35B7437D53960F3998BFA462 – C:\SWSetup\Chipset\IDE\WinXP\sata_ide\nvata.sys
[2006/01/26 18:04:16 | 000,099,584 | —- | M] (NVIDIA Corporation) MD5=3AC5EEDD35B7437D53960F3998BFA462 – C:\SWSetup\Chipset\nvata.sys
[2006/01/26 18:04:16 | 000,099,584 | —- | M] (NVIDIA Corporation) MD5=3AC5EEDD35B7437D53960F3998BFA462 – C:\WINDOWS\system32\drivers\nvata.sys

< MD5 for: NVATABUS.SYS >
[2006/01/26 18:04:16 | 000,099,584 | —- | M] (NVIDIA Corporation) MD5=3AC5EEDD35B7437D53960F3998BFA462 – C:\SWSetup\Chipset\IDE\Win2K\sataraid\nvatabus.sys
[2006/01/26 18:04:16 | 000,099,584 | —- | M] (NVIDIA Corporation) MD5=3AC5EEDD35B7437D53960F3998BFA462 – C:\SWSetup\Chipset\IDE\WinXP\sataraid\nvatabus.sys
[2006/01/26 18:04:16 | 000,099,584 | —- | M] (NVIDIA Corporation) MD5=3AC5EEDD35B7437D53960F3998BFA462 – C:\SWSetup\Chipset\nvatabus.sys

< MD5 for: SCECLI.DLL >
[2006/03/15 22:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 18:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/13 18:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 18:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/04/13 18:11:51 | 001,267,200 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\comsvcs.dll
[2010/01/05 04:00:20 | 000,347,136 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtmsft.dll
[2010/01/05 04:00:21 | 000,214,528 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtrans.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2010/02/02 17:33:07 | 016,777,216 | -HS- | M] () – C:\WINDOWS\system32\config\axkmhvaj.sav
[2006/06/29 04:59:22 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2006/06/29 04:59:22 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
< End of report >

Extras was not generated. Ran OTL twice with the same results, thought I had missed something but guess not.
Post #20
Hi,

Please do the following:


Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
[2010/02/02 17:33:07 | 016,777,216 | -HS- | M] () – C:\WINDOWS\system32\config\axkmhvaj.sav

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post the OTL log


NEXT



Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:

    :filefind
*btwusb*
*iastor*
*mhndrv*
*nvtcp*
*pxhelp20*
*vsmrwdriver*
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Post #21
OTL All processes killed ========== OTL ========== Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{C4069E3A-68F1-403E-B40E-20066696354B} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C4069E3A-68F1-403E-B40E-20066696354B}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D7E97865-918F-41E4-9CD0-25AB1C574CE8} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ not found. C:\WINDOWS\system32\config\axkmhvaj.sav moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 65748 bytes ->Temporary Internet Files folder emptied: 67 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: test ->Temp folder emptied: 93543899 bytes ->Temporary Internet Files folder emptied: 85906408 bytes ->Java cache emptied: 4235088 bytes ->Google Chrome cache emptied: 15493099 bytes ->Apple Safari cache emptied: 182704407 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 19569 bytes %systemroot%\System32 .tmp files removed: 2577 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 184 bytes Total Files Cleaned = 364.00 mb OTL by OldTimer - Version 3.1.27.1 log created on 02062010_185934 Files\Folders moved on Reboot… File move failed. C:\WINDOWS\temp\hlktmp scheduled to be moved on reboot. File\Folder C:\WINDOWS\temp\mcmsc_FTMAdo3dj03Qj1g not found! File\Folder C:\WINDOWS\temp\mcmsc_Xzh2HurltspMWDr not found! Registry entries deleted on Reboot… SystemLook SystemLook v1.0 by jpshortstuff (11.01.10) Log created at 19:11 on 06/02/2010 by test (Administrator - Elevation successful) ========== filefind ========== Searching for "*btwusb*" C:\SWSetup\BTOOTH\btwusb.cat –a— 80 bytes [20:05 12/05/2006] [20:05 12/05/2006] 12AE1FEB4F76043516E00D817339B189 C:\SWSetup\BTOOTH\btwusb.inf –a— 105673 bytes [20:05 12/05/2006] [20:05 12/05/2006] 0B95E7F0EFFCFBB5FE3D334AA86AEBA0 C:\SWSetup\BTOOTH\btwusb.PNF –a— 70564 bytes [04:42 20/09/2006] [04:42 20/09/2006] 9F3B3E836A6F269A0FB7158C3B55C617 C:\SWSetup\BTOOTH\btwusb.sys –a— 57320 bytes [20:05 12/05/2006] [20:05 12/05/2006] 4272BAB9291D26DA5AC913BC79C3CE85 C:\WINDOWS\system32\drivers\btwusb.sys –a— 57320 bytes [20:05 12/05/2006] [20:05 12/05/2006] 4272BAB9291D26DA5AC913BC79C3CE85 Searching for "*iastor*" C:\SWSetup\HDD\iastor.cat –a— 8180 bytes [00:13 20/10/2005] [00:13 20/10/2005] 1218101163ED69D44FAC44FFDE1C59B0 C:\SWSetup\HDD\iastor.inf –a— 3846 bytes [09:01 13/10/2005] [09:01 13/10/2005] 356A15A494C2AE6855C8D1480E0E1A3D C:\SWSetup\HDD\iastor.PNF –a— 9388 bytes [04:42 20/09/2006] [04:42 20/09/2006] E1D06897A6452A0BDA9824167172C01F C:\SWSetup\HDD\iastor.sys –a— 874240 bytes [09:07 13/10/2005] [09:07 13/10/2005] 309C4D86D989FB1FCF64BD30DC81C51B C:\WINDOWS\inf\iaStor.cat –a— 25 bytes [09:47 20/04/2005] [09:47 20/04/2005] C7DF137CF34B7DE5769CC2A746C375E3 C:\WINDOWS\inf\iaStor.inf –a— 3796 bytes [15:02 26/08/2005] [15:02 26/08/2005] 4855E3E3EB4187EC77A0BC7C45A06A1C C:\WINDOWS\inf\iaStor.PNF –a— 9284 bytes [04:42 20/09/2006] [04:42 20/09/2006] 14116ADDD7F512B39EC87D21A5A53D1A C:\WINDOWS\system32\drivers\iaStor.sys –a— 874240 bytes [09:07 13/10/2005] [09:07 13/10/2005] 309C4D86D989FB1FCF64BD30DC81C51B Searching for "*mhndrv*" C:\WINDOWS\system32\drivers\mhndrv.sys –a— 11008 bytes [18:45 10/08/2004] [18:45 10/08/2004] 7F2F1D2815A6449D346FCCCBC569FBD6 Searching for "*nvtcp*" C:\SWSetup\Chipset\Ethernet\nvtcp.sys –a— 101888 bytes [00:30 03/03/2006] [00:30 03/03/2006] C3B4DDFDDEB512790EA24DE867FCB7C3 C:\SWSetup\Chipset\nvtcp.sys –a— 101888 bytes [00:30 03/03/2006] [00:30 03/03/2006] C3B4DDFDDEB512790EA24DE867FCB7C3 C:\WINDOWS\system32\drivers\nvtcp.sys –a— 101888 bytes [04:43 20/09/2006] [00:30 03/03/2006] C3B4DDFDDEB512790EA24DE867FCB7C3 Searching for "*pxhelp20*" C:\WINDOWS\inf\pxhelp20.inf –a— 1651 bytes [17:03 26/01/2005] [17:03 26/01/2005] F8A34693E38B119E412EB6A30C399C1D C:\WINDOWS\inf\pxhelp20.PNF –a— 6496 bytes [04:42 20/09/2006] [04:42 20/09/2006] D6EA60C722387A509AE17D0530037DCF C:\WINDOWS\system32\drivers\pxhelp20.sys –a— 20640 bytes [17:03 25/04/2005] [00:05 21/06/2005] 86724469CD077901706854974CD13C3E Searching for "*vsmrwdriver*" C:\4DEmbroidery\Drivers\VSMGenericDriver\Drivers32\VsmRWDriver.sys –a— 14464 bytes [18:23 27/03/2008] [18:23 27/03/2008] 932B355836BA3013F86ACC4682FF98C7 C:\4DEmbroidery\Drivers\VSMGenericDriver\vsmrwdriver.cat –a— 9544 bytes [00:06 09/01/2007] [00:06 09/01/2007] 9AEC6F99E1DE2BFAFCD2E4246E178E7C C:\4DEmbroidery\Drivers\VSMGenericDriver\VsmRWDriver.inf –a— 3333 bytes [20:29 08/01/2007] [20:29 08/01/2007] B8E9C1666D8CFB63A34C245408353FC0 C:\WINDOWS\system32\drivers\Msft_Kernel_VsmRWDriver_01005.Wdf –ah– 0 bytes [03:03 25/09/2009] [03:03 25/09/2009] D41D8CD98F00B204E9800998ECF8427E C:\WINDOWS\system32\drivers\VsmRWDriver.sys -ra— 7808 bytes [01:01 08/11/2009] [13:31 08/01/2007] 9105E45DB92EB2479E04C1F1085A524A -=End Of File=-
Post #22
Hi,

Please do the following:

Please go to Start > run > type in cmd

this will open a command window:

copy/paste the following text inside the code cox into the open command window


findstr /i /m /c:"setup.php" %systemroot%\system32\drivers\*.sys >log.txt
if exist log.txt start notepad log.txt
exit
cls


a notepad will open.

Please copy the content of the notepad in your next reply
Post #26
How is your system running?

are there any outstanding issues?

I'd like to see another GMER log if you could rerun GMER

uncheck the box beside files this time as well.


NEXT


Visit ADOBEand download the latest version of Acrobat Reader (version 9.3)
Having the latest updates ensures there are no security vulnerabilities in your system.


NEXT

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 18 and save it to your desktop.
  • Scroll down to where it says JDK 6 Update 18 (JDK or JRE)
  • Click the Download JRE button to the right
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u18 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u18-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.
Post #27
System seems to be running fine. about 2 weeks ago computer would not turn off with out powering down with the button, this past Thursday if started turning off like it should. Google searchs are going where they should. Updated both Adobe and Java. Here is the latest GMER log

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-02-06 23:12:03
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\test\LOCALS~1\Temp\kgpyapod.sys


—- System - GMER 1.0.15 —-

SSDT \WINDOWS\system32\ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation) ZwCreateKey [0x804D7FCE]
SSDT \WINDOWS\system32\ntkrnlpa.exe[unknown section] [804D7FCE] ZwCreateKey [0x804D7FCE]
SSDT \WINDOWS\system32\ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation) ZwDeleteKey [0x804D7FD8]
SSDT \WINDOWS\system32\ntkrnlpa.exe[unknown section] [804D7FD8] ZwDeleteKey [0x804D7FD8]
SSDT \WINDOWS\system32\ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation) ZwDeleteValueKey [0x804D7FC9]
SSDT \WINDOWS\system32\ntkrnlpa.exe[unknown section] [804D7FC9] ZwDeleteValueKey [0x804D7FC9]
SSDT \WINDOWS\system32\ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation) ZwEnumerateKey [0x804D7FDD]
SSDT \WINDOWS\system32\ntkrnlpa.exe[unknown section] [804D7FDD] ZwEnumerateKey [0x804D7FDD]
SSDT \WINDOWS\system32\ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation) ZwEnumerateValueKey [0x804D7FE2]
SSDT \WINDOWS\system32\ntkrnlpa.exe[unknown section] [804D7FE2] ZwEnumerateValueKey [0x804D7FE2]
SSDT \WINDOWS\system32\ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation) ZwOpenKey [0x804D7FF1]
SSDT \WINDOWS\system32\ntkrnlpa.exe[unknown section] [804D7FF1] ZwOpenKey [0x804D7FF1]
SSDT \WINDOWS\system32\ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation) ZwQueryKey [0x804D7FEC]
SSDT \WINDOWS\system32\ntkrnlpa.exe[unknown section] [804D7FEC] ZwQueryKey [0x804D7FEC]
SSDT \WINDOWS\system32\ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation) ZwQueryValueKey [0x804D7FE7]
SSDT \WINDOWS\system32\ntkrnlpa.exe[unknown section] [804D7FE7] ZwQueryValueKey [0x804D7FE7]
SSDT \WINDOWS\system32\ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation) ZwSetValueKey [0x804D7FD3]
SSDT \WINDOWS\system32\ntkrnlpa.exe[unknown section] [804D7FD3] ZwSetValueKey [0x804D7FD3]

INT 0x03 \WINDOWS\system32\ntkrnlpa.exe[unknown section] 804D7FF6

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xEB6AC78A]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xEB6AC738]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xEB6AC74C]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xEB6AC7CA]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0xEB6AC917]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xEB6AC710]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xEB6AC724]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xEB6AC79E]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0xEB6AC8B9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xEB6AC858]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0xEB6AC93F]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0xEB6AC92B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0xEB6AC776]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xEB6AC762]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xEB6AC7F9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnloadKey [0xEB6AC901]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xEB6AC7E0]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xEB6AC7B4]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwYieldExecution 80504AE8 7 Bytes JMP EB6AC7B8 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF5BBC360, 0x225D9D, 0xE8000020]
.text C:\WINDOWS\system32\DRIVERS\aksfridge.sys section is writeable [0xB9542000, 0x44527, 0xE0000020]
.init C:\WINDOWS\system32\DRIVERS\aksfridge.sys entry point in ".init" section [0xB9594224]
.init C:\WINDOWS\system32\DRIVERS\aksfridge.sys unknown last code section [0xB9594000, 0x7000, 0xE20000E0]
.text C:\WINDOWS\system32\drivers\hardlock.sys section is writeable [0xB92DF400, 0x88182, 0xE8000020]
.protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xB9383820] C:\WINDOWS\system32\drivers\hardlock.sys entry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xB9383820]
.protectÿÿÿÿhardlockunknown last code section [0xB9383600, 0x50F6, 0xE0000020] C:\WINDOWS\system32\drivers\hardlock.sys unknown last code section [0xB9383600, 0x50F6, 0xE0000020]

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\Explorer.EXE[572] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 01320000
.text C:\WINDOWS\Explorer.EXE[572] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 0132006E
.text C:\WINDOWS\Explorer.EXE[572] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 01320F79
.text C:\WINDOWS\Explorer.EXE[572] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 01320F8A
.text C:\WINDOWS\Explorer.EXE[572] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 01320047
.text C:\WINDOWS\Explorer.EXE[572] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 01320FAF
.text C:\WINDOWS\Explorer.EXE[572] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 01320F4B
.text C:\WINDOWS\Explorer.EXE[572] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 01320F5C
.text C:\WINDOWS\Explorer.EXE[572] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 01320F29
.text C:\WINDOWS\Explorer.EXE[572] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 013200C2
.text C:\WINDOWS\Explorer.EXE[572] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 013200DD
.text C:\WINDOWS\Explorer.EXE[572] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 0132002C
.text C:\WINDOWS\Explorer.EXE[572] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 01320FE5
.text C:\WINDOWS\Explorer.EXE[572] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 01320093
.text C:\WINDOWS\Explorer.EXE[572] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 0132001B
.text C:\WINDOWS\Explorer.EXE[572] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 01320FCA
.text C:\WINDOWS\Explorer.EXE[572] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 01320F3A
.text C:\WINDOWS\Explorer.EXE[572] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00D50011
.text C:\WINDOWS\Explorer.EXE[572] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00D50F76
.text C:\WINDOWS\Explorer.EXE[572] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00D50FC0
.text C:\WINDOWS\Explorer.EXE[572] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00D50000
.text C:\WINDOWS\Explorer.EXE[572] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00D50F9B
.text C:\WINDOWS\Explorer.EXE[572] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00D50FEF
.text C:\WINDOWS\Explorer.EXE[572] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00D5003D
.text C:\WINDOWS\Explorer.EXE[572] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00D50022
.text C:\WINDOWS\Explorer.EXE[572] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00D40F90
.text C:\WINDOWS\Explorer.EXE[572] msvcrt.dll!system 77C293C7 5 Bytes JMP 00D40FB5
.text C:\WINDOWS\Explorer.EXE[572] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00D4000A
.text C:\WINDOWS\Explorer.EXE[572] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00D40FE3
.text C:\WINDOWS\Explorer.EXE[572] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00D4001B
.text C:\WINDOWS\Explorer.EXE[572] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00D40FD2
.text C:\WINDOWS\Explorer.EXE[572] WININET.dll!InternetOpenA 3D953081 5 Bytes JMP 00D20FEF
.text C:\WINDOWS\Explorer.EXE[572] WININET.dll!InternetOpenW 3D9536B1 5 Bytes JMP 00D2000A
.text C:\WINDOWS\Explorer.EXE[572] WININET.dll!InternetOpenUrlA 3D956F5A 5 Bytes JMP 00D20FDE
.text C:\WINDOWS\Explorer.EXE[572] WININET.dll!InternetOpenUrlW 3D998439 5 Bytes JMP 00D20FCD
.text C:\WINDOWS\Explorer.EXE[572] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00D30000
.text C:\WINDOWS\system32\services.exe[1380] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00070FEF
.text C:\WINDOWS\system32\services.exe[1380] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00070F7E
.text C:\WINDOWS\system32\services.exe[1380] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00070073
.text C:\WINDOWS\system32\services.exe[1380] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00070062
.text C:\WINDOWS\system32\services.exe[1380] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00070047
.text C:\WINDOWS\system32\services.exe[1380] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00070FA5
.text C:\WINDOWS\system32\services.exe[1380] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 000700A9
.text C:\WINDOWS\system32\services.exe[1380] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00070F6D
.text C:\WINDOWS\system32\services.exe[1380] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000700CE
.text C:\WINDOWS\system32\services.exe[1380] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00070F35
.text C:\WINDOWS\system32\services.exe[1380] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00070F1A
.text C:\WINDOWS\system32\services.exe[1380] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00070036
.text C:\WINDOWS\system32\services.exe[1380] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00070FD4
.text C:\WINDOWS\system32\services.exe[1380] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00070098
.text C:\WINDOWS\system32\services.exe[1380] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 0007001B
.text C:\WINDOWS\system32\services.exe[1380] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 0007000A
.text C:\WINDOWS\system32\services.exe[1380] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00070F46
.text C:\WINDOWS\system32\services.exe[1380] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00060FA8
.text C:\WINDOWS\system32\services.exe[1380] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00060043
.text C:\WINDOWS\system32\services.exe[1380] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00060FB9
.text C:\WINDOWS\system32\services.exe[1380] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00060FD4
.text C:\WINDOWS\system32\services.exe[1380] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00060F86
.text C:\WINDOWS\system32\services.exe[1380] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00060FE5
.text C:\WINDOWS\system32\services.exe[1380] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00060028
.text C:\WINDOWS\system32\services.exe[1380] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00060F97
.text C:\WINDOWS\system32\services.exe[1380] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00050FB9
.text C:\WINDOWS\system32\services.exe[1380] msvcrt.dll!system 77C293C7 5 Bytes JMP 00050044
.text C:\WINDOWS\system32\services.exe[1380] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00050FEF
.text C:\WINDOWS\system32\services.exe[1380] msvcrt.dll!_open 77C2F566 5 Bytes JMP 0005000C
.text C:\WINDOWS\system32\services.exe[1380] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00050FD4
.text C:\WINDOWS\system32\services.exe[1380] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0005001D
.text C:\WINDOWS\system32\services.exe[1380] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00040FEF
.text C:\WINDOWS\system32\lsass.exe[1392] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00E90FE5
.text C:\WINDOWS\system32\lsass.exe[1392] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00E9007D
.text C:\WINDOWS\system32\lsass.exe[1392] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00E90F92
.text C:\WINDOWS\system32\lsass.exe[1392] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00E90FA3
.text C:\WINDOWS\system32\lsass.exe[1392] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00E90062
.text C:\WINDOWS\system32\lsass.exe[1392] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00E90047
.text C:\WINDOWS\system32\lsass.exe[1392] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00E900AE
.text C:\WINDOWS\system32\lsass.exe[1392] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00E90F66
.text C:\WINDOWS\system32\lsass.exe[1392] kernel32.dll!CreateProcessW 7C802336 1 Byte [E9]
.text C:\WINDOWS\system32\lsass.exe[1392] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00E90F3A
.text C:\WINDOWS\system32\lsass.exe[1392] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00E90F55
.text C:\WINDOWS\system32\lsass.exe[1392] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00E900EE
.text C:\WINDOWS\system32\lsass.exe[1392] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00E90FC0
.text C:\WINDOWS\system32\lsass.exe[1392] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00E90000
.text C:\WINDOWS\system32\lsass.exe[1392] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00E90F77
.text C:\WINDOWS\system32\lsass.exe[1392] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00E90036
.text C:\WINDOWS\system32\lsass.exe[1392] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00E90025
.text C:\WINDOWS\system32\lsass.exe[1392] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00E900C9
.text C:\WINDOWS\system32\lsass.exe[1392] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00E80FC0
.text C:\WINDOWS\system32\lsass.exe[1392] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00E80076
.text C:\WINDOWS\system32\lsass.exe[1392] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00E80FE5
.text C:\WINDOWS\system32\lsass.exe[1392] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00E8001B
.text C:\WINDOWS\system32\lsass.exe[1392] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00E80051
.text C:\WINDOWS\system32\lsass.exe[1392] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00E8000A
.text C:\WINDOWS\system32\lsass.exe[1392] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00E80FAF
.text C:\WINDOWS\system32\lsass.exe[1392] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [08, 89]
.text C:\WINDOWS\system32\lsass.exe[1392] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00E8002C
.text C:\WINDOWS\system32\lsass.exe[1392] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00E70FB7
.text C:\WINDOWS\system32\lsass.exe[1392] msvcrt.dll!system 77C293C7 5 Bytes JMP 00E70FC8
.text C:\WINDOWS\system32\lsass.exe[1392] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00E7002E
.text C:\WINDOWS\system32\lsass.exe[1392] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00E70000
.text C:\WINDOWS\system32\lsass.exe[1392] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00E70FD9
.text C:\WINDOWS\system32\lsass.exe[1392] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00E7001D
.text C:\WINDOWS\system32\lsass.exe[1392] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00C30000
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 02530FEF
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 02530F9B
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 02530FB6
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 02530084
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 02530073
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 02530051
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 025300D9
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 025300C8
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 02530F4A
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 02530F5B
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 02530F39
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 02530062
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 0253000A
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 025300AB
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 02530040
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 02530025
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 02530F6C
.text C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 02520011
.text C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 02520022
.text C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 02520FCA
.text C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 02520FDB
.text C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 02520F6F
.text C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 02520000
.text C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 02520F80
.text C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [72, 8A] {JB 0xffffffffffffff8c}
.text C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 02520F9B
.text C:\WINDOWS\system32\svchost.exe[1560] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 02510FAD
.text C:\WINDOWS\system32\svchost.exe[1560] msvcrt.dll!system 77C293C7 5 Bytes JMP 02510038
.text C:\WINDOWS\system32\svchost.exe[1560] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 0251001D
.text C:\WINDOWS\system32\svchost.exe[1560] msvcrt.dll!_open 77C2F566 5 Bytes JMP 02510FEF
.text C:\WINDOWS\system32\svchost.exe[1560] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 02510FC8
.text C:\WINDOWS\system32\svchost.exe[1560] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0251000C
.text C:\WINDOWS\system32\svchost.exe[1560] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00FF000A
.text C:\WINDOWS\system32\svchost.exe[1608] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00DD0FEF
.text C:\WINDOWS\system32\svchost.exe[1608] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00DD0093
.text C:\WINDOWS\system32\svchost.exe[1608] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00DD0078
.text C:\WINDOWS\system32\svchost.exe[1608] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00DD0F9E
.text C:\WINDOWS\system32\svchost.exe[1608] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00DD0051
.text C:\WINDOWS\system32\svchost.exe[1608] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00DD0FB9
.text C:\WINDOWS\system32\svchost.exe[1608] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00DD00AE
.text C:\WINDOWS\system32\svchost.exe[1608] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00DD0F68
.text C:\WINDOWS\system32\svchost.exe[1608] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00DD0F4B
.text C:\WINDOWS\system32\svchost.exe[1608] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00DD00E4
.text C:\WINDOWS\system32\svchost.exe[1608] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00DD0F3A
.text C:\WINDOWS\system32\svchost.exe[1608] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00DD0040
.text C:\WINDOWS\system32\svchost.exe[1608] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00DD0FDE
.text C:\WINDOWS\system32\svchost.exe[1608] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00DD0F79
.text C:\WINDOWS\system32\svchost.exe[1608] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00DD0025
.text C:\WINDOWS\system32\svchost.exe[1608] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00DD0014
.text C:\WINDOWS\system32\svchost.exe[1608] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00DD00BF
.text C:\WINDOWS\system32\svchost.exe[1608] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00DC0025
.text C:\WINDOWS\system32\svchost.exe[1608] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00DC006C
.text C:\WINDOWS\system32\svchost.exe[1608] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00DC0FDE
.text C:\WINDOWS\system32\svchost.exe[1608] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00DC0FEF
.text C:\WINDOWS\system32\svchost.exe[1608] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00DC0FAF
.text C:\WINDOWS\system32\svchost.exe[1608] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00DC0000
.text C:\WINDOWS\system32\svchost.exe[1608] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00DC0051
.text C:\WINDOWS\system32\svchost.exe[1608] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00DC0036
.text C:\WINDOWS\system32\svchost.exe[1608] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00DB005D
.text C:\WINDOWS\system32\svchost.exe[1608] msvcrt.dll!system 77C293C7 5 Bytes JMP 00DB0FC8
.text C:\WINDOWS\system32\svchost.exe[1608] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00DB0027
.text C:\WINDOWS\system32\svchost.exe[1608] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00DB0000
.text C:\WINDOWS\system32\svchost.exe[1608] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00DB0038
.text C:\WINDOWS\system32\svchost.exe[1608] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00DB0FE3
.text C:\WINDOWS\system32\svchost.exe[1608] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00DA0000
.text C:\WINDOWS\System32\svchost.exe[1648] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 05FB0000
.text C:\WINDOWS\System32\svchost.exe[1648] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 05FB0F70
.text C:\WINDOWS\System32\svchost.exe[1648] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 05FB0F8B
.text C:\WINDOWS\System32\svchost.exe[1648] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 05FB0F9C
.text C:\WINDOWS\System32\svchost.exe[1648] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 05FB005B
.text C:\WINDOWS\System32\svchost.exe[1648] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 05FB0FB9
.text C:\WINDOWS\System32\svchost.exe[1648] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 05FB0F2E
.text C:\WINDOWS\System32\svchost.exe[1648] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 05FB0F3F
.text C:\WINDOWS\System32\svchost.exe[1648] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 05FB0F02
.text C:\WINDOWS\System32\svchost.exe[1648] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 05FB0F1D
.text C:\WINDOWS\System32\svchost.exe[1648] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 05FB0EF1
.text C:\WINDOWS\System32\svchost.exe[1648] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 05FB004A
.text C:\WINDOWS\System32\svchost.exe[1648] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 05FB001B
.text C:\WINDOWS\System32\svchost.exe[1648] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 05FB0076
.text C:\WINDOWS\System32\svchost.exe[1648] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 05FB0FCA
.text C:\WINDOWS\System32\svchost.exe[1648] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 05FB0FDB
.text C:\WINDOWS\System32\svchost.exe[1648] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 05FB0091
.text C:\WINDOWS\System32\svchost.exe[1648] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 05FA0FC3
.text C:\WINDOWS\System32\svchost.exe[1648] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 05FA0F8D
.text C:\WINDOWS\System32\svchost.exe[1648] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 05FA0FD4
.text C:\WINDOWS\System32\svchost.exe[1648] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 05FA0000
.text C:\WINDOWS\System32\svchost.exe[1648] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 05FA0F9E
.text C:\WINDOWS\System32\svchost.exe[1648] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 05FA0FEF
.text C:\WINDOWS\System32\svchost.exe[1648] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 05FA004A
.text C:\WINDOWS\System32\svchost.exe[1648] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 05FA0025
.text C:\WINDOWS\System32\svchost.exe[1648] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 0335004B
.text C:\WINDOWS\System32\svchost.exe[1648] msvcrt.dll!system 77C293C7 5 Bytes JMP 0335003A
.text C:\WINDOWS\System32\svchost.exe[1648] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 03350029
.text C:\WINDOWS\System32\svchost.exe[1648] msvcrt.dll!_open 77C2F566 5 Bytes JMP 03350FEF
.text C:\WINDOWS\System32\svchost.exe[1648] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 03350FCA
.text C:\WINDOWS\System32\svchost.exe[1648] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0335000C
.text C:\WINDOWS\System32\svchost.exe[1648] WS2_32.dll!socket 71AB4211 5 Bytes JMP 03340FEF
.text C:\WINDOWS\System32\svchost.exe[1648] WININET.dll!InternetOpenA 3D953081 5 Bytes JMP 03330FEF
.text C:\WINDOWS\System32\svchost.exe[1648] WININET.dll!InternetOpenW 3D9536B1 5 Bytes JMP 03330FD4
.text C:\WINDOWS\System32\svchost.exe[1648] WININET.dll!InternetOpenUrlA 3D956F5A 5 Bytes JMP 03330FB9
.text C:\WINDOWS\System32\svchost.exe[1648] WININET.dll!InternetOpenUrlW 3D998439 5 Bytes JMP 03330FA8
.text C:\WINDOWS\system32\svchost.exe[1800] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00D9000A
.text C:\WINDOWS\system32\svchost.exe[1800] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00D90F68
.text C:\WINDOWS\system32\svchost.exe[1800] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00D9005D
.text C:\WINDOWS\system32\svchost.exe[1800] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00D90F83
.text C:\WINDOWS\system32\svchost.exe[1800] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00D90040
.text C:\WINDOWS\system32\svchost.exe[1800] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00D90FAF
.text C:\WINDOWS\system32\svchost.exe[1800] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00D90098
.text C:\WINDOWS\system32\svchost.exe[1800] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00D90F46
.text C:\WINDOWS\system32\svchost.exe[1800] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00D90F24
.text C:\WINDOWS\system32\svchost.exe[1800] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00D90F35
.text C:\WINDOWS\system32\svchost.exe[1800] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00D900E2
.text C:\WINDOWS\system32\svchost.exe[1800] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00D90F9E
.text C:\WINDOWS\system32\svchost.exe[1800] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00D90FEF
.text C:\WINDOWS\system32\svchost.exe[1800] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00D90F57
.text C:\WINDOWS\system32\svchost.exe[1800] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00D90FCA
.text C:\WINDOWS\system32\svchost.exe[1800] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00D9001B
.text C:\WINDOWS\system32\svchost.exe[1800] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00D900B3
.text C:\WINDOWS\system32\svchost.exe[1800] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00D80FB9
.text C:\WINDOWS\system32\svchost.exe[1800] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00D8004A
.text C:\WINDOWS\system32\svchost.exe[1800] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00D80FD4
.text C:\WINDOWS\system32\svchost.exe[1800] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00D80FE5
.text C:\WINDOWS\system32\svchost.exe[1800] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00D80F8D
.text C:\WINDOWS\system32\svchost.exe[1800] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00D80000
.text C:\WINDOWS\system32\svchost.exe[1800] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00D80FA8
.text C:\WINDOWS\system32\svchost.exe[1800] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [F8, 88]
.text C:\WINDOWS\system32\svchost.exe[1800] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00D8002F
.text C:\WINDOWS\system32\svchost.exe[1800] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00D70F9C
.text C:\WINDOWS\system32\svchost.exe[1800] msvcrt.dll!system 77C293C7 5 Bytes JMP 00D70FB7
.text C:\WINDOWS\system32\svchost.exe[1800] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00D70FD2
.text C:\WINDOWS\system32\svchost.exe[1800] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00D70FEF
.text C:\WINDOWS\system32\svchost.exe[1800] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00D70027
.text C:\WINDOWS\system32\svchost.exe[1800] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00D7000C
.text C:\WINDOWS\system32\svchost.exe[1800] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00D60FEF
.text C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00D8000A
.text C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00D8007B
.text C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00D80F90
.text C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00D8005E
.text C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00D80FA1
.text C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00D80FBC
.text C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00D80096
.text C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00D80F5A
.text C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00D80F1B
.text C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00D80F2C
.text C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00D800C5
.text C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00D80039
.text C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00D80FEF
.text C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00D80F75
.text C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00D80FCD
.text C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00D80FDE
.text C:\WINDOWS\system32\svchost.exe[1828] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00D80F3D
.text C:\WINDOWS\system32\svchost.exe[1828] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00D70FAF
.text C:\WINDOWS\system32\svchost.exe[1828] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00D70F79
.text C:\WINDOWS\system32\svchost.exe[1828] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00D70FC0
.text C:\WINDOWS\system32\svchost.exe[1828] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00D70FE5
.text C:\WINDOWS\system32\svchost.exe[1828] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00D7002C
.text C:\WINDOWS\system32\svchost.exe[1828] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00D70000
.text C:\WINDOWS\system32\svchost.exe[1828] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00D70F94
.text C:\WINDOWS\system32\svchost.exe[1828] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [F7, 88]
.text C:\WINDOWS\system32\svchost.exe[1828] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00D7001B
.text C:\WINDOWS\system32\svchost.exe[1828] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00D60FC3
.text C:\WINDOWS\system32\svchost.exe[1828] msvcrt.dll!system 77C293C7 5 Bytes JMP 00D60FD4
.text C:\WINDOWS\system32\svchost.exe[1828] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00D60029
.text C:\WINDOWS\system32\svchost.exe[1828] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00D6000C
.text C:\WINDOWS\system32\svchost.exe[1828] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00D60044
.text C:\WINDOWS\system32\svchost.exe[1828] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00D60FEF
.text C:\WINDOWS\system32\svchost.exe[1828] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00D50FEF
.text C:\WINDOWS\system32\svchost.exe[1828] WININET.dll!InternetOpenA 3D953081 5 Bytes JMP 00F60FE5
.text C:\WINDOWS\system32\svchost.exe[1828] WININET.dll!InternetOpenW 3D9536B1 5 Bytes JMP 00F60FD4
.text C:\WINDOWS\system32\svchost.exe[1828] WININET.dll!InternetOpenUrlA 3D956F5A 5 Bytes JMP 00F6000A
.text C:\WINDOWS\system32\svchost.exe[1828] WININET.dll!InternetOpenUrlW 3D998439 5 Bytes JMP 00F6001B
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BE0FEF
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BE009A
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BE0FAF
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BE007D
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BE006C
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BE0040
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BE0F52
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BE0F63
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BE0F26
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BE0F37
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00BE0F0B
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00BE0051
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00BE000A
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00BE0F8A
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00BE0FD4
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00BE002F
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00BE00B5
.text C:\WINDOWS\system32\svchost.exe[2032] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00660047
.text C:\WINDOWS\system32\svchost.exe[2032] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00660FBD
.text C:\WINDOWS\system32\svchost.exe[2032] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0066002C
.text C:\WINDOWS\system32\svchost.exe[2032] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0066001B
.text C:\WINDOWS\system32\svchost.exe[2032] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00660084
.text C:\WINDOWS\system32\svchost.exe[2032] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00660000
.text C:\WINDOWS\system32\svchost.exe[2032] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00660073
.text C:\WINDOWS\system32\svchost.exe[2032] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00660058
.text C:\WINDOWS\system32\svchost.exe[2032] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00650FB7
.text C:\WINDOWS\system32\svchost.exe[2032] msvcrt.dll!system 77C293C7 5 Bytes JMP 00650042
.text C:\WINDOWS\system32\svchost.exe[2032] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00650FD2
.text C:\WINDOWS\system32\svchost.exe[2032] msvcrt.dll!_open 77C2F566 5 Bytes JMP 0065000C
.text C:\WINDOWS\system32\svchost.exe[2032] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00650027
.text C:\WINDOWS\system32\svchost.exe[2032] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00650FE3
.text C:\WINDOWS\system32\svchost.exe[2032] WININET.dll!InternetOpenA 3D953081 5 Bytes JMP 00630FEF
.text C:\WINDOWS\system32\svchost.exe[2032] WININET.dll!InternetOpenW 3D9536B1 5 Bytes JMP 00630FDE
.text C:\WINDOWS\system32\svchost.exe[2032] WININET.dll!InternetOpenUrlA 3D956F5A 5 Bytes JMP 00630FCD
.text C:\WINDOWS\system32\svchost.exe[2032] WININET.dll!InternetOpenUrlW 3D998439 5 Bytes JMP 00630FBC
.text C:\WINDOWS\system32\svchost.exe[2032] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00640FEF
.text C:\WINDOWS\System32\svchost.exe[2212] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00F80000
.text C:\WINDOWS\System32\svchost.exe[2212] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00F80073
.text C:\WINDOWS\System32\svchost.exe[2212] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00F80F7E
.text C:\WINDOWS\System32\svchost.exe[2212] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00F80058
.text C:\WINDOWS\System32\svchost.exe[2212] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00F80F9B
.text C:\WINDOWS\System32\svchost.exe[2212] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00F80FC0
.text C:\WINDOWS\System32\svchost.exe[2212] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00F800B2
.text C:\WINDOWS\System32\svchost.exe[2212] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00F800A1
.text C:\WINDOWS\System32\svchost.exe[2212] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00F80F23
.text C:\WINDOWS\System32\svchost.exe[2212] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00F80F3E
.text C:\WINDOWS\System32\svchost.exe[2212] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00F800D7
.text C:\WINDOWS\System32\svchost.exe[2212] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00F80047
.text C:\WINDOWS\System32\svchost.exe[2212] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00F80FE5
.text C:\WINDOWS\System32\svchost.exe[2212] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00F80084
.text C:\WINDOWS\System32\svchost.exe[2212] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00F8002C
.text C:\WINDOWS\System32\svchost.exe[2212] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00F80011
.text C:\WINDOWS\System32\svchost.exe[2212] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00F80F4F
.text C:\WINDOWS\System32\svchost.exe[2212] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00F70051
.text C:\WINDOWS\System32\svchost.exe[2212] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00F70FAF
.text C:\WINDOWS\System32\svchost.exe[2212] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00F70036
.text C:\WINDOWS\System32\svchost.exe[2212] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00F70025
.text C:\WINDOWS\System32\svchost.exe[2212] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00F70FCA
.text C:\WINDOWS\System32\svchost.exe[2212] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00F7000A
.text C:\WINDOWS\System32\svchost.exe[2212] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00F70FDB
.text C:\WINDOWS\System32\svchost.exe[2212] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [17, 89]
.text C:\WINDOWS\System32\svchost.exe[2212] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00F70062
.text C:\WINDOWS\System32\svchost.exe[2212] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 006C0F90
.text C:\WINDOWS\System32\svchost.exe[2212] msvcrt.dll!system 77C293C7 5 Bytes JMP 006C001B
.text C:\WINDOWS\System32\svchost.exe[2212] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 006C0FB5
.text C:\WINDOWS\System32\svchost.exe[2212] msvcrt.dll!_open 77C2F566 5 Bytes JMP 006C0FEF
.text C:\WINDOWS\System32\svchost.exe[2212] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 006C000A
.text C:\WINDOWS\System32\svchost.exe[2212] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 006C0FC6
.text C:\WINDOWS\System32\svchost.exe[2212] WS2_32.dll!socket 71AB4211 5 Bytes JMP 006B0FEF
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[2716] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0041C130 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[2716] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 0041C1B0 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\WINDOWS\system32\dllhost.exe[3168] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00F10000
.text C:\WINDOWS\system32\dllhost.exe[3168] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00F10FAC
.text C:\WINDOWS\system32\dllhost.exe[3168] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00F100AB
.text C:\WINDOWS\system32\dllhost.exe[3168] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00F1008E
.text C:\WINDOWS\system32\dllhost.exe[3168] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00F1007D
.text C:\WINDOWS\system32\dllhost.exe[3168] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00F10FE5
.text C:\WINDOWS\system32\dllhost.exe[3168] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00F10F80
.text C:\WINDOWS\system32\dllhost.exe[3168] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00F100C6
.text C:\WINDOWS\system32\dllhost.exe[3168] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00F10F39
.text C:\WINDOWS\system32\dllhost.exe[3168] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00F10F54
.text C:\WINDOWS\system32\dllhost.exe[3168] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00F100ED
.text C:\WINDOWS\system32\dllhost.exe[3168] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00F1006C
.text C:\WINDOWS\system32\dllhost.exe[3168] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00F1001B
.text C:\WINDOWS\system32\dllhost.exe[3168] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00F10F9B
.text C:\WINDOWS\system32\dllhost.exe[3168] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00F10051
.text C:\WINDOWS\system32\dllhost.exe[3168] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00F10040
.text C:\WINDOWS\system32\dllhost.exe[3168] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00F10F65
.text C:\WINDOWS\system32\dllhost.exe[3168] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00EF0F9C
.text C:\WINDOWS\system32\dllhost.exe[3168] msvcrt.dll!system 77C293C7 5 Bytes JMP 00EF0FB7
.text C:\WINDOWS\system32\dllhost.exe[3168] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00EF000C
.text C:\WINDOWS\system32\dllhost.exe[3168] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00EF0FEF
.text C:\WINDOWS\system32\dllhost.exe[3168] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00EF0027
.text C:\WINDOWS\system32\dllhost.exe[3168] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00EF0FD2
.text C:\WINDOWS\system32\dllhost.exe[3168] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00F00036
.text C:\WINDOWS\system32\dllhost.exe[3168] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00F00F9E
.text C:\WINDOWS\system32\dllhost.exe[3168] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00F0001B
.text C:\WINDOWS\system32\dllhost.exe[3168] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00F00FEF
.text C:\WINDOWS\system32\dllhost.exe[3168] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00F00FAF
.text C:\WINDOWS\system32\dllhost.exe[3168] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00F0000A
.text C:\WINDOWS\system32\dllhost.exe[3168] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00F00051
.text C:\WINDOWS\system32\dllhost.exe[3168] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00F00FCA
.text C:\WINDOWS\system32\dllhost.exe[3168] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00EE0000
.text C:\WINDOWS\system32\svchost.exe[3384] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00CA0FEF
.text C:\WINDOWS\system32\svchost.exe[3384] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00CA0082
.text C:\WINDOWS\system32\svchost.exe[3384] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00CA0F97
.text C:\WINDOWS\system32\svchost.exe[3384] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00CA0071
.text C:\WINDOWS\system32\svchost.exe[3384] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00CA0FA8
.text C:\WINDOWS\system32\svchost.exe[3384] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00CA002F
.text C:\WINDOWS\system32\svchost.exe[3384] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00CA0F57
.text C:\WINDOWS\system32\svchost.exe[3384] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00CA009D
.text C:\WINDOWS\system32\svchost.exe[3384] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00CA0F17
.text C:\WINDOWS\system32\svchost.exe[3384] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00CA00BA
.text C:\WINDOWS\system32\svchost.exe[3384] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00CA00CB
.text C:\WINDOWS\system32\svchost.exe[3384] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00CA0040
.text C:\WINDOWS\system32\svchost.exe[3384] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00CA0FD4
.text C:\WINDOWS\system32\svchost.exe[3384] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00CA0F72
.text C:\WINDOWS\system32\svchost.exe[3384] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00CA0014
.text C:\WINDOWS\system32\svchost.exe[3384] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00CA0FC3
.text C:\WINDOWS\system32\svchost.exe[3384] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00CA0F3C
.text C:\WINDOWS\system32\svchost.exe[3384] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00C90025
.text C:\WINDOWS\system32\svchost.exe[3384] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00C9006C
.text C:\WINDOWS\system32\svchost.exe[3384] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00C90FD4
.text C:\WINDOWS\system32\svchost.exe[3384] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00C9000A
.text C:\WINDOWS\system32\svchost.exe[3384] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00C9005B
.text C:\WINDOWS\system32\svchost.exe[3384] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00C90FE5
.text C:\WINDOWS\system32\svchost.exe[3384] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00C90FAF
.text C:\WINDOWS\system32\svchost.exe[3384] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes JMP C89FEDE5
.text C:\WINDOWS\system32\svchost.exe[3384] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00C90036
.text C:\WINDOWS\system32\svchost.exe[3384] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00C80042
.text C:\WINDOWS\system32\svchost.exe[3384] msvcrt.dll!system 77C293C7 5 Bytes JMP 00C80FB7
.text C:\WINDOWS\system32\svchost.exe[3384] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00C80FE3
.text C:\WINDOWS\system32\svchost.exe[3384] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00C8000C
.text C:\WINDOWS\system32\svchost.exe[3384] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00C80FC8
.text C:\WINDOWS\system32\svchost.exe[3384] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00C8001D
.text C:\WINDOWS\system32\svchost.exe[3384] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00C70FE5
.text C:\WINDOWS\system32\svchost.exe[3396] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BD0FE5
.text C:\WINDOWS\system32\svchost.exe[3396] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BD0F54
.text C:\WINDOWS\system32\svchost.exe[3396] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BD0053
.text C:\WINDOWS\system32\svchost.exe[3396] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BD0F79
.text C:\WINDOWS\system32\svchost.exe[3396] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BD0F8A
.text C:\WINDOWS\system32\svchost.exe[3396] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BD0FA5
.text C:\WINDOWS\system32\svchost.exe[3396] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BD008B
.text C:\WINDOWS\system32\svchost.exe[3396] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BD0F43
.text C:\WINDOWS\system32\svchost.exe[3396] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BD00C1
.text C:\WINDOWS\system32\svchost.exe[3396] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BD0F28
.text C:\WINDOWS\system32\svchost.exe[3396] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00BD0F0D
.text C:\WINDOWS\system32\svchost.exe[3396] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00BD002C
.text C:\WINDOWS\system32\svchost.exe[3396] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00BD0000
.text C:\WINDOWS\system32\svchost.exe[3396] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00BD0064
.text C:\WINDOWS\system32\svchost.exe[3396] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00BD0FC0
.text C:\WINDOWS\system32\svchost.exe[3396] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00BD0011
.text C:\WINDOWS\system32\svchost.exe[3396] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00BD00A6
.text C:\WINDOWS\system32\svchost.exe[3396] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00BC0FD4
.text C:\WINDOWS\system32\svchost.exe[3396] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00BC0F8D
.text C:\WINDOWS\system32\svchost.exe[3396] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00BC0FEF
.text C:\WINDOWS\system32\svchost.exe[3396] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00BC001B
.text C:\WINDOWS\system32\svchost.exe[3396] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00BC0054
.text C:\WINDOWS\system32\svchost.exe[3396] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00BC0000
.text C:\WINDOWS\system32\svchost.exe[3396] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00BC0FB2
.text C:\WINDOWS\system32\svchost.exe[3396] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [DC, 88]
.text C:\WINDOWS\system32\svchost.exe[3396] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00BC0FC3
.text C:\WINDOWS\system32\svchost.exe[3396] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00BB0FCF
.text C:\WINDOWS\system32\svchost.exe[3396] msvcrt.dll!system 77C293C7 5 Bytes JMP 00BB005A
.text C:\WINDOWS\system32\svchost.exe[3396] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00BB002E
.text C:\WINDOWS\system32\svchost.exe[3396] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00BB0000
.text C:\WINDOWS\system32\svchost.exe[3396] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00BB0049
.text C:\WINDOWS\system32\svchost.exe[3396] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00BB0011
.text C:\WINDOWS\system32\svchost.exe[3572] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 01480FE5
.text C:\WINDOWS\system32\svchost.exe[3572] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 01480F94
.text C:\WINDOWS\system32\svchost.exe[3572] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 01480FA5
.text C:\WINDOWS\system32\svchost.exe[3572] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 01480089
.text C:\WINDOWS\system32\svchost.exe[3572] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 0148006C
.text C:\WINDOWS\system32\svchost.exe[3572] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 01480036
.text C:\WINDOWS\system32\svchost.exe[3572] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 014800B5
.text C:\WINDOWS\system32\svchost.exe[3572] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 0148009A
.text C:\WINDOWS\system32\svchost.exe[3572] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 01480F1C
.text C:\WINDOWS\system32\svchost.exe[3572] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 01480F2D
.text C:\WINDOWS\system32\svchost.exe[3572] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 01480F0B
.text C:\WINDOWS\system32\svchost.exe[3572] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 01480051
.text C:\WINDOWS\system32\svchost.exe[3572] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 01480FD4
.text C:\WINDOWS\system32\svchost.exe[3572] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 01480F6F
.text C:\WINDOWS\system32\svchost.exe[3572] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 01480025
.text C:\WINDOWS\system32\svchost.exe[3572] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 0148000A
.text C:\WINDOWS\system32\svchost.exe[3572] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 01480F52
.text C:\WINDOWS\system32\svchost.exe[3572] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 01470FB9
.text C:\WINDOWS\system32\svchost.exe[3572] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 01470F83
.text C:\WINDOWS\system32\svchost.exe[3572] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0147000A
.text C:\WINDOWS\system32\svchost.exe[3572] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 01470FDE
.text C:\WINDOWS\system32\svchost.exe[3572] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 01470040
.text C:\WINDOWS\system32\svchost.exe[3572] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 01470FEF
.text C:\WINDOWS\system32\svchost.exe[3572] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 0147002F
.text C:\WINDOWS\system32\svchost.exe[3572] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 01470F9E
.text C:\WINDOWS\system32\svchost.exe[3572] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 01460FAD
.text C:\WINDOWS\system32\svchost.exe[3572] msvcrt.dll!system 77C293C7 5 Bytes JMP 01460FD2
.text C:\WINDOWS\system32\svchost.exe[3572] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 01460027
.text C:\WINDOWS\system32\svchost.exe[3572] msvcrt.dll!_open 77C2F566 5 Bytes JMP 01460000
.text C:\WINDOWS\system32\svchost.exe[3572] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 01460042
.text C:\WINDOWS\system32\svchost.exe[3572] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 01460FE3
.text C:\WINDOWS\system32\svchost.exe[3572] WS2_32.dll!socket 71AB4211 5 Bytes JMP 01450000
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00260FEF
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00260F88
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00260FA3
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00260087
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00260FCA
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0026005B
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 002600BF
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00260F77
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00260F26
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00260F41
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 002600DA
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 0026006C
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 0026000A
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00260098
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00260036
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00260025
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00260F52
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00350FB9
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00350058
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00350FD4
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00350FE5
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00350047
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 0035000A
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00350036
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00350025
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E1DF4B9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E352046 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E351FC7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E35200B C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E351F53 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E351F8D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] USER32.dll!DialogBoxIndirectParamA 7E456D7D 1 Byte [E9]
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E352081 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E2017EA C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00360044
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] msvcrt.dll!system 77C293C7 5 Bytes JMP 00360033
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00360FD4
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00360FEF
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00360FC3
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00360018
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 3E352243 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] WININET.dll!InternetOpenA 3D953081 5 Bytes JMP 01CF000A
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] WININET.dll!InternetOpenW 3D9536B1 5 Bytes JMP 01CF001B
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] WININET.dll!InternetOpenUrlA 3D956F5A 5 Bytes JMP 01CF0FE5
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] WININET.dll!InternetOpenUrlW 3D998439 5 Bytes JMP 01CF0036
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[6048] ws2_32.dll!socket 71AB4211 5 Bytes JMP 02980FE5

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 eabfiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Development Company, L.P.)
AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

Device \Driver\Disk \Device\Harddisk0\DR0 aksfridge.sys (Ancillary Function Driver/Aladdin Knowledge Systems Ltd.)

AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

—- EOF - GMER 1.0.15 —-
Post #28
Hi,

Your logs look clean.

I'm interested to know if your McAfee real time protection or virus scan - did a scan after you ran the first GMER scan, if there are any logs, I would be interested in seeing them. There was an infected driver on your system, which essentially, hasn't revealed itself in any of the logs, I'm interested if your antivirus or realtime protection devoured it.

In the meantime we can clean up our tools:

Please do the following:

Follow these steps to uninstall Combofix

  • Click START then RUN
  • Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]




NEXT

Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.


If any logs/tools remain on your desktop > right click and delete them.


NEXT


Below I have included a number of recommendations for how to protect your computer against malware infections.

  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them
    Then consider a password keeper, to keep all your passwords safe.

  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

  • For realtime protection against spyware, try SpywareTerminator


    WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox, IE and chrome.


  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.

  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.


**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.
Post #29
The McAfee logs can be found when I open the security center but I can't copy them tfrom there. Is there a file that I can open to copy them from? . Advise taken on all the other points. I do have my pictures, important files and embroidery files saved to an external hard drive., Thanks
Post #30 last edited
No, I'm sorry, I'm not familiar with the program at all as I've never used it - If ctrl + C > then Ctrl +V doesn't work, no to worry. I was looking for a file from c:\windows\system32\drivers\??????.sys if there isn't such a file, then it will remain a mystery..

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI