[Resolved] Generic Host problem, browser hijacks, blue screens etc

Deleted Member Topic Starter

Post #1February 4, 2010, 8:21 PM UTC last edited February 4, 2010, 8:24 PM UTC

Hi, I have a small Samsung notebook and have recently had problems with the generic host messge followed by an automated shutdown. I have tried various fixes previously reccomended on here and installed Norton Internet Security and Norton Utilities and did all the scans, Then I had a system crash after which windows wouldn't boot, whichever mode I selected it would go straight to a blue screen which displayed for less than a second and then shut down. This has happened twice since.

The only way I could recover the system was to use Samsung Recovery, There were two restore points both when the computer was virtually brand new so I have lost all of my data up to last week, Norton Internet Security has been removed but McCaffee is running on a 30 day trial.

I have had a couple of lesser crashes since, after which I get a Windows message saying that the computer has recovered from a serious problem.

The generic host message has not appeared for a while but the browser still gets redirected to various shopping or search sites.

I am sorry, I left sections in one of the scans contrary to instruction but I was working offline to avoid interference and didn't have the malware removal guide to hand.

PS, Gewn (sic)Morgan was the original owner of the PC

Hear are the logfiles:

Malwarebytes' Anti-Malware 1.44
Database version: 3674
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

02/02/2010 21:17:48
mbam-log-2010-02-02 (21-17-48).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 140356
Time elapsed: 26 minute(s), 47 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 21:09:05.00 on 03/02/2010
Internet Explorer: 6.0.2900.5512
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.610 [GMT 0:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Samsung\Samsung EDS\EDSAgent.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Samsung\Samsung Battery Manager\BatteryManager.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
C:\Program Files\SAMSUNG\MagicKBD\MagicKBD.exe
C:\Program Files\SAMSUNG\MagicKBD\PerformanceManager.exe
C:\WINDOWS\system32\igfxext.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Program Files\Samsung\Samsung Update Plus\SLUTrayNotifier.exe
C:\Documents and Settings\gewn morgan\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
mDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\progra~1\mcafee\viruss~1\scriptsn.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [SunJavaUpdateSched] c:\program files\java\jre1.5.0\bin\jusched.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: []
mRun: [EDS] c:\program files\samsung\samsung eds\EDSAgent.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [DMHotKey] c:\program files\samsung\easy display manager\DMLoader.exe
mRun: [BatteryManager] c:\program files\samsung\samsung battery manager\BatteryManager.exe
mRun: [MagicKeyboard] c:\program files\samsung\magickbd\PreMKBD.exe
mRun: [mcagent_exe] c:\program files\mcafee.com\agent\mcagent.exe /runkey
mRun: [MobileConnect] c:\program files\vodafone\vodafone mobile connect\bin\MobileConnect.exe /silent
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
Notify: igfxcui - igfxdev.dll

============= SERVICES / DRIVERS ===============

R1 mfehidk;McAfee Inc.;c:\windows\system32\drivers\mfehidk.sys [2009-4-2 201288]
R2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;c:\program files\microsoft small business\business contact manager\BcmSqlStartupSvc.exe [2008-1-11 30312]
R2 DOSMEMIO;MEMIO;c:\windows\system32\MEMIO.SYS [2009-4-2 4300]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2009-4-2 359248]
R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2009-4-2 144704]
R2 VMCService;Vodafone Mobile Connect Service;c:\program files\vodafone\vodafone mobile connect\bin\VMCService.exe [2008-11-4 14336]
R2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32mpcoinst,serviceStartProc –> RUNDLL32.EXE ykx32mpcoinst,serviceStartProc [?]
R3 DNSeFilter;DNSeFilter;c:\windows\system32\drivers\SamsungEDS.SYS [2008-1-15 30208]
R3 hspabus;SAMSUNG HSPA USB Composite Device driver (WDM);c:\windows\system32\drivers\hspabus.sys [2009-5-21 91776]
R3 hspamdfl;SAMSUNG HSPA Modem Filter;c:\windows\system32\drivers\hspamdfl.sys [2009-5-21 14976]
R3 hspamdm;SAMSUNG HSPA Modem Drivers;c:\windows\system32\drivers\hspamdm.sys [2009-5-21 119808]
R3 hspaserd;SAMSUNG HSPA Modem Diagnostic Serial Port (WDM);c:\windows\system32\drivers\hspaserd.sys [2009-5-21 98560]
R3 mfeavfk;McAfee Inc.;c:\windows\system32\drivers\mfeavfk.sys [2009-4-2 79304]
R3 mfebopk;McAfee Inc.;c:\windows\system32\drivers\mfebopk.sys [2009-4-2 35240]
R3 VMC326;Vimicro Camera Service VMC326;c:\windows\system32\drivers\VMC326.sys [2009-4-2 238464]
S2 0025851265052709mcinstcleanup;McAfee Application Installer Cleanup (0025851265052709);c:\windows\temp\002585~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service –> c:\windows\temp\002585~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?]
S3 mferkdk;McAfee Inc.;c:\windows\system32\drivers\mferkdk.sys [2009-4-2 33800]
S3 mfesmfk;McAfee Inc.;c:\windows\system32\drivers\mfesmfk.sys [2009-4-2 40488]
S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2006-4-14 28933976]
S4 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2009-4-2 695624]

=============== Created Last 30 ================

2010-02-03 20:38 –d—– c:\windows\system32\XPSViewer
2010-02-03 20:38 597,504 -c—— c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-02-03 20:38 89,088 -c—— c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-02-03 20:38 117,760 ——– c:\windows\system32\prntvpt.dll
2010-02-03 20:38 1,676,288 -c—— c:\windows\system32\dllcache\xpssvcs.dll
2010-02-03 20:38 575,488 -c—— c:\windows\system32\dllcache\xpsshhdr.dll
2010-02-03 20:38 1,676,288 ——– c:\windows\system32\xpssvcs.dll
2010-02-03 20:38 575,488 ——– c:\windows\system32\xpsshhdr.dll
2010-02-02 20:57 455,296 -c—— c:\windows\system32\dllcache\mrxsmb.sys
2010-02-02 20:56 272,128 -c—— c:\windows\system32\dllcache\bthport.sys
2010-02-02 20:56 272,128 ——– c:\windows\system32\drivers\bthport.sys
2010-02-02 20:53 2,145,280 -c—— c:\windows\system32\dllcache\ntkrnlmp.exe
2010-02-02 20:53 2,023,936 -c—— c:\windows\system32\dllcache\ntkrpamp.exe
2010-02-02 20:53 2,066,048 -c—— c:\windows\system32\dllcache\ntkrnlpa.exe
2010-02-02 20:53 2,560 ——– c:\windows\system32\xpsp4res.dll
2010-02-01 23:39 –d—– c:\windows\system32\PreInstall
2010-02-01 23:39 26,488 a——- c:\windows\system32\spupdsvc.exe
2010-02-01 21:38 –d—– c:\docume~1\gewnmo~1\applic~1\Malwarebytes
2010-02-01 21:38 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-01 21:38 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-02-01 21:38 19,160 a——- c:\windows\system32\drivers\mbam.sys
2010-02-01 21:38 –d—– c:\program files\Malwarebytes' Anti-Malware
2010-02-01 20:22 –d—– c:\program files\Trend Micro
2010-02-01 19:26 –ds—- c:\documents and settings\gewn morgan\UserData
2010-02-01 19:26 –d—– c:\windows\system32\SoftwareDistribution

==================== Find3M ====================

2009-12-22 05:21 667,136 a——- c:\windows\system32\wininet.dll
2009-12-22 05:20 81,920 a——- c:\windows\system32\ieencode.dll
2009-11-21 15:51 471,552 a——- c:\windows\apppatch\aclayers.dll

============= FINISH: 21:09:56.79 ===============

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-02-03 21:23:21
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\GEWNMO~1\LOCALS~1\Temp\afryraod.sys

—- System - GMER 1.0.15 —-

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xA9EDE97A]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xA9EDE928]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xA9EDE93C]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xA9EDE9BA]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xA9EDE900]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xA9EDE914]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xA9EDE98E]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0xA9EDE966]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xA9EDE952]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xA9EDE9E9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xA9EDE9D0]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xA9EDE9A4]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!ZwYieldExecution 80515A6A 7 Bytes JMP A9EDE9A8 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtCreateFile 8057C328 5 Bytes JMP A9EDE97E \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtSetInformationProcess 8057CFC0 5 Bytes JMP A9EDE956 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwUnmapViewOfSection 8057DEF1 5 Bytes JMP A9EDE9D4 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtMapViewOfSection 8057E369 7 Bytes JMP A9EDE9BE \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtOpenProcess 80581702 5 Bytes JMP A9EDE904 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwProtectVirtualMemory 80581889 7 Bytes JMP A9EDE992 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwCreateProcessEx 8058B7CD 7 Bytes JMP A9EDE940 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwTerminateProcess 8058E695 5 Bytes JMP A9EDE9ED \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwCreateProcess 805B0470 5 Bytes JMP A9EDE92C \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtOpenThread 805E1941 5 Bytes JMP A9EDE918 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwSetContextThread 80635977 5 Bytes JMP A9EDE96A \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\system32\svchost.exe[200] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C50000
.text C:\WINDOWS\system32\svchost.exe[200] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C5006E
.text C:\WINDOWS\system32\svchost.exe[200] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C50F79
.text C:\WINDOWS\system32\svchost.exe[200] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C50F8A
.text C:\WINDOWS\system32\svchost.exe[200] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C50047
.text C:\WINDOWS\system32\svchost.exe[200] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C50FAC
.text C:\WINDOWS\system32\svchost.exe[200] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C50090
.text C:\WINDOWS\system32\svchost.exe[200] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C50F48
.text C:\WINDOWS\system32\svchost.exe[200] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C50F2D
.text C:\WINDOWS\system32\svchost.exe[200] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C500C6
.text C:\WINDOWS\system32\svchost.exe[200] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00C50F12
.text C:\WINDOWS\system32\svchost.exe[200] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00C50F9B
.text C:\WINDOWS\system32\svchost.exe[200] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C50FDB
.text C:\WINDOWS\system32\svchost.exe[200] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00C5007F
.text C:\WINDOWS\system32\svchost.exe[200] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00C50022
.text C:\WINDOWS\system32\svchost.exe[200] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00C50011
.text C:\WINDOWS\system32\svchost.exe[200] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00C500A1
.text C:\WINDOWS\system32\svchost.exe[200] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00C4002F
.text C:\WINDOWS\system32\svchost.exe[200] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00C40F9E
.text C:\WINDOWS\system32\svchost.exe[200] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00C40FD4
.text C:\WINDOWS\system32\svchost.exe[200] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00C40000
.text C:\WINDOWS\system32\svchost.exe[200] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00C4005B
.text C:\WINDOWS\system32\svchost.exe[200] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00C40FEF
.text C:\WINDOWS\system32\svchost.exe[200] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00C40FC3
.text C:\WINDOWS\system32\svchost.exe[200] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [E4, 88] {IN AL, 0x88}
.text C:\WINDOWS\system32\svchost.exe[200] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00C40040
.text C:\WINDOWS\system32\svchost.exe[200] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00C30036
.text C:\WINDOWS\system32\svchost.exe[200] msvcrt.dll!system 77C293C7 5 Bytes JMP 00C30FA1
.text C:\WINDOWS\system32\svchost.exe[200] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00C30000
.text C:\WINDOWS\system32\svchost.exe[200] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00C30FE3
.text C:\WINDOWS\system32\svchost.exe[200] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00C30011
.text C:\WINDOWS\system32\svchost.exe[200] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00C30FC6
.text C:\WINDOWS\Explorer.EXE[696] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 022A0000
.text C:\WINDOWS\Explorer.EXE[696] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 022A0078
.text C:\WINDOWS\Explorer.EXE[696] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 022A0F83
.text C:\WINDOWS\Explorer.EXE[696] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 022A0F94
.text C:\WINDOWS\Explorer.EXE[696] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 022A0051
.text C:\WINDOWS\Explorer.EXE[696] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 022A0FCA
.text C:\WINDOWS\Explorer.EXE[696] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 022A00AE
.text C:\WINDOWS\Explorer.EXE[696] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 022A009D
.text C:\WINDOWS\Explorer.EXE[696] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 022A00D0
.text C:\WINDOWS\Explorer.EXE[696] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 022A00BF
.text C:\WINDOWS\Explorer.EXE[696] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 022A00EB
.text C:\WINDOWS\Explorer.EXE[696] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 022A0FAF
.text C:\WINDOWS\Explorer.EXE[696] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 022A0011
.text C:\WINDOWS\Explorer.EXE[696] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 022A0F72
.text C:\WINDOWS\Explorer.EXE[696] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 022A0FE5
.text C:\WINDOWS\Explorer.EXE[696] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 022A002C
.text C:\WINDOWS\Explorer.EXE[696] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 022A0F4B
.text C:\WINDOWS\Explorer.EXE[696] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 02290047
.text C:\WINDOWS\Explorer.EXE[696] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 02290FAF
.text C:\WINDOWS\Explorer.EXE[696] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 02290036
.text C:\WINDOWS\Explorer.EXE[696] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0229001B
.text C:\WINDOWS\Explorer.EXE[696] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 02290FC0
.text C:\WINDOWS\Explorer.EXE[696] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 02290000
.text C:\WINDOWS\Explorer.EXE[696] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 02290062
.text C:\WINDOWS\Explorer.EXE[696] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 02290FDB
.text C:\WINDOWS\Explorer.EXE[696] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 0228003B
.text C:\WINDOWS\Explorer.EXE[696] msvcrt.dll!system 77C293C7 5 Bytes JMP 02280FB0
.text C:\WINDOWS\Explorer.EXE[696] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 02280FD2
.text C:\WINDOWS\Explorer.EXE[696] msvcrt.dll!_open 77C2F566 5 Bytes JMP 02280FEF
.text C:\WINDOWS\Explorer.EXE[696] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 02280FC1
.text C:\WINDOWS\Explorer.EXE[696] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0228000C
.text C:\WINDOWS\Explorer.EXE[696] WININET.dll!InternetOpenW 771BAF49 5 Bytes JMP 02270000
.text C:\WINDOWS\Explorer.EXE[696] WININET.dll!InternetOpenA 771C5796 5 Bytes JMP 02270FEF
.text C:\WINDOWS\Explorer.EXE[696] WININET.dll!InternetOpenUrlA 771C5A62 5 Bytes JMP 02270011
.text C:\WINDOWS\Explorer.EXE[696] WININET.dll!InternetOpenUrlW 771D5BB2 5 Bytes JMP 02270FCA
.text C:\WINDOWS\Explorer.EXE[696] WS2_32.dll!socket 71AB4211 5 Bytes JMP 02260FEF
.text C:\WINDOWS\system32\services.exe[772] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00070FE5
.text C:\WINDOWS\system32\services.exe[772] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00070062
.text C:\WINDOWS\system32\services.exe[772] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00070F63
.text C:\WINDOWS\system32\services.exe[772] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00070047
.text C:\WINDOWS\system32\services.exe[772] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00070F94
.text C:\WINDOWS\system32\services.exe[772] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00070025
.text C:\WINDOWS\system32\services.exe[772] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00070F37
.text C:\WINDOWS\system32\services.exe[772] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 0007007F
.text C:\WINDOWS\system32\services.exe[772] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 0007009A
.text C:\WINDOWS\system32\services.exe[772] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00070F0B
.text C:\WINDOWS\system32\services.exe[772] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00070EF0
.text C:\WINDOWS\system32\services.exe[772] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00070036
.text C:\WINDOWS\system32\services.exe[772] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00070000
.text C:\WINDOWS\system32\services.exe[772] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00070F52
.text C:\WINDOWS\system32\services.exe[772] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00070FB9
.text C:\WINDOWS\system32\services.exe[772] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00070FCA
.text C:\WINDOWS\system32\services.exe[772] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00070F1C
.text C:\WINDOWS\system32\services.exe[772] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00060FD4
.text C:\WINDOWS\system32\services.exe[772] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 0006006C
.text C:\WINDOWS\system32\services.exe[772] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00060FE5
.text C:\WINDOWS\system32\services.exe[772] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0006001B
.text C:\WINDOWS\system32\services.exe[772] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00060FA5
.text C:\WINDOWS\system32\services.exe[772] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00060000
.text C:\WINDOWS\system32\services.exe[772] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00060051
.text C:\WINDOWS\system32\services.exe[772] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00060040
.text C:\WINDOWS\system32\services.exe[772] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 0005004B
.text C:\WINDOWS\system32\services.exe[772] msvcrt.dll!system 77C293C7 5 Bytes JMP 00050FCA
.text C:\WINDOWS\system32\services.exe[772] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00050FE5
.text C:\WINDOWS\system32\services.exe[772] msvcrt.dll!_open 77C2F566 5 Bytes JMP 0005000C
.text C:\WINDOWS\system32\services.exe[772] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 0005003A
.text C:\WINDOWS\system32\services.exe[772] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0005001D
.text C:\WINDOWS\system32\services.exe[772] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00040000
.text C:\WINDOWS\system32\lsass.exe[784] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00F80FEF
.text C:\WINDOWS\system32\lsass.exe[784] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00F8005E
.text C:\WINDOWS\system32\lsass.exe[784] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00F80F5F
.text C:\WINDOWS\system32\lsass.exe[784] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00F80F7C
.text C:\WINDOWS\system32\lsass.exe[784] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00F80F8D
.text C:\WINDOWS\system32\lsass.exe[784] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00F80FBC
.text C:\WINDOWS\system32\lsass.exe[784] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00F80096
.text C:\WINDOWS\system32\lsass.exe[784] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00F80F4E
.text C:\WINDOWS\system32\lsass.exe[784] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00F80F1F
.text C:\WINDOWS\system32\lsass.exe[784] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00F800B8
.text C:\WINDOWS\system32\lsass.exe[784] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00F80F0E
.text C:\WINDOWS\system32\lsass.exe[784] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00F80039
.text C:\WINDOWS\system32\lsass.exe[784] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00F8000A
.text C:\WINDOWS\system32\lsass.exe[784] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00F80079
.text C:\WINDOWS\system32\lsass.exe[784] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00F80FCD
.text C:\WINDOWS\system32\lsass.exe[784] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00F80FDE
.text C:\WINDOWS\system32\lsass.exe[784] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00F800A7
.text C:\WINDOWS\system32\lsass.exe[784] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00F70036
.text C:\WINDOWS\system32\lsass.exe[784] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00F7006C
.text C:\WINDOWS\system32\lsass.exe[784] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00F70025
.text C:\WINDOWS\system32\lsass.exe[784] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00F7000A
.text C:\WINDOWS\system32\lsass.exe[784] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00F70051
.text C:\WINDOWS\system32\lsass.exe[784] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00F70FEF
.text C:\WINDOWS\system32\lsass.exe[784] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00F70FB9
.text C:\WINDOWS\system32\lsass.exe[784] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [17, 89]
.text C:\WINDOWS\system32\lsass.exe[784] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00F70FCA
.text C:\WINDOWS\system32\lsass.exe[784] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00F60073
.text C:\WINDOWS\system32\lsass.exe[784] msvcrt.dll!system 77C293C7 5 Bytes JMP 00F6004E
.text C:\WINDOWS\system32\lsass.exe[784] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00F60022
.text C:\WINDOWS\system32\lsass.exe[784] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00F60000
.text C:\WINDOWS\system32\lsass.exe[784] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00F6003D
.text C:\WINDOWS\system32\lsass.exe[784] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00F60011
.text C:\WINDOWS\system32\lsass.exe[784] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00F50FE5
.text C:\WINDOWS\system32\svchost.exe[940] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00F90000
.text C:\WINDOWS\system32\svchost.exe[940] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00F90F7E
.text C:\WINDOWS\system32\svchost.exe[940] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00F90F99
.text C:\WINDOWS\system32\svchost.exe[940] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00F9007D
.text C:\WINDOWS\system32\svchost.exe[940] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00F90FC0
.text C:\WINDOWS\system32\svchost.exe[940] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00F90051
.text C:\WINDOWS\system32\svchost.exe[940] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00F90F35
.text C:\WINDOWS\system32\svchost.exe[940] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00F90F50
.text C:\WINDOWS\system32\svchost.exe[940] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00F900BD
.text C:\WINDOWS\system32\svchost.exe[940] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00F900AC
.text C:\WINDOWS\system32\svchost.exe[940] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00F900E2
.text C:\WINDOWS\system32\svchost.exe[940] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00F9006C
.text C:\WINDOWS\system32\svchost.exe[940] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00F90FE5
.text C:\WINDOWS\system32\svchost.exe[940] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00F90F6D
.text C:\WINDOWS\system32\svchost.exe[940] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00F90040
.text C:\WINDOWS\system32\svchost.exe[940] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00F9001B
.text C:\WINDOWS\system32\svchost.exe[940] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00F90F24
.text C:\WINDOWS\system32\svchost.exe[940] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00F80FB9
.text C:\WINDOWS\system32\svchost.exe[940] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00F80036
.text C:\WINDOWS\system32\svchost.exe[940] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00F80FD4
.text C:\WINDOWS\system32\svchost.exe[940] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00F8000A
.text C:\WINDOWS\system32\svchost.exe[940] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00F80025
.text C:\WINDOWS\system32\svchost.exe[940] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00F80FEF
.text C:\WINDOWS\system32\svchost.exe[940] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00F80F8D
.text C:\WINDOWS\system32\svchost.exe[940] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [18, 89]
.text C:\WINDOWS\system32\svchost.exe[940] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00F80F9E
.text C:\WINDOWS\system32\svchost.exe[940] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00F70038
.text C:\WINDOWS\system32\svchost.exe[940] msvcrt.dll!system 77C293C7 5 Bytes JMP 00F70027
.text C:\WINDOWS\system32\svchost.exe[940] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00F70FC8
.text C:\WINDOWS\system32\svchost.exe[940] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00F70FEF
.text C:\WINDOWS\system32\svchost.exe[940] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00F70FB7
.text C:\WINDOWS\system32\svchost.exe[940] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00F7000C
.text C:\WINDOWS\system32\svchost.exe[940] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00F60000
.text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00CB0FEF
.text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00CB0F4B
.text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00CB0F66
.text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00CB0F81
.text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00CB0FA8
.text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00CB0040
.text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00CB007D
.text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00CB006C
.text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00CB0F10
.text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00CB00A9
.text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00CB0EF5
.text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00CB0FB9
.text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00CB0FDE
.text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00CB005B
.text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00CB0025
.text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00CB000A
.text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00CB0098
.text C:\WINDOWS\system32\svchost.exe[1012] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00CA0025
.text C:\WINDOWS\system32\svchost.exe[1012] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00CA0076
.text C:\WINDOWS\system32\svchost.exe[1012] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00CA0FD4
.text C:\WINDOWS\system32\svchost.exe[1012] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00CA000A
.text C:\WINDOWS\system32\svchost.exe[1012] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00CA0FB9
.text C:\WINDOWS\system32\svchost.exe[1012] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00CA0FEF
.text C:\WINDOWS\system32\svchost.exe[1012] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00CA0051
.text C:\WINDOWS\system32\svchost.exe[1012] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00CA0040
.text C:\WINDOWS\system32\svchost.exe[1012] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00C90038
.text C:\WINDOWS\system32\svchost.exe[1012] msvcrt.dll!system 77C293C7 5 Bytes JMP 00C90027
.text C:\WINDOWS\system32\svchost.exe[1012] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00C90FD2
.text C:\WINDOWS\system32\svchost.exe[1012] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00C90000
.text C:\WINDOWS\system32\svchost.exe[1012] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00C90FAD
.text C:\WINDOWS\system32\svchost.exe[1012] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00C90FE3
.text C:\WINDOWS\system32\svchost.exe[1012] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00C80FEF
.text C:\WINDOWS\System32\svchost.exe[1052] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 03B60000
.text C:\WINDOWS\System32\svchost.exe[1052] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 03B60F66
.text C:\WINDOWS\System32\svchost.exe[1052] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 03B60051
.text C:\WINDOWS\System32\svchost.exe[1052] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 03B60F83
.text C:\WINDOWS\System32\svchost.exe[1052] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 03B60040
.text C:\WINDOWS\System32\svchost.exe[1052] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 03B6001B
.text C:\WINDOWS\System32\svchost.exe[1052] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 03B60F24
.text C:\WINDOWS\System32\svchost.exe[1052] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 03B6006C
.text C:\WINDOWS\System32\svchost.exe[1052] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 03B60098
.text C:\WINDOWS\System32\svchost.exe[1052] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 03B60087
.text C:\WINDOWS\System32\svchost.exe[1052] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 03B60EDA
.text C:\WINDOWS\System32\svchost.exe[1052] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 03B60F9E
.text C:\WINDOWS\System32\svchost.exe[1052] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 03B60FE5
.text C:\WINDOWS\System32\svchost.exe[1052] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 03B60F4B
.text C:\WINDOWS\System32\svchost.exe[1052] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 03B60FB9
.text C:\WINDOWS\System32\svchost.exe[1052] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 03B60FCA
.text C:\WINDOWS\System32\svchost.exe[1052] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 03B60F09
.text C:\WINDOWS\System32\svchost.exe[1052] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 03B5002C
.text C:\WINDOWS\System32\svchost.exe[1052] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 03B50062
.text C:\WINDOWS\System32\svchost.exe[1052] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 03B50FE5
.text C:\WINDOWS\System32\svchost.exe[1052] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 03B5001B
.text C:\WINDOWS\System32\svchost.exe[1052] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 03B50FAF
.text C:\WINDOWS\System32\svchost.exe[1052] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 03B50000
.text C:\WINDOWS\System32\svchost.exe[1052] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 03B50FC0
.text C:\WINDOWS\System32\svchost.exe[1052] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [D5, 8B] {AAD 0x8b}
.text C:\WINDOWS\System32\svchost.exe[1052] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 03B50047
.text C:\WINDOWS\System32\svchost.exe[1052] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 03B40FC8
.text C:\WINDOWS\System32\svchost.exe[1052] msvcrt.dll!system 77C293C7 5 Bytes JMP 03B40049
.text C:\WINDOWS\System32\svchost.exe[1052] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 03B40FE3
.text C:\WINDOWS\System32\svchost.exe[1052] msvcrt.dll!_open 77C2F566 5 Bytes JMP 03B40000
.text C:\WINDOWS\System32\svchost.exe[1052] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 03B40038
.text C:\WINDOWS\System32\svchost.exe[1052] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 03B4001D
.text C:\WINDOWS\System32\svchost.exe[1052] WS2_32.dll!socket 71AB4211 5 Bytes JMP 03B20FEF
.text C:\WINDOWS\System32\svchost.exe[1052] WININET.dll!InternetOpenW 771BAF49 5 Bytes JMP 03B3001B
.text C:\WINDOWS\System32\svchost.exe[1052] WININET.dll!InternetOpenA 771C5796 5 Bytes JMP 03B3000A
.text C:\WINDOWS\System32\svchost.exe[1052] WININET.dll!InternetOpenUrlA 771C5A62 5 Bytes JMP 03B30FE5
.text C:\WINDOWS\System32\svchost.exe[1052] WININET.dll!InternetOpenUrlW 771D5BB2 5 Bytes JMP 03B30038
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 007B0FE5
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 007B0093
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 007B0078
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 007B005B
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 007B0F9E
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 007B0040
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 007B0F55
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 007B0F66
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 007B0F18
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 007B0F29
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 007B00CC
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 007B0FAF
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 007B000A
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 007B0F83
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 007B0025
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 007B0FD4
.text C:\WINDOWS\system32\svchost.exe[1184] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 007B0F3A
.text C:\WINDOWS\system32\svchost.exe[1184] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 007A0FC3
.text C:\WINDOWS\system32\svchost.exe[1184] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 007A0039
.text C:\WINDOWS\system32\svchost.exe[1184] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 007A0FDE
.text C:\WINDOWS\system32\svchost.exe[1184] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 007A0FEF
.text C:\WINDOWS\system32\svchost.exe[1184] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 007A0F7C
.text C:\WINDOWS\system32\svchost.exe[1184] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 007A0000
.text C:\WINDOWS\system32\svchost.exe[1184] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 007A0FA1
.text C:\WINDOWS\system32\svchost.exe[1184] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [9A, 88]
.text C:\WINDOWS\system32\svchost.exe[1184] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 007A0FB2
.text C:\WINDOWS\system32\svchost.exe[1184] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00790FB0
.text C:\WINDOWS\system32\svchost.exe[1184] msvcrt.dll!system 77C293C7 5 Bytes JMP 00790FC1
.text C:\WINDOWS\system32\svchost.exe[1184] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00790FE3
.text C:\WINDOWS\system32\svchost.exe[1184] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00790000
.text C:\WINDOWS\system32\svchost.exe[1184] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00790FD2
.text C:\WINDOWS\system32\svchost.exe[1184] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0079001D
.text C:\WINDOWS\system32\svchost.exe[1184] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00780FEF
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C10FEF
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C10F83
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C10F94
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C10FA5
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C10062
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C1002C
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C10F30
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C10F57
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C10F1F
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C100B8
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00C100C9
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00C1003D
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C10000
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00C10F68
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00C1001B
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00C10FCA
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00C10093
.text C:\WINDOWS\system32\svchost.exe[1264] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00C00FDE
.text C:\WINDOWS\system32\svchost.exe[1264] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00C00F8D
.text C:\WINDOWS\system32\svchost.exe[1264] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00C00FEF
.text C:\WINDOWS\system32\svchost.exe[1264] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00C0001B
.text C:\WINDOWS\system32\svchost.exe[1264] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00C00FA8
.text C:\WINDOWS\system32\svchost.exe[1264] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00C00000
.text C:\WINDOWS\system32\svchost.exe[1264] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00C0004A
.text C:\WINDOWS\system32\svchost.exe[1264] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00C00FCD
.text C:\WINDOWS\system32\svchost.exe[1264] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00BF0055
.text C:\WINDOWS\system32\svchost.exe[1264] msvcrt.dll!system 77C293C7 5 Bytes JMP 00BF0044
.text C:\WINDOWS\system32\svchost.exe[1264] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00BF0FDE
.text C:\WINDOWS\system32\svchost.exe[1264] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00BF000C
.text C:\WINDOWS\system32\svchost.exe[1264] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00BF0033
.text C:\WINDOWS\system32\svchost.exe[1264] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00BF0FEF
.text C:\WINDOWS\system32\svchost.exe[1264] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BE0FEF
.text C:\WINDOWS\system32\svchost.exe[1512] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00A80FEF
.text C:\WINDOWS\system32\svchost.exe[1512] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00A80F41
.text C:\WINDOWS\system32\svchost.exe[1512] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00A80036
.text C:\WINDOWS\system32\svchost.exe[1512] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00A80F5C
.text C:\WINDOWS\system32\svchost.exe[1512] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00A80F79
.text C:\WINDOWS\system32\svchost.exe[1512] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00A80F8A
.text C:\WINDOWS\system32\svchost.exe[1512] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00A80F0B
.text C:\WINDOWS\system32\svchost.exe[1512] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00A8005D
.text C:\WINDOWS\system32\svchost.exe[1512] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00A8009A
.text C:\WINDOWS\system32\svchost.exe[1512] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00A80089
.text C:\WINDOWS\system32\svchost.exe[1512] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00A80EE6
.text C:\WINDOWS\system32\svchost.exe[1512] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00A80011
.text C:\WINDOWS\system32\svchost.exe[1512] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00A80000
.text C:\WINDOWS\system32\svchost.exe[1512] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00A80F26
.text C:\WINDOWS\system32\svchost.exe[1512] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00A80FA5
.text C:\WINDOWS\system32\svchost.exe[1512] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00A80FC0
.text C:\WINDOWS\system32\svchost.exe[1512] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00A8006E
.text C:\WINDOWS\system32\svchost.exe[1512] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00930025
.text C:\WINDOWS\system32\svchost.exe[1512] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 0093006C
.text C:\WINDOWS\system32\svchost.exe[1512] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00930FD4
.text C:\WINDOWS\system32\svchost.exe[1512] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0093000A
.text C:\WINDOWS\system32\svchost.exe[1512] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00930051
.text C:\WINDOWS\system32\svchost.exe[1512] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00930FEF
.text C:\WINDOWS\system32\svchost.exe[1512] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00930FA5
.text C:\WINDOWS\system32\svchost.exe[1512] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [B3, 88] {MOV BL, 0x88}
.text C:\WINDOWS\system32\svchost.exe[1512] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00930036
.text C:\WINDOWS\system32\svchost.exe[1512] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00920FC6
.text C:\WINDOWS\system32\svchost.exe[1512] msvcrt.dll!system 77C293C7 5 Bytes JMP 00920047
.text C:\WINDOWS\system32\svchost.exe[1512] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00920011
.text C:\WINDOWS\system32\svchost.exe[1512] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00920FE3
.text C:\WINDOWS\system32\svchost.exe[1512] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 0092002C
.text C:\WINDOWS\system32\svchost.exe[1512] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00920000
.text C:\WINDOWS\system32\svchost.exe[1512] WININET.dll!InternetOpenW 771BAF49 5 Bytes JMP 00910FDB
.text C:\WINDOWS\system32\svchost.exe[1512] WININET.dll!InternetOpenA 771C5796 5 Bytes JMP 00910000
.text C:\WINDOWS\system32\svchost.exe[1512] WININET.dll!InternetOpenUrlA 771C5A62 5 Bytes JMP 00910011
.text C:\WINDOWS\system32\svchost.exe[1512] WININET.dll!InternetOpenUrlW 771D5BB2 5 Bytes JMP 00910FCA
.text C:\WINDOWS\system32\svchost.exe[1512] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00900FEF
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1716] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0041C340 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1716] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 0041C3C0 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\WINDOWS\system32\wuauclt.exe[4024] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 001B0FEF
.text C:\WINDOWS\system32\wuauclt.exe[4024] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001B0F83
.text C:\WINDOWS\system32\wuauclt.exe[4024] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 001B0F94
.text C:\WINDOWS\system32\wuauclt.exe[4024] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 001B0062
.text C:\WINDOWS\system32\wuauclt.exe[4024] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 001B0FA5
.text C:\WINDOWS\system32\wuauclt.exe[4024] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 001B0036
.text C:\WINDOWS\system32\wuauclt.exe[4024] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 001B00D5
.text C:\WINDOWS\system32\wuauclt.exe[4024] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 001B00BA
.text C:\WINDOWS\system32\wuauclt.exe[4024] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001B00F0
.text C:\WINDOWS\system32\wuauclt.exe[4024] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 001B0F61
.text C:\WINDOWS\system32\wuauclt.exe[4024] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 001B0F3C
.text C:\WINDOWS\system32\wuauclt.exe[4024] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 001B0047
.text C:\WINDOWS\system32\wuauclt.exe[4024] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 001B000A
.text C:\WINDOWS\system32\wuauclt.exe[4024] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 001B0093
.text C:\WINDOWS\system32\wuauclt.exe[4024] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 001B0FD4
.text C:\WINDOWS\system32\wuauclt.exe[4024] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 001B001B
.text C:\WINDOWS\system32\wuauclt.exe[4024] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 001B0F72
.text C:\WINDOWS\system32\wuauclt.exe[4024] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 002A004C
.text C:\WINDOWS\system32\wuauclt.exe[4024] msvcrt.dll!system 77C293C7 5 Bytes JMP 002A0FB7
.text C:\WINDOWS\system32\wuauclt.exe[4024] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 002A0027
.text C:\WINDOWS\system32\wuauclt.exe[4024] msvcrt.dll!_open 77C2F566 5 Bytes JMP 002A0FEF
.text C:\WINDOWS\system32\wuauclt.exe[4024] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 002A0FC8
.text C:\WINDOWS\system32\wuauclt.exe[4024] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 002A000C
.text C:\WINDOWS\system32\wuauclt.exe[4024] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 002B0025
.text C:\WINDOWS\system32\wuauclt.exe[4024] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 002B007D
.text C:\WINDOWS\system32\wuauclt.exe[4024] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 002B0FD4
.text C:\WINDOWS\system32\wuauclt.exe[4024] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 002B0FE5
.text C:\WINDOWS\system32\wuauclt.exe[4024] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 002B0062
.text C:\WINDOWS\system32\wuauclt.exe[4024] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 002B0000
.text C:\WINDOWS\system32\wuauclt.exe[4024] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 002B0047
.text C:\WINDOWS\system32\wuauclt.exe[4024] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 002B0036

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

—- EOF - GMER 1.0.15 —-

Thanks Eric

Attachments:

📎Attach.txt

Conspire

Post #2February 6, 2010, 4:48 PM UTC last edited February 6, 2010, 4:48 PM UTC

Hello there, Eric Sullivan

I'm Conspire, I'll be glad to help you with your computer problems.

Please observe these rules while we work:

Read the entire procedure
It is important to perform ALL actions in sequence.
If you don't know, stop and ask! Don't keep going on.
Please reply to this thread. Do not start a new topic.
Stick with me till you're given the all clear.
Remember, absence of symptoms does not mean the infection is all gone.
Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

Please bear with me, I will post back to you as soon as I can.

IMPORTANT NOTE : Please do not delete anything unless instructed to.

Deleted Member

Post #3February 6, 2010, 5:42 PM UTC

Thanks Conspire.

Conspire

Post #4February 7, 2010, 2:32 AM UTC

Hello there,

***Read through this entire procedure and if you have any questions, please ask them before you begin. Then either print out, or copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

===================================================

On your next reply please post :
Combofix log

Good Day!

Deleted Member

Post #5February 7, 2010, 7:28 PM UTC

Hi, This is my second Combofix Scan, I hadn't fully disabled McAffee the first time so I reran it after correcting that. Sorry. If you need to see the first scan I have kept a copy.

Cheers,
Eric

ComboFix 10-02-07.01 - gewn morgan 07/02/2010 19:10:06.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.527 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((( Files Created from 2010-01-07 to 2010-02-07 )))))))))))))))))))))))))))))))
.

2010-02-03 20:38 . 2010-02-03 20:38 ——– d—–w- c:\windows\system32\XPSViewer
2010-02-03 20:38 . 2010-02-03 20:38 ——– d—–w- c:\program files\MSBuild
2010-02-03 20:38 . 2010-02-03 20:38 ——– d—–w- c:\program files\Reference Assemblies
2010-02-03 20:38 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-02-03 20:38 . 2008-07-06 12:06 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-02-03 20:38 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2010-02-03 20:38 . 2008-07-06 10:50 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-02-03 20:38 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-02-03 20:38 . 2008-07-06 12:06 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-02-03 20:38 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2010-02-03 20:38 . 2008-07-06 12:06 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2010-02-03 20:38 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2010-02-02 22:27 . 2010-02-02 22:27 0 —-a-w- c:\windows\nsreg.dat
2010-02-02 22:27 . 2010-02-02 22:27 ——– d—–w- c:\documents and settings\gewn morgan\Application Data\Thunderbird
2010-02-02 22:27 . 2010-02-02 22:27 ——– d—–w- c:\documents and settings\gewn morgan\Local Settings\Application Data\Thunderbird
2010-02-02 22:26 . 2010-02-06 17:29 ——– d—–w- c:\program files\Mozilla Thunderbird
2010-02-02 20:57 . 2008-10-24 11:21 455296 -c—-w- c:\windows\system32\dllcache\mrxsmb.sys
2010-02-02 20:56 . 2008-06-13 11:05 272128 -c—-w- c:\windows\system32\dllcache\bthport.sys
2010-02-02 20:56 . 2008-06-13 11:05 272128 ——w- c:\windows\system32\drivers\bthport.sys
2010-02-02 20:53 . 2009-08-04 15:13 2145280 -c—-w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-02-02 20:53 . 2009-08-04 14:20 2023936 -c—-w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-02-02 20:53 . 2009-08-04 14:20 2066048 -c—-w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-02-02 20:53 . 2008-05-03 11:55 2560 ——w- c:\windows\system32\xpsp4res.dll
2010-02-01 23:39 . 2007-11-30 11:18 26488 —-a-w- c:\windows\system32\spupdsvc.exe
2010-02-01 21:38 . 2010-02-01 21:38 ——– d—–w- c:\documents and settings\gewn morgan\Application Data\Malwarebytes
2010-02-01 21:38 . 2010-01-07 16:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-01 21:38 . 2010-02-01 21:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-01 21:38 . 2010-02-01 21:38 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-01 21:38 . 2010-01-07 16:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-02-01 21:24 . 2010-02-01 21:25 ——– d—–w- c:\program files\ERUNT
2010-02-01 20:22 . 2010-02-01 20:22 ——– d—–w- c:\program files\Trend Micro
2010-02-01 19:26 . 2010-02-01 19:26 ——– d-s—w- c:\documents and settings\gewn morgan\UserData

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-07 12:01 . 2009-04-02 01:49 76487 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-02-03 20:58 . 2009-07-24 01:09 68456 —-a-w- c:\documents and settings\gewn morgan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-01 19:30 . 2009-04-02 02:03 ——– d—–w- c:\program files\McAfee
2009-12-22 05:21 . 2009-04-02 00:30 667136 ——w- c:\windows\system32\wininet.dll
2009-12-22 05:20 . 2009-04-02 00:30 81920 —-a-w- c:\windows\system32\ieencode.dll
2009-11-21 15:51 . 2009-04-02 00:30 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0\bin\jusched.exe" [2009-04-02 36972]
"RTHDCPL"="RTHDCPL.EXE" [2008-08-26 16851456]
"EDS"="c:\program files\Samsung\Samsung EDS\EDSAgent.exe" [2007-12-21 659456]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-28 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-28 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-28 137752]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-28 1044480]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"DMHotKey"="c:\program files\Samsung\Easy Display Manager\DMLoader.exe" [2006-12-27 466944]
"BatteryManager"="c:\program files\Samsung\Samsung Battery Manager\BatteryManager.exe" [2008-10-20 2768896]
"MagicKeyboard"="c:\program files\SAMSUNG\MagicKBD\PreMKBD.exe" [2006-05-15 151552]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-08-04 582992]
"MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2008-11-04 2087424]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

R2 DOSMEMIO;MEMIO;c:\windows\system32\MEMIO.SYS [02/04/2009 01:54 4300]
R2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [04/11/2008 03:39 14336]
R3 DNSeFilter;DNSeFilter;c:\windows\system32\drivers\SamsungEDS.SYS [15/01/2008 03:01 30208]
R3 hspabus;SAMSUNG HSPA USB Composite Device driver (WDM);c:\windows\system32\drivers\hspabus.sys [21/05/2009 13:14 91776]
R3 hspamdfl;SAMSUNG HSPA Modem Filter;c:\windows\system32\drivers\hspamdfl.sys [21/05/2009 13:14 14976]
R3 hspamdm;SAMSUNG HSPA Modem Drivers;c:\windows\system32\drivers\hspamdm.sys [21/05/2009 13:14 119808]
R3 hspaserd;SAMSUNG HSPA Modem Diagnostic Serial Port (WDM);c:\windows\system32\drivers\hspaserd.sys [21/05/2009 13:14 98560]
R3 VMC326;Vimicro Camera Service VMC326;c:\windows\system32\drivers\VMC326.sys [02/04/2009 01:58 238464]
S2 0025851265052709mcinstcleanup;McAfee Application Installer Cleanup (0025851265052709);c:\windows\TEMP\002585~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service –> c:\windows\TEMP\002585~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32mpcoinst,serviceStartProc –> RUNDLL32.EXE ykx32mpcoinst,serviceStartProc [?]
.
Contents of the 'Scheduled Tasks' folder

2009-04-02 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-04-02 13:32]

2009-04-02 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-04-02 13:32]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-07 19:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(728)
c:\windows\system32\igfxdev.dll

- - - - - - - > 'explorer.exe'(3468)
c:\windows\system32\xpsp3res.dll
.
Completion time: 2010-02-07 19:15:24
ComboFix-quarantined-files.txt 2010-02-07 19:15
ComboFix2.txt 2010-02-07 18:29

Pre-Run: 66,667,925,504 bytes free
Post-Run: 66,660,708,352 bytes free

- - End Of File - - 1098867C08554ECBC0920490BAF3F7EA

Conspire

Post #6February 8, 2010, 3:03 PM UTC

Please post the first log from ComboFix for me to review. Thanks

Deleted Member

Post #7February 8, 2010, 8:07 PM UTC

Here is the first scan
ComboFix 10-02-07.01 - gewn morgan 07/02/2010 18:21:45.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.557 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: McAfee VirusScan *On-access scanning enabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-746137067-706699826-1644491937-1003
c:\windows\msetup
c:\windows\msetup\MSetup.exe
c:\windows\system32\ToolBx.dll

.
((((((((((((((((((((((((( Files Created from 2010-01-07 to 2010-02-07 )))))))))))))))))))))))))))))))
.

2010-02-03 20:38 . 2010-02-03 20:38 ——– d—–w- c:\windows\system32\XPSViewer
2010-02-03 20:38 . 2010-02-03 20:38 ——– d—–w- c:\program files\MSBuild
2010-02-03 20:38 . 2010-02-03 20:38 ——– d—–w- c:\program files\Reference Assemblies
2010-02-03 20:38 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-02-03 20:38 . 2008-07-06 12:06 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-02-03 20:38 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2010-02-03 20:38 . 2008-07-06 10:50 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-02-03 20:38 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-02-03 20:38 . 2008-07-06 12:06 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-02-03 20:38 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2010-02-03 20:38 . 2008-07-06 12:06 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2010-02-03 20:38 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2010-02-02 22:27 . 2010-02-02 22:27 0 —-a-w- c:\windows\nsreg.dat
2010-02-02 22:27 . 2010-02-02 22:27 ——– d—–w- c:\documents and settings\gewn morgan\Application Data\Thunderbird
2010-02-02 22:27 . 2010-02-02 22:27 ——– d—–w- c:\documents and settings\gewn morgan\Local Settings\Application Data\Thunderbird
2010-02-02 22:26 . 2010-02-06 17:29 ——– d—–w- c:\program files\Mozilla Thunderbird
2010-02-02 20:57 . 2008-10-24 11:21 455296 -c—-w- c:\windows\system32\dllcache\mrxsmb.sys
2010-02-02 20:56 . 2008-06-13 11:05 272128 -c—-w- c:\windows\system32\dllcache\bthport.sys
2010-02-02 20:56 . 2008-06-13 11:05 272128 ——w- c:\windows\system32\drivers\bthport.sys
2010-02-02 20:53 . 2009-08-04 15:13 2145280 -c—-w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-02-02 20:53 . 2009-08-04 14:20 2023936 -c—-w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-02-02 20:53 . 2009-08-04 14:20 2066048 -c—-w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-02-02 20:53 . 2008-05-03 11:55 2560 ——w- c:\windows\system32\xpsp4res.dll
2010-02-01 23:39 . 2007-11-30 11:18 26488 —-a-w- c:\windows\system32\spupdsvc.exe
2010-02-01 21:38 . 2010-02-01 21:38 ——– d—–w- c:\documents and settings\gewn morgan\Application Data\Malwarebytes
2010-02-01 21:38 . 2010-01-07 16:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-01 21:38 . 2010-02-01 21:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-01 21:38 . 2010-02-01 21:38 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-01 21:38 . 2010-01-07 16:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-02-01 21:24 . 2010-02-01 21:25 ——– d—–w- c:\program files\ERUNT
2010-02-01 20:22 . 2010-02-01 20:22 ——– d—–w- c:\program files\Trend Micro
2010-02-01 19:26 . 2010-02-01 19:26 ——– d-s—w- c:\documents and settings\gewn morgan\UserData

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-07 12:01 . 2009-04-02 01:49 76487 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-02-03 20:58 . 2009-07-24 01:09 68456 —-a-w- c:\documents and settings\gewn morgan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-01 19:30 . 2009-04-02 02:03 ——– d—–w- c:\program files\McAfee
2009-12-22 05:21 . 2009-04-02 00:30 667136 —-a-w- c:\windows\system32\wininet.dll
2009-12-22 05:20 . 2009-04-02 00:30 81920 —-a-w- c:\windows\system32\ieencode.dll
2009-11-21 15:51 . 2009-04-02 00:30 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0\bin\jusched.exe" [2009-04-02 36972]
"RTHDCPL"="RTHDCPL.EXE" [2008-08-26 16851456]
"EDS"="c:\program files\Samsung\Samsung EDS\EDSAgent.exe" [2007-12-21 659456]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-28 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-28 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-28 137752]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-28 1044480]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"DMHotKey"="c:\program files\Samsung\Easy Display Manager\DMLoader.exe" [2006-12-27 466944]
"BatteryManager"="c:\program files\Samsung\Samsung Battery Manager\BatteryManager.exe" [2008-10-20 2768896]
"MagicKeyboard"="c:\program files\SAMSUNG\MagicKBD\PreMKBD.exe" [2006-05-15 151552]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-08-04 582992]
"MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2008-11-04 2087424]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

R2 DOSMEMIO;MEMIO;c:\windows\system32\MEMIO.SYS [02/04/2009 01:54 4300]
R2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [04/11/2008 03:39 14336]
R3 DNSeFilter;DNSeFilter;c:\windows\system32\drivers\SamsungEDS.SYS [15/01/2008 03:01 30208]
R3 hspabus;SAMSUNG HSPA USB Composite Device driver (WDM);c:\windows\system32\drivers\hspabus.sys [21/05/2009 13:14 91776]
R3 hspamdfl;SAMSUNG HSPA Modem Filter;c:\windows\system32\drivers\hspamdfl.sys [21/05/2009 13:14 14976]
R3 hspamdm;SAMSUNG HSPA Modem Drivers;c:\windows\system32\drivers\hspamdm.sys [21/05/2009 13:14 119808]
R3 hspaserd;SAMSUNG HSPA Modem Diagnostic Serial Port (WDM);c:\windows\system32\drivers\hspaserd.sys [21/05/2009 13:14 98560]
R3 VMC326;Vimicro Camera Service VMC326;c:\windows\system32\drivers\VMC326.sys [02/04/2009 01:58 238464]
S2 0025851265052709mcinstcleanup;McAfee Application Installer Cleanup (0025851265052709);c:\windows\TEMP\002585~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service –> c:\windows\TEMP\002585~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32mpcoinst,serviceStartProc –> RUNDLL32.EXE ykx32mpcoinst,serviceStartProc [?]
.
Contents of the 'Scheduled Tasks' folder

2009-04-02 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-04-02 13:32]

2009-04-02 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-04-02 13:32]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod;=SMSN
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod;=SMSN
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-07 18:27
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(728)
c:\windows\system32\igfxdev.dll
.
Completion time: 2010-02-07 18:29:16
ComboFix-quarantined-files.txt 2010-02-07 18:29

Pre-Run: 66,460,569,600 bytes free
Post-Run: 66,658,013,184 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 50F8615C63D33ED1EE07D56E7C32FA40

There was a virus warning early on from McCaffee which alerted me that the auto scan was still enabled,

Cheers,
Eric

Conspire

Post #8February 9, 2010, 2:12 PM UTC

Hi,

Eset online scannner

You can use either Internet Explorer or Mozilla FireFox for this scan.

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Please go here then click on: [external image: Posted Image]

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:

- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
Now click on: [external image: Posted Image]
The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
Now click on: [external image: Posted Image]
Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste that log as a reply to this topic.

===================================================

On your next reply please post :
ESET log
Are you still being redirected and random crashes?

Good Day!

Deleted Member

Post #9February 11, 2010, 9:59 AM UTC

Hi Sorry for the delay. The first time I ran ESET it was taking ages so I left it overnight and at some point the computer restarted and there was no sign of ESET. I installed it last night and ran it in speed mode (FnF8 on Samsungs) and it completed the scan in about 90 minutes. There was no reference to a log file that I could find it just said no infections detected

. I haven't had any crashes or browser hijacks since completing the preparatory steps just prior to my first post.

Conspire

Post #10February 11, 2010, 2:10 PM UTC

Ok, no worries about the delay. Please try this.

Panda ActiveScan 2.0

Go to Panda Security website and click on Scan your PC now to perform an online scan.

A new windows will pop-up and click Scan now
Select Full scan (by default), and click Scan now, please be patient while the scanner is updating its file definitions.
Click on the Notepad icon under "Export to", then save the log in at your desktop with the name of "ActiveScan.txt"
Please post your result on the next reply.

Deleted Member

Post #11February 12, 2010, 10:22 PM UTC

I had a blue screen and crash when I tried to run the scan over night but managed it successfully 2nd time. ;******************************************************************************* ********************************************************************************* ******************* ANALYSIS: 2010-02-12 22:17:17 PROTECTIONS: 1 MALWARE: 16 SUSPECTS: 0 ;******************************************************************************* ********************************************************************************* ******************* PROTECTIONS Description Version Active Updated ;=============================================================================== ================================================================================= =================== McAfee VirusScan Yes Yes ;=============================================================================== ================================================================================= =================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;=============================================================================== ================================================================================= =================== 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No c:\documents and settings\gewn morgan\cookies\gewn morgan@casalemedia[2].txt 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No c:\documents and settings\gewn morgan\cookies\gewn morgan@doubleclick[1].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No c:\documents and settings\gewn morgan\cookies\gewn morgan@atdmt[1].txt 00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No c:\documents and settings\gewn morgan\cookies\gewn morgan@tradedoubler[1].txt 00145457 Cookie/FastClick TrackingCookie No 0 Yes No c:\documents and settings\gewn morgan\cookies\gewn morgan@fastclick[1].txt 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No c:\documents and settings\gewn morgan\cookies\gewn morgan@tribalfusion[2].txt 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No c:\documents and settings\gewn morgan\cookies\gewn morgan@mediaplex[2].txt 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No c:\documents and settings\gewn morgan\cookies\gewn [removed][1].txt 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No c:\documents and settings\gewn morgan\cookies\gewn morgan@apmebf[2].txt 00168076 Cookie/BurstNet TrackingCookie No 0 Yes No c:\documents and settings\gewn morgan\cookies\gewn morgan@burstnet[2].txt 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No c:\documents and settings\gewn morgan\cookies\gewn morgan@serving-sys[1].txt 00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No c:\documents and settings\gewn morgan\cookies\gewn [removed]-sys[2].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No c:\documents and settings\gewn morgan\cookies\gewn morgan@advertising[1].txt 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No c:\documents and settings\gewn morgan\cookies\gewn [removed][2].txt 00172221 Cookie/Zedo TrackingCookie No 0 Yes No c:\documents and settings\gewn morgan\cookies\gewn morgan@zedo[1].txt 05898765 Trj/Nabload.DPS Virus/Trojan No 0 No No c:\documents and settings\gewn morgan\desktop\combofix.exe[32788r22fwjfw\catchme.cfxxe] ;=============================================================================== ================================================================================= =================== SUSPECTS Sent Location ;=============================================================================== ================================================================================= =================== ;=============================================================================== ================================================================================= =================== VULNERABILITIES Id Severity Description ;=============================================================================== ================================================================================= =================== 215938 HIGH MS09-072 214071 HIGH MS09-054 212530 HIGH MS09-034 210618 HIGH MS09-019 208379 HIGH MS09-014 203806 HIGH MS08-078 203508 HIGH MS08-073 201250 HIGH MS08-058 209273 HIGH MS08-045 194861 HIGH MS08-031 ;=============================================================================== ================================================================================= ===================

LDTate

Post #12February 12, 2010, 10:28 PM UTC

Conspire is on holiday. Just cookies and the combofix program. How's it running?

Deleted Member

Post #13February 12, 2010, 11:30 PM UTC

apart from that one crash which might have been power related as I didn't realise the power lead had been unplugged it has been doing fine.

The screen has a habit of whiteing out now and again, but it was doing that before the problems started. Moving the screen on its hinges seems to bring the image back,but it could be coincidence. I have a new copy of Norton, do you think I should uninstall the Mcaffey Trial which is on 30daytrial and install it?

LDTate

Post #14February 12, 2010, 11:36 PM UTC

You could wait until the McAfee expires if you want.

LDTate

Post #15February 14, 2010, 7:38 PM UTC

Good job

The following will implement some cleanup procedures as well as reset System Restore points:

Click START then RUN
Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
- [external image: Posted Image]
If you used DeFogger
You must remember to re-enable your Emulation drivers once we are finished, double click DeFogger to run the tool.
- The application window will appear
- Click the Re-enable button to re-enable your CD Emulation drivers
- Click Yes to continue
- A 'Finished!' message will appear
- Click OK
- DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.

To be on the safe side, I would also change all my passwords.

Here's my usual all clean post

Log looks good
- Make your Internet Explorer more secure - This can be done by following these simple instructions:
  - From within Internet Explorer click on the Tools menu and then click on Options.
  - Click once on the Security tab
  - Click once on the Internet icon so it becomes highlighted.
  - Click once on the Custom Level button.
  - Change the Download signed ActiveX controls to Prompt
  - Change the Download unsigned ActiveX controls to Disable
  - Change the Initialize and script ActiveX controls not marked as safe to Disable
  - Change the Installation of desktop items to Prompt
  - Change the Launching programs and files in an IFRAME to Prompt
  - Change the Navigate sub-frames across different domains to Prompt
  - When all these settings have been made, click on the OK button.
  - If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Next press the Apply button and then the OK to exit the Internet Properties page.
Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
This will ensure your computer has always the latest security updates available installed on your computer.
If there are new updates to install, install them immediately, reboot your computer, and revisit the site
until there are no more critical updates.
Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.

I would suggest you read How to Prevent Malware:

[Resolved] Generic Host problem, browser hijacks, blue screens etc

✨ Ask AI

Ask AI