[Resolved] Nexplore popups & disabled Malwarebytes

xxjoliet Topic Starter

Post #1March 28, 2010, 4:30 PM UTC

My computer has recently become infected with some sort of spyware/malware. Popups from "Nexplore" appear in both Firefox & IE when I use them and also my Malwarebytes program has been disabled. Any ideas to help? Thank you very much!

Here is my latest HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:30:12 PM, on 3/28/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
C:\WINDOWS\system32\mfevtps.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TDispVol.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Toshiba\Tvs\TvsTray.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\WINDOWS\system32\dla\DLACTRLW.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\McAfee\Common Framework\udaterui.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe
C:\WINDOWS\system32\RAMASST.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\toshiba\ivp\ism\ivpsvmgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshibadirect.com/dpdstart
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptsn.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\DLACTRLW.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [faborolor] Rundll32.exe "c:\windows\system32\domilepo.dll",a
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-21-3829708469-1608534815-687403768-500\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Administrator')
O4 - HKUS\S-1-5-21-3829708469-1608534815-687403768-500\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Administrator')
O4 - HKUS\S-1-5-21-3829708469-1608534815-687403768-500\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe (User 'Administrator')
O4 - Global Startup: McAfee Security Scan.lnk = ?
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O15 - Trusted Zone: http://*.buy-internet-security10.com
O15 - Trusted Zone: http://*.is-soft-download.com
O15 - Trusted Zone: http://*.is-software-download.com
O15 - Trusted Zone: http://*.is-software-download25.com
O15 - Trusted Zone: http://*.buy-internet-security10.com (HKLM)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - AppInit_DLLs: pibuzilu.dll fahokipa.dll c:\windows\system32\domilepo.dll
O21 - SSODL: muhadoyin - {b5922613-ab15-4682-899b-669143863e6e} - c:\windows\system32\domilepo.dll
O22 - SharedTaskScheduler: kupuhivus - {b5922613-ab15-4682-899b-669143863e6e} - c:\windows\system32\domilepo.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: McAfee Engine Service (McAfeeEngineService) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

–
End of file - 11839 bytes

Essexboy

Post #2March 28, 2010, 7:18 PM UTC

Hi - please run Hijackthis and select the items listed beow then click check selected

O4 - HKLM\..\Run: [faborolor] Rundll32.exe "c:\windows\system32\domilepo.dll",a
O20 - AppInit_DLLs: pibuzilu.dll fahokipa.dll c:\windows\system32\domilepo.dll
O21 - SSODL: muhadoyin - {b5922613-ab15-4682-899b-669143863e6e} - c:\windows\system32\domilepo.dll
O22 - SharedTaskScheduler: kupuhivus - {b5922613-ab15-4682-899b-669143863e6e} - c:\windows\system32\domilepo.dll

THEN

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

THEN

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Under the Custom Scan box paste this in

netsvcs
%SYSTEMDRIVE%\*.*
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
/md5stop
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

xxjoliet

Post #3March 29, 2010, 5:29 PM UTC

Those exact entries did not show up in my HijackThis when I ran a new scan, so I deleted the ones that looked similar that I could find. Popups are still occuring…. didn't know if this should be happening? Thanks for your help so far, and here are the logs you requested. I attached the two from OTL because I wasn't sure if you needed them.

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-29 12:37:36
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\LAUREN~1\LOCALS~1\Temp\ugtdapob.sys

—- System - GMER 1.0.15 —-

SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xF85F387E]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xF85F3BFE]

Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwCreateFile [0xF82FA7BA]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwCreateProcess [0xF82FA610]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xF82FA624]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwDeleteKey [0xF82FA68C]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xF82FA6B8]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwEnumerateKey [0xF82FA726]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwEnumerateValueKey [0xF82FA710]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwLoadKey2 [0xF82FA73C]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xF82FA7FA]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0xF82FA768]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwOpenKey [0xF82FA662]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwOpenProcess [0xF82FA5D4]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwOpenThread [0xF82FA5E8]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xF82FA7CE]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwQueryKey [0xF82FA7A4]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0xF82FA6FA]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwQueryValueKey [0xF82FA6E4]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwRenameKey [0xF82FA6A2]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwReplaceKey [0xF82FA790]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwRestoreKey [0xF82FA77C]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwSetContextThread [0xF82FA64E]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xF82FA63A]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwTerminateProcess [0xF82FA829]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwUnloadKey [0xF82FA752]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xF82FA810]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwYieldExecution [0xF82FA7E4]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtCreateFile
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtMapViewOfSection
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtOpenProcess
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtOpenThread
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtSetInformationProcess

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!ZwYieldExecution 804F0EB6 7 Bytes JMP F82FA7E8 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwOpenKey 80568EE9 5 Bytes JMP F82FA666 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwQueryValueKey 8056A382 7 Bytes JMP F82FA6E8 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtCreateFile 8056F600 5 Bytes JMP F82FA7BE mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtSetInformationProcess 80570441 5 Bytes JMP F82FA63E mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwQueryKey 805732AD 7 Bytes JMP F82FA7A8 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwEnumerateKey 805735A4 7 Bytes JMP F82FA72A mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtOpenProcess 805741D0 5 Bytes JMP F82FA5D8 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwProtectVirtualMemory 8057457F 7 Bytes JMP F82FA7D2 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwUnmapViewOfSection 80578606 5 Bytes JMP F82FA814 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtMapViewOfSection 80578A81 7 Bytes JMP F82FA7FE mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwCreateProcessEx 80581030 7 Bytes JMP F82FA628 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwTerminateProcess 805836B0 5 Bytes JMP F82FA82D mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtOpenThread 8058B58D 5 Bytes JMP F82FA5EC mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwNotifyChangeKey 8058BA5D 5 Bytes JMP F82FA76C mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwEnumerateValueKey 80590669 7 Bytes JMP F82FA714 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwDeleteValueKey 80592D50 7 Bytes JMP F82FA6BC mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwDeleteKey 805952BE 7 Bytes JMP F82FA690 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwLoadKey2 805AEB9A 7 Bytes JMP F82FA740 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwCreateProcess 805B135A 5 Bytes JMP F82FA614 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwSetContextThread 8062DD47 5 Bytes JMP F82FA652 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwUnloadKey 8064DA6A 7 Bytes JMP F82FA756 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwQueryMultipleValueKey 8064E390 7 Bytes JMP F82FA6FE mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwRenameKey 8064E80E 7 Bytes JMP F82FA6A6 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwRestoreKey 8064ED01 5 Bytes JMP F82FA780 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwReplaceKey 8064F16A 5 Bytes JMP F82FA794 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
init C:\WINDOWS\system32\drivers\tifm21.sys entry point in "init" section [0xF7C8AEBF]

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 01480FEF
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 01480F39
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 01480F5E
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 01480F6F
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 0148002C
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0148000A
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 01480081
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 01480066
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 014800B7
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 01480F14
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 01480EF9
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 0148001B
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 01480FD4
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 01480049
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 01480FA8
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 01480FC3
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 01480092
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 01470FC0
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 01470F8A
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0147001B
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 01470FEF
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 0147003D
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 0147000A
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 0147002C
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 01470FAF
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 0146003D
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] msvcrt.dll!system 77C293C7 5 Bytes JMP 01460FB2
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 01460011
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] msvcrt.dll!_open 77C2F566 5 Bytes JMP 01460FEF
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 01460022
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 01460000
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[204] WS2_32.dll!socket 71AB4211 5 Bytes JMP 01450FEF
.text C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe[240] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 01011B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe[240] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 01011AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe[240] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 01011B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe[240] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 01011B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe[240] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 01011C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe[240] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 01011CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe[240] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 01011BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe[240] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 01011C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe[240] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 01011C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[328] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 00DB1B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[328] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 00DB1AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[328] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 00DB1B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[328] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00DB1B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[328] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 00DB1C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[328] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 00DB1CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[328] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 00DB1BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[328] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 00DB1C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[328] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 00DB1C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\VirusScan Enterprise\ShStat.exe[652] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 10001B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\VirusScan Enterprise\ShStat.exe[652] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 10001AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\VirusScan Enterprise\ShStat.exe[652] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 10001B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\VirusScan Enterprise\ShStat.exe[652] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10001B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\VirusScan Enterprise\ShStat.exe[652] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10001C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\VirusScan Enterprise\ShStat.exe[652] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 10001CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\VirusScan Enterprise\ShStat.exe[652] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 10001BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\VirusScan Enterprise\ShStat.exe[652] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 10001C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\VirusScan Enterprise\ShStat.exe[652] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 10001C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\AGRSMMSG.exe[740] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 10001B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\AGRSMMSG.exe[740] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 10001AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\AGRSMMSG.exe[740] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 10001B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\AGRSMMSG.exe[740] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10001B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\AGRSMMSG.exe[740] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10001C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\AGRSMMSG.exe[740] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 10001CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\AGRSMMSG.exe[740] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 10001BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\AGRSMMSG.exe[740] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 10001C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\AGRSMMSG.exe[740] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 10001C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe[808] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 01031B9E C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe[808] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 01031AC8 C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe[808] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 01031B2E C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe[808] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 01031B45 C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe[808] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 01031C2B C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe[808] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 01031CFC C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe[808] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 01031BD5 C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe[808] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 01031C14 C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe[808] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 01031C62 C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00F10FEF
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00F10F6D
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00F10F7E
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00F10062
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00F10051
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00F10FC0
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00F10F37
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00F10F48
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00F100B8
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00F10F15
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00F100D3
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00F10FAF
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00F10000
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00F10073
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00F10036
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00F1001B
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00F10F26
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00F00FDE
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00F00F8D
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00F00025
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00F00014
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00F00FB2
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00F00FEF
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00F00FC3
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [10, 89]
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00F0004A
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00EF0055
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] msvcrt.dll!system 77C293C7 5 Bytes JMP 00EF003A
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00EF0FD4
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00EF0000
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00EF0029
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00EF0FEF
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[812] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00EE0FEF
.text C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe[816] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 01201B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe[816] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 01201AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe[816] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 01201B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe[816] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 01201B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe[816] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 01201C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe[816] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 01201CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe[816] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 01201BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe[816] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 01201C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe[816] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 01201C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\mfevtps.exe[836] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 006C1B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\mfevtps.exe[836] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 006C1AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\mfevtps.exe[836] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 006C1B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\mfevtps.exe[836] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 006C1B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\mfevtps.exe[836] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 006C1C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\mfevtps.exe[836] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 006C1CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\mfevtps.exe[836] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 006C1BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\mfevtps.exe[836] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 006C1C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\mfevtps.exe[836] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 006C1C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00E40FEF
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00E40F88
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00E40073
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00E40062
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00E40051
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00E40036
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00E40F3F
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00E40F5C
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00E400D1
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00E400B6
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00E40F1D
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00E40FAF
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00E40FD4
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00E40F77
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00E40025
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00E40014
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00E40F2E
.text C:\WINDOWS\system32\services.exe[948] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00E30FD4
.text C:\WINDOWS\system32\services.exe[948] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00E30065
.text C:\WINDOWS\system32\services.exe[948] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00E30FE5
.text C:\WINDOWS\system32\services.exe[948] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00E3001B
.text C:\WINDOWS\system32\services.exe[948] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00E3004A
.text C:\WINDOWS\system32\services.exe[948] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00E3000A
.text C:\WINDOWS\system32\services.exe[948] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00E30FA8
.text C:\WINDOWS\system32\services.exe[948] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [03, 89]
.text C:\WINDOWS\system32\services.exe[948] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00E30FC3
.text C:\WINDOWS\system32\services.exe[948] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00E20F9C
.text C:\WINDOWS\system32\services.exe[948] msvcrt.dll!system 77C293C7 5 Bytes JMP 00E20FB7
.text C:\WINDOWS\system32\services.exe[948] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00E20FC8
.text C:\WINDOWS\system32\services.exe[948] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00E20FEF
.text C:\WINDOWS\system32\services.exe[948] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00E2001D
.text C:\WINDOWS\system32\services.exe[948] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00E2000C
.text C:\WINDOWS\system32\services.exe[948] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00E10FE5
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 010A0000
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 010A00AB
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 010A009A
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 010A0FC0
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 010A007D
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 010A0051
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 010A0F63
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 010A0F7E
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 010A00EB
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 010A00C6
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 010A0F2D
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 010A0062
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 010A001B
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 010A0F9B
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 010A0FDB
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 010A002C
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 010A0F52
.text C:\WINDOWS\system32\lsass.exe[960] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 01090FA8
.text C:\WINDOWS\system32\lsass.exe[960] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 0109004A
.text C:\WINDOWS\system32\lsass.exe[960] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 01090FB9
.text C:\WINDOWS\system32\lsass.exe[960] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 01090FD4
.text C:\WINDOWS\system32\lsass.exe[960] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 0109002F
.text C:\WINDOWS\system32\lsass.exe[960] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 01090FEF
.text C:\WINDOWS\system32\lsass.exe[960] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 0109001E
.text C:\WINDOWS\system32\lsass.exe[960] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 01090F97
.text C:\WINDOWS\system32\lsass.exe[960] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00FF0F8B
.text C:\WINDOWS\system32\lsass.exe[960] msvcrt.dll!system 77C293C7 5 Bytes JMP 00FF0016
.text C:\WINDOWS\system32\lsass.exe[960] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00FF0FC1
.text C:\WINDOWS\system32\lsass.exe[960] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00FF0FE3
.text C:\WINDOWS\system32\lsass.exe[960] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00FF0FB0
.text C:\WINDOWS\system32\lsass.exe[960] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00FF0FD2
.text C:\WINDOWS\system32\lsass.exe[960] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00FE0000
.text C:\WINDOWS\system32\svchost.exe[1160] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C10000
.text C:\WINDOWS\system32\svchost.exe[1160] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C10095
.text C:\WINDOWS\system32\svchost.exe[1160] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C10084
.text C:\WINDOWS\system32\svchost.exe[1160] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C10073
.text C:\WINDOWS\system32\svchost.exe[1160] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C10FB6
.text C:\WINDOWS\system32\svchost.exe[1160] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C1004E
.text C:\WINDOWS\system32\svchost.exe[1160] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C10F68
.text C:\WINDOWS\system32\svchost.exe[1160] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C10F85
.text C:\WINDOWS\system32\svchost.exe[1160] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C10F32
.text C:\WINDOWS\system32\svchost.exe[1160] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C100CB
.text C:\WINDOWS\system32\svchost.exe[1160] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00C100F0
.text C:\WINDOWS\system32\svchost.exe[1160] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00C10FD1
.text C:\WINDOWS\system32\svchost.exe[1160] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C1001B
.text C:\WINDOWS\system32\svchost.exe[1160] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00C100A6
.text C:\WINDOWS\system32\svchost.exe[1160] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00C1003D
.text C:\WINDOWS\system32\svchost.exe[1160] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00C1002C
.text C:\WINDOWS\system32\svchost.exe[1160] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00C10F43
.text C:\WINDOWS\system32\svchost.exe[1160] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00C00022
.text C:\WINDOWS\system32\svchost.exe[1160] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00C0007A
.text C:\WINDOWS\system32\svchost.exe[1160] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00C00011
.text C:\WINDOWS\system32\svchost.exe[1160] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00C00FDB
.text C:\WINDOWS\system32\svchost.exe[1160] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00C0005F
.text C:\WINDOWS\system32\svchost.exe[1160] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00C00000
.text C:\WINDOWS\system32\svchost.exe[1160] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00C0004E
.text C:\WINDOWS\system32\svchost.exe[1160] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00C0003D
.text C:\WINDOWS\system32\svchost.exe[1160] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00BF003A
.text C:\WINDOWS\system32\svchost.exe[1160] msvcrt.dll!system 77C293C7 5 Bytes JMP 00BF0FAF
.text C:\WINDOWS\system32\svchost.exe[1160] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00BF0029
.text C:\WINDOWS\system32\svchost.exe[1160] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00BF0FEF
.text C:\WINDOWS\system32\svchost.exe[1160] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00BF0FCA
.text C:\WINDOWS\system32\svchost.exe[1160] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00BF000C
.text C:\WINDOWS\system32\svchost.exe[1160] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BE0000
.text C:\WINDOWS\system32\svchost.exe[1228] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00D40FEF
.text C:\WINDOWS\system32\svchost.exe[1228] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00D40071
.text C:\WINDOWS\system32\svchost.exe[1228] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00D40060
.text C:\WINDOWS\system32\svchost.exe[1228] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00D4004F
.text C:\WINDOWS\system32\svchost.exe[1228] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00D40032
.text C:\WINDOWS\system32\svchost.exe[1228] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00D40FAB
.text C:\WINDOWS\system32\svchost.exe[1228] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00D4009D
.text C:\WINDOWS\system32\svchost.exe[1228] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00D40F61
.text C:\WINDOWS\system32\svchost.exe[1228] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00D400DA
.text C:\WINDOWS\system32\svchost.exe[1228] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00D400C9
.text C:\WINDOWS\system32\svchost.exe[1228] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00D40F1C
.text C:\WINDOWS\system32\svchost.exe[1228] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00D40F90
.text C:\WINDOWS\system32\svchost.exe[1228] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00D40FDE
.text C:\WINDOWS\system32\svchost.exe[1228] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00D40082
.text C:\WINDOWS\system32\svchost.exe[1228] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00D40FBC
.text C:\WINDOWS\system32\svchost.exe[1228] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00D40FCD
.text C:\WINDOWS\system32\svchost.exe[1228] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00D400B8
.text C:\WINDOWS\system32\svchost.exe[1228] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00C70FC0
.text C:\WINDOWS\system32\svchost.exe[1228] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00C70058
.text C:\WINDOWS\system32\svchost.exe[1228] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00C7001B
.text C:\WINDOWS\system32\svchost.exe[1228] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00C7000A
.text C:\WINDOWS\system32\svchost.exe[1228] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00C70047
.text C:\WINDOWS\system32\svchost.exe[1228] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00C70FEF
.text C:\WINDOWS\system32\svchost.exe[1228] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00C70036
.text C:\WINDOWS\system32\svchost.exe[1228] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00C70FA5
.text C:\WINDOWS\system32\svchost.exe[1228] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00C60FAF
.text C:\WINDOWS\system32\svchost.exe[1228] msvcrt.dll!system 77C293C7 5 Bytes JMP 00C60FD4
.text C:\WINDOWS\system32\svchost.exe[1228] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00C60029
.text C:\WINDOWS\system32\svchost.exe[1228] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00C6000C
.text C:\WINDOWS\system32\svchost.exe[1228] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00C6003A
.text C:\WINDOWS\system32\svchost.exe[1228] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00C60FEF
.text C:\WINDOWS\system32\svchost.exe[1228] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00C50FEF
.text C:\Program Files\Toshiba\Tvs\TvsTray.exe[1296] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 00C21B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Toshiba\Tvs\TvsTray.exe[1296] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 00C21AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Toshiba\Tvs\TvsTray.exe[1296] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 00C21B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Toshiba\Tvs\TvsTray.exe[1296] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C21B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Toshiba\Tvs\TvsTray.exe[1296] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 00C21C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Toshiba\Tvs\TvsTray.exe[1296] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 00C21CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Toshiba\Tvs\TvsTray.exe[1296] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 00C21BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Toshiba\Tvs\TvsTray.exe[1296] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 00C21C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Toshiba\Tvs\TvsTray.exe[1296] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 00C21C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\iPod\bin\iPodService.exe[1304] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 10001B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\iPod\bin\iPodService.exe[1304] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 10001AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\iPod\bin\iPodService.exe[1304] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 10001B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\iPod\bin\iPodService.exe[1304] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10001B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\iPod\bin\iPodService.exe[1304] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10001C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\iPod\bin\iPodService.exe[1304] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 10001CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\iPod\bin\iPodService.exe[1304] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 10001BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\iPod\bin\iPodService.exe[1304] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 10001C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\iPod\bin\iPodService.exe[1304] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 10001C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\TPSMain.exe[1312] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 00D11B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\TPSMain.exe[1312] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 00D11AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\TPSMain.exe[1312] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 00D11B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\TPSMain.exe[1312] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00D11B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\TPSMain.exe[1312] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 00D11C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\TPSMain.exe[1312] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 00D11CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\TPSMain.exe[1312] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 00D11BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\TPSMain.exe[1312] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 00D11C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\TPSMain.exe[1312] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 00D11C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\dla\DLACTRLW.exe[1320] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 00C51B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\dla\DLACTRLW.exe[1320] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 00C51AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\dla\DLACTRLW.exe[1320] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 00C51B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\dla\DLACTRLW.exe[1320] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C51B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\dla\DLACTRLW.exe[1320] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 00C51C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\dla\DLACTRLW.exe[1320] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 00C51CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\dla\DLACTRLW.exe[1320] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 00C51BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\dla\DLACTRLW.exe[1320] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 00C51C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\dla\DLACTRLW.exe[1320] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 00C51C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[1340] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 10001B9E C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[1340] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 10001AC8 C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[1340] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 10001B2E C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[1340] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10001B45 C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[1340] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10001C2B C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[1340] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 10001CFC C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[1340] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 10001BD5 C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[1340] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 10001C14 C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[1340] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 10001C62 C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[1360] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 00CC1B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[1360] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 00CC1AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[1360] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 00CC1B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[1360] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00CC1B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[1360] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 00CC1C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[1360] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 00CC1CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[1360] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 00CC1BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[1360] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 00CC1C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[1360] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 00CC1C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 04F90FE5
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 04F90076
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 04F90065
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 04F90054
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 04F90F97
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 04F9002F
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 04F900A2
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 04F90F66
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 04F90F2B
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 04F900C4
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 04F90F10
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 04F90FA8
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 04F90FD4
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 04F90091
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 04F9001E
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 04F90FC3
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 04F900B3
.text C:\WINDOWS\System32\svchost.exe[1372] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 01940040
.text C:\WINDOWS\System32\svchost.exe[1372] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 01940FC3
.text C:\WINDOWS\System32\svchost.exe[1372] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0194002F
.text C:\WINDOWS\System32\svchost.exe[1372] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 01940014
.text C:\WINDOWS\System32\svchost.exe[1372] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 01940FDE
.text C:\WINDOWS\System32\svchost.exe[1372] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 01940FEF
.text C:\WINDOWS\System32\svchost.exe[1372] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 01940076
.text C:\WINDOWS\System32\svchost.exe[1372] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 01940065
.text C:\WINDOWS\System32\svchost.exe[1372] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 01930F97
.text C:\WINDOWS\System32\svchost.exe[1372] msvcrt.dll!system 77C293C7 5 Bytes JMP 01930FB2
.text C:\WINDOWS\System32\svchost.exe[1372] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 01930FDE
.text C:\WINDOWS\System32\svchost.exe[1372] msvcrt.dll!_open 77C2F566 5 Bytes JMP 01930000
.text C:\WINDOWS\System32\svchost.exe[1372] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 01930FCD
.text C:\WINDOWS\System32\svchost.exe[1372] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 01930FEF
.text C:\WINDOWS\System32\svchost.exe[1372] WS2_32.dll!socket 71AB4211 5 Bytes JMP 01920FE5
.text C:\WINDOWS\System32\svchost.exe[1372] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 01910000
.text C:\WINDOWS\System32\svchost.exe[1372] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 01910025
.text C:\WINDOWS\System32\svchost.exe[1372] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 01910036
.text C:\WINDOWS\System32\svchost.exe[1372] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 01910FE5
.text C:\WINDOWS\system32\svchost.exe[1528] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C50FEF
.text C:\WINDOWS\system32\svchost.exe[1528] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C50073
.text C:\WINDOWS\system32\svchost.exe[1528] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C50062
.text C:\WINDOWS\system32\svchost.exe[1528] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C50051
.text C:\WINDOWS\system32\svchost.exe[1528] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C50040
.text C:\WINDOWS\system32\svchost.exe[1528] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C50FB9
.text C:\WINDOWS\system32\svchost.exe[1528] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C5009F
.text C:\WINDOWS\system32\svchost.exe[1528] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C50084
.text C:\WINDOWS\system32\svchost.exe[1528] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C500CB
.text C:\WINDOWS\system32\svchost.exe[1528] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C50F3C
.text C:\WINDOWS\system32\svchost.exe[1528] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00C50F17
.text C:\WINDOWS\system32\svchost.exe[1528] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00C50FA8
.text C:\WINDOWS\system32\svchost.exe[1528] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C50000
.text C:\WINDOWS\system32\svchost.exe[1528] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00C50F63
.text C:\WINDOWS\system32\svchost.exe[1528] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00C50FCA
.text C:\WINDOWS\system32\svchost.exe[1528] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00C5001B
.text C:\WINDOWS\system32\svchost.exe[1528] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00C500B0
.text C:\WINDOWS\system32\svchost.exe[1528] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00700047
.text C:\WINDOWS\system32\svchost.exe[1528] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00700FA5
.text C:\WINDOWS\system32\svchost.exe[1528] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0070002C
.text C:\WINDOWS\system32\svchost.exe[1528] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00700011
.text C:\WINDOWS\system32\svchost.exe[1528] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00700FB6
.text C:\WINDOWS\system32\svchost.exe[1528] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00700000
.text C:\WINDOWS\system32\svchost.exe[1528] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00700062
.text C:\WINDOWS\system32\svchost.exe[1528] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00700FDB
.text C:\WINDOWS\system32\svchost.exe[1528] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 006F0F9C
.text C:\WINDOWS\system32\svchost.exe[1528] msvcrt.dll!system 77C293C7 5 Bytes JMP 006F0031
.text C:\WINDOWS\system32\svchost.exe[1528] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 006F0FC1
.text C:\WINDOWS\system32\svchost.exe[1528] msvcrt.dll!_open 77C2F566 5 Bytes JMP 006F0FEF
.text C:\WINDOWS\system32\svchost.exe[1528] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 006F0016
.text C:\WINDOWS\system32\svchost.exe[1528] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 006F0FD2
.text C:\WINDOWS\system32\svchost.exe[1528] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 006D000A
.text C:\WINDOWS\system32\svchost.exe[1528] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 006D0FE5
.text C:\WINDOWS\system32\svchost.exe[1528] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 006D0FD4
.text C:\WINDOWS\system32\svchost.exe[1528] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 006D0025
.text C:\WINDOWS\system32\svchost.exe[1528] WS2_32.dll!socket 71AB4211 5 Bytes JMP 006E0000
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C70000
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C70067
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C70F72
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C70F8D
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C70F9E
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C70FCA
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C70F2B
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C70F3C
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C70F10
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C700A9
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00C700C4
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00C70FB9
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C70FE5
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00C70F4D
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00C70036
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00C7001B
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00C70098
.text C:\WINDOWS\system32\svchost.exe[1596] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00C6001B
.text C:\WINDOWS\system32\svchost.exe[1596] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00C60F8A
.text C:\WINDOWS\system32\svchost.exe[1596] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00C60FCA
.text C:\WINDOWS\system32\svchost.exe[1596] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00C60FDB
.text C:\WINDOWS\system32\svchost.exe[1596] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00C60FA5
.text C:\WINDOWS\system32\svchost.exe[1596] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00C60000
.text C:\WINDOWS\system32\svchost.exe[1596] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00C60047
.text C:\WINDOWS\system32\svchost.exe[1596] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00C60036
.text C:\WINDOWS\system32\svchost.exe[1596] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00C50053
.text C:\WINDOWS\system32\svchost.exe[1596] msvcrt.dll!system 77C293C7 5 Bytes JMP 00C50042
.text C:\WINDOWS\system32\svchost.exe[1596] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00C50FD2
.text C:\WINDOWS\system32\svchost.exe[1596] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00C50FEF
.text C:\WINDOWS\system32\svchost.exe[1596] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00C50031
.text C:\WINDOWS\system32\svchost.exe[1596] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00C5000C
.text C:\WINDOWS\system32\svchost.exe[1596] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00C40FEF
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1616] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 006D1B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1616] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 006D1AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1616] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 006D1B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1616] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 006D1B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1616] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 006D1C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1616] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 006D1CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1616] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 006D1BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1616] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 006D1C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1616] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 006D1C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Bonjour\mDNSResponder.exe[1652] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 00701B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Bonjour\mDNSResponder.exe[1652] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 00701AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Bonjour\mDNSResponder.exe[1652] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 00701B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Bonjour\mDNSResponder.exe[1652] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00701B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Bonjour\mDNSResponder.exe[1652] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 00701C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Bonjour\mDNSResponder.exe[1652] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 00701CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Bonjour\mDNSResponder.exe[1652] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 00701BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Bonjour\mDNSResponder.exe[1652] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 00701C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Bonjour\mDNSResponder.exe[1652] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 00701C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\Common Framework\udaterui.exe[1740] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 010D1B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\Common Framework\udaterui.exe[1740] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 010D1AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\Common Framework\udaterui.exe[1740] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 010D1B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\Common Framework\udaterui.exe[1740] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 010D1B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\Common Framework\udaterui.exe[1740] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 010D1C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\Common Framework\udaterui.exe[1740] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 010D1CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\Common Framework\udaterui.exe[1740] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 010D1BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\Common Framework\udaterui.exe[1740] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 010D1C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\Common Framework\udaterui.exe[1740] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 010D1C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\ltmoh\Ltmoh.exe[1772] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 00B51B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\ltmoh\Ltmoh.exe[1772] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 00B51AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\ltmoh\Ltmoh.exe[1772] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 00B51B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\ltmoh\Ltmoh.exe[1772] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00B51B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\ltmoh\Ltmoh.exe[1772] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 00B51C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\ltmoh\Ltmoh.exe[1772] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 00B51CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\ltmoh\Ltmoh.exe[1772] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 00B51BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\ltmoh\Ltmoh.exe[1772] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 00B51C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\ltmoh\Ltmoh.exe[1772] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 00B51C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Synaptics\SynTP\Toshiba.exe[1804] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 00C91B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Synaptics\SynTP\Toshiba.exe[1804] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 00C91AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Synaptics\SynTP\Toshiba.exe[1804] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 00C91B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Synaptics\SynTP\Toshiba.exe[1804] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C91B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Synaptics\SynTP\Toshiba.exe[1804] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 00C91C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Synaptics\SynTP\Toshiba.exe[1804] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 00C91CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Synaptics\SynTP\Toshiba.exe[1804] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 00C91BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Synaptics\SynTP\Toshiba.exe[1804] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 00C91C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Synaptics\SynTP\Toshiba.exe[1804] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 00C91C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\svchost.exe[1820] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C0000A
.text C:\WINDOWS\system32\svchost.exe[1820] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C00FC0
.text C:\WINDOWS\system32\svchost.exe[1820] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C000BF
.text C:\WINDOWS\system32\svchost.exe[1820] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C000AE
.text C:\WINDOWS\system32\svchost.exe[1820] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C00091
.text C:\WINDOWS\system32\svchost.exe[1820] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C00062
.text C:\WINDOWS\system32\svchost.exe[1820] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C00101
.text C:\WINDOWS\system32\svchost.exe[1820] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C00FAF
.text C:\WINDOWS\system32\svchost.exe[1820] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C00134
.text C:\WINDOWS\system32\svchost.exe[1820] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C00123
.text C:\WINDOWS\system32\svchost.exe[1820] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00C00145
.text C:\WINDOWS\system32\svchost.exe[1820] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00C00FE5
.text C:\WINDOWS\system32\svchost.exe[1820] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C0001B
.text C:\WINDOWS\system32\svchost.exe[1820] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00C000D0
.text C:\WINDOWS\system32\svchost.exe[1820] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00C00051
.text C:\WINDOWS\system32\svchost.exe[1820] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00C0002C
.text C:\WINDOWS\system32\svchost.exe[1820] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00C00112
.text C:\WINDOWS\system32\svchost.exe[1820] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00BF002C
.text C:\WINDOWS\system32\svchost.exe[1820] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00BF0076
.text C:\WINDOWS\system32\svchost.exe[1820] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00BF001B
.text C:\WINDOWS\system32\svchost.exe[1820] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00BF0000
.text C:\WINDOWS\system32\svchost.exe[1820] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00BF0FAF
.text C:\WINDOWS\system32\svchost.exe[1820] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00BF0FEF
.text C:\WINDOWS\system32\svchost.exe[1820] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00BF0047
.text C:\WINDOWS\system32\svchost.exe[1820] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00BF0FC0
.text C:\WINDOWS\system32\svchost.exe[1820] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00BE0F7F
.text C:\WINDOWS\system32\svchost.exe[1820] msvcrt.dll!system 77C293C7 5 Bytes JMP 00BE0F90
.text C:\WINDOWS\system32\svchost.exe[1820] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00BE0000
.text C:\WINDOWS\system32\svchost.exe[1820] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00BE0FEF
.text C:\WINDOWS\system32\svchost.exe[1820] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00BE0FAB
.text C:\WINDOWS\system32\svchost.exe[1820] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00BE0FD2
.text C:\WINDOWS\system32\svchost.exe[1820] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BD0FE5
.text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C30FE5
.text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C30060
.text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C30F61
.text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C30F72
.text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C30F8D
.text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C30FC3
.text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C3008C
.text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C30F50
.text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C300D3
.text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C300B8
.text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00C300EE
.text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00C30FA8
.text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C30FD4
.text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00C30071
.text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00C30025
.text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00C30014
.text C:\WINDOWS\system32\svchost.exe[1856] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00C300A7
.text C:\WINDOWS\system32\svchost.exe[1856] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00C2002C
.text C:\WINDOWS\system32\svchost.exe[1856] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00C20062
.text C:\WINDOWS\system32\svchost.exe[1856] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00C20FDB
.text C:\WINDOWS\system32\svchost.exe[1856] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00C2001B
.text C:\WINDOWS\system32\svchost.exe[1856] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00C20FA5
.text C:\WINDOWS\system32\svchost.exe[1856] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00C2000A
.text C:\WINDOWS\system32\svchost.exe[1856] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00C20047
.text C:\WINDOWS\system32\svchost.exe[1856] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00C20FC0
.text C:\WINDOWS\system32\svchost.exe[1856] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00C10038
.text C:\WINDOWS\system32\svchost.exe[1856] msvcrt.dll!system 77C293C7 5 Bytes JMP 00C10FB7
.text C:\WINDOWS\system32\svchost.exe[1856] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00C1000C
.text C:\WINDOWS\system32\svchost.exe[1856] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00C10FE3
.text C:\WINDOWS\system32\svchost.exe[1856] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00C10027
.text C:\WINDOWS\system32\svchost.exe[1856] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00C10FD2
.text C:\WINDOWS\system32\svchost.exe[1864] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00A70FE5
.text C:\WINDOWS\system32\svchost.exe[1864] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00A70F46
.text C:\WINDOWS\system32\svchost.exe[1864] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00A70F57
.text C:\WINDOWS\system32\svchost.exe[1864] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00A70F68
.text C:\WINDOWS\system32\svchost.exe[1864] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00A70F79
.text C:\WINDOWS\system32\svchost.exe[1864] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00A70FAF
.text C:\WINDOWS\system32\svchost.exe[1864] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00A70062
.text C:\WINDOWS\system32\svchost.exe[1864] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00A70F1A
.text C:\WINDOWS\system32\svchost.exe[1864] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00A70EE4
.text C:\WINDOWS\system32\svchost.exe[1864] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00A70EFF
.text C:\WINDOWS\system32\svchost.exe[1864] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00A70EC9
.text C:\WINDOWS\system32\svchost.exe[1864] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00A70F94
.text C:\WINDOWS\system32\svchost.exe[1864] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00A70000
.text C:\WINDOWS\system32\svchost.exe[1864] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00A70F2B
.text C:\WINDOWS\system32\svchost.exe[1864] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00A7001B
.text C:\WINDOWS\system32\svchost.exe[1864] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00A70FCA
.text C:\WINDOWS\system32\svchost.exe[1864] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00A7007D
.text C:\WINDOWS\system32\svchost.exe[1864] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00A60FB9
.text C:\WINDOWS\system32\svchost.exe[1864] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00A60F97
.text C:\WINDOWS\system32\svchost.exe[1864] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00A60FCA
.text C:\WINDOWS\system32\svchost.exe[1864] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00A60FEF
.text C:\WINDOWS\system32\svchost.exe[1864] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00A60054
.text C:\WINDOWS\system32\svchost.exe[1864] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00A60000
.text C:\WINDOWS\system32\svchost.exe[1864] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00A60FA8
.text C:\WINDOWS\system32\svchost.exe[1864] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [C6, 88]
.text C:\WINDOWS\system32\svchost.exe[1864] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00A6002F
.text C:\WINDOWS\system32\svchost.exe[1864] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00A50047
.text C:\WINDOWS\system32\svchost.exe[1864] msvcrt.dll!system 77C293C7 5 Bytes JMP 00A5002C
.text C:\WINDOWS\system32\svchost.exe[1864] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00A50FD7
.text C:\WINDOWS\system32\svchost.exe[1864] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00A50000
.text C:\WINDOWS\system32\svchost.exe[1864] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00A50FBC
.text C:\WINDOWS\system32\svchost.exe[1864] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00A50011
.text C:\WINDOWS\system32\svchost.exe[1864] WS2_32.dll!socket 71AB4211 5 Bytes JMP 0076000A
.text C:\Program Files\Java\jre6\bin\jqs.exe[1968] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 006D1B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Java\jre6\bin\jqs.exe[1968] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 006D1AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Java\jre6\bin\jqs.exe[1968] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 006D1B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Java\jre6\bin\jqs.exe[1968] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 006D1B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Java\jre6\bin\jqs.exe[1968] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 006D1C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Java\jre6\bin\jqs.exe[1968] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 006D1CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Java\jre6\bin\jqs.exe[1968] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 006D1BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Java\jre6\bin\jqs.exe[1968] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 006D1C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\Java\jre6\bin\jqs.exe[1968] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 006D1C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 01890FE5
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 01890069
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 01890058
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 01890F74
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 0189003D
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 01890022
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 018900A1
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 01890090
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 01890F26
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 01890F37
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 01890F0B
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 01890F9B
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 02E01B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 02E01AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 02E01B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 02E01B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 01890F59
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 01890011
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 02E01C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 02E01CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 01890000
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 01890F48
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 02E01BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\Explorer.EXE[2004] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 02E01C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\Explorer.EXE[2004] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 01880047
.text C:\WINDOWS\Explorer.EXE[2004] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 0188009F
.text C:\WINDOWS\Explorer.EXE[2004] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 01880022
.text C:\WINDOWS\Explorer.EXE[2004] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 01880011
.text C:\WINDOWS\Explorer.EXE[2004] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 0188008E
.text C:\WINDOWS\Explorer.EXE[2004] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 01880000
.text C:\WINDOWS\Explorer.EXE[2004] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 01880069
.text C:\WINDOWS\Explorer.EXE[2004] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 01880058
.text C:\WINDOWS\Explorer.EXE[2004] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 017A0FAB
.text C:\WINDOWS\Explorer.EXE[2004] msvcrt.dll!system 77C293C7 5 Bytes JMP 017A002C
.text C:\WINDOWS\Explorer.EXE[2004] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 017A000A
.text C:\WINDOWS\Explorer.EXE[2004] msvcrt.dll!_open 77C2F566 5 Bytes JMP 017A0FE3
.text C:\WINDOWS\Explorer.EXE[2004] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 017A001B
.text C:\WINDOWS\Explorer.EXE[2004] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 017A0FD2
.text C:\WINDOWS\Explorer.EXE[2004] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 01790000
.text C:\WINDOWS\Explorer.EXE[2004] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 01790FEF
.text C:\WINDOWS\Explorer.EXE[2004] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 0179001B
.text C:\WINDOWS\Explorer.EXE[2004] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 0179002C
.text C:\WINDOWS\Explorer.EXE[2004] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00E20FEF
.text C:\WINDOWS\Explorer.EXE[2004] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 02E01C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe[2100] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 10001B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe[2100] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 10001AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe[2100] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 10001B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe[2100] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10001B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe[2100] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10001C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe[2100] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 10001CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe[2100] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 10001BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe[2100] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 10001C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe[2100] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 10001C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\RTHDCPL.EXE[2240] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 10001B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\RTHDCPL.EXE[2240] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 10001AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\RTHDCPL.EXE[2240] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 10001B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\RTHDCPL.EXE[2240] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10001B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\RTHDCPL.EXE[2240] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10001C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\RTHDCPL.EXE[2240] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 10001CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\RTHDCPL.EXE[2240] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 10001BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\RTHDCPL.EXE[2240] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 10001C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\RTHDCPL.EXE[2240] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 10001C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\TPSBattM.exe[2576] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 00A81B9E C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\TPSBattM.exe[2576] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 00A81AC8 C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\TPSBattM.exe[2576] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 00A81B2E C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\TPSBattM.exe[2576] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00A81B45 C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\TPSBattM.exe[2576] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 00A81C2B C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\TPSBattM.exe[2576] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 00A81CFC C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\TPSBattM.exe[2576] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 00A81BD5 C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\TPSBattM.exe[2576] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 00A81C14 C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\TPSBattM.exe[2576] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 00A81C62 C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\ctfmon.exe[2748] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 10001B9E C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\ctfmon.exe[2748] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 10001AC8 C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\ctfmon.exe[2748] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 10001B2E C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\ctfmon.exe[2748] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10001B45 C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\ctfmon.exe[2748] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10001C2B C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\ctfmon.exe[2748] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 10001CFC C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\ctfmon.exe[2748] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 10001BD5 C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\ctfmon.exe[2748] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 10001C14 C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\ctfmon.exe[2748] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 10001C62 C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\RAMASST.exe[2800] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 10001B9E C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\RAMASST.exe[2800] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 10001AC8 C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\RAMASST.exe[2800] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 10001B2E C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\RAMASST.exe[2800] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10001B45 C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\RAMASST.exe[2800] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10001C2B C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\RAMASST.exe[2800] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 10001CFC C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\RAMASST.exe[2800] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 10001BD5 C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\RAMASST.exe[2800] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 10001C14 C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\RAMASST.exe[2800] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 10001C62 C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\McAfee\Common Framework\McTray.exe[2884] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 00BA1B9E C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\McAfee\Common Framework\McTray.exe[2884] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 00BA1AC8 C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\McAfee\Common Framework\McTray.exe[2884] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 00BA1B2E C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\McAfee\Common Framework\McTray.exe[2884] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00BA1B45 C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\McAfee\Common Framework\McTray.exe[2884] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 00BA1C2B C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\McAfee\Common Framework\McTray.exe[2884] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 00BA1CFC C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\McAfee\Common Framework\McTray.exe[2884] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 00BA1BD5 C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\McAfee\Common Framework\McTray.exe[2884] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 00BA1C14 C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\McAfee\Common Framework\McTray.exe[2884] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 00BA1C62 C:\WINDOWS\system32\nojoredu.dll
.text C:\WINDOWS\system32\dllhost.exe[3088] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 001A0000
.text C:\WINDOWS\system32\dllhost.exe[3088] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001A0F88
.text C:\WINDOWS\system32\dllhost.exe[3088] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 001A007D
.text C:\WINDOWS\system32\dllhost.exe[3088] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 001A006C
.text C:\WINDOWS\system32\dllhost.exe[3088] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 001A005B
.text C:\WINDOWS\system32\dllhost.exe[3088] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 001A0FB9
.text C:\WINDOWS\system32\dllhost.exe[3088] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 001A00D0
.text C:\WINDOWS\system32\dllhost.exe[3088] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 001A00B3
.text C:\WINDOWS\system32\dllhost.exe[3088] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001A00F2
.text C:\WINDOWS\system32\dllhost.exe[3088] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 001A00E1
.text C:\WINDOWS\system32\dllhost.exe[3088] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 001A0F34
.text C:\WINDOWS\system32\dllhost.exe[3088] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 001A0040
.text C:\WINDOWS\system32\dllhost.exe[3088] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 001A0FEF
.text C:\WINDOWS\system32\dllhost.exe[3088] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 001A00A2
.text C:\WINDOWS\system32\dllhost.exe[3088] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 001A001B
.text C:\WINDOWS\system32\dllhost.exe[3088] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 001A0FD4
.text C:\WINDOWS\system32\dllhost.exe[3088] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 001A0F6D
.text C:\WINDOWS\system32\dllhost.exe[3088] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 0029005A
.text C:\WINDOWS\system32\dllhost.exe[3088] msvcrt.dll!system 77C293C7 5 Bytes JMP 00290049
.text C:\WINDOWS\system32\dllhost.exe[3088] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00290FD9
.text C:\WINDOWS\system32\dllhost.exe[3088] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00290000
.text C:\WINDOWS\system32\dllhost.exe[3088] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 0029002E
.text C:\WINDOWS\system32\dllhost.exe[3088] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00290011
.text C:\WINDOWS\system32\dllhost.exe[3088] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 002A0FD4
.text C:\WINDOWS\system32\dllhost.exe[3088] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 002A0054
.text C:\WINDOWS\system32\dllhost.exe[3088] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 002A001B
.text C:\WINDOWS\system32\dllhost.exe[3088] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 002A000A
.text C:\WINDOWS\system32\dllhost.exe[3088] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 002A0F97
.text C:\WINDOWS\system32\dllhost.exe[3088] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 002A0FEF
.text C:\WINDOWS\system32\dllhost.exe[3088] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 002A0FB2
.text C:\WINDOWS\system32\dllhost.exe[3088] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [4A, 88]
.text C:\WINDOWS\system32\dllhost.exe[3088] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 002A0FC3
.text C:\WINDOWS\system32\dllhost.exe[3088] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00780000
.text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3948] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 00B11B9E C:\WINDOWS\system32\nojoredu.dll
.text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3948] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 00B11AC8 C:\WINDOWS\system32\nojoredu.dll
.text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3948] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 00B11B2E C:\WINDOWS\system32\nojoredu.dll
.text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3948] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00B11B45 C:\WINDOWS\system32\nojoredu.dll
.text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3948] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 00B11C2B C:\WINDOWS\system32\nojoredu.dll
.text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3948] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 00B11CFC C:\WINDOWS\system32\nojoredu.dll
.text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3948] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 00B11BD5 C:\WINDOWS\system32\nojoredu.dll
.text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3948] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 00B11C14 C:\WINDOWS\system32\nojoredu.dll
.text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3948] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 00B11C62 C:\WINDOWS\system32\nojoredu.dll
.text C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe[4044] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 00AC1B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe[4044] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 00AC1AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe[4044] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 00AC1B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe[4044] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00AC1B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe[4044] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 00AC1C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe[4044] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 00AC1CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe[4044] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 00AC1BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe[4044] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 00AC1C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe[4044] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 00AC1C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\TDispVol.exe[4068] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 10001B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\TDispVol.exe[4068] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 10001AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\TDispVol.exe[4068] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 10001B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\TDispVol.exe[4068] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10001B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\TDispVol.exe[4068] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10001C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\TDispVol.exe[4068] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 10001CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\TDispVol.exe[4068] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 10001BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\TDispVol.exe[4068] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 10001C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\TDispVol.exe[4068] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 10001C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\igfxpers.exe[4076] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 10001B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\igfxpers.exe[4076] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 10001AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\igfxpers.exe[4076] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 10001B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\igfxpers.exe[4076] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10001B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\igfxpers.exe[4076] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10001C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\igfxpers.exe[4076] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 10001CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\igfxpers.exe[4076] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 10001BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\igfxpers.exe[4076] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 10001C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\system32\igfxpers.exe[4076] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 10001C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\ehome\ehtray.exe[4092] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 10001B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\ehome\ehtray.exe[4092] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 10001AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\ehome\ehtray.exe[4092] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 10001B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\ehome\ehtray.exe[4092] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10001B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\ehome\ehtray.exe[4092] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10001C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\ehome\ehtray.exe[4092] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 10001CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\ehome\ehtray.exe[4092] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 10001BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\ehome\ehtray.exe[4092] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 10001C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\WINDOWS\ehome\ehtray.exe[4092] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 10001C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\Documents and Settings\Lauren Rothermel\Desktop\gmer\gmer.exe[5108] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 00AF1B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\Documents and Settings\Lauren Rothermel\Desktop\gmer\gmer.exe[5108] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 00AF1AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\Documents and Settings\Lauren Rothermel\Desktop\gmer\gmer.exe[5108] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 00AF1B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\Documents and Settings\Lauren Rothermel\Desktop\gmer\gmer.exe[5108] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00AF1B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\Documents and Settings\Lauren Rothermel\Desktop\gmer\gmer.exe[5108] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 00AF1C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\Documents and Settings\Lauren Rothermel\Desktop\gmer\gmer.exe[5108] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 00AF1CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\Documents and Settings\Lauren Rothermel\Desktop\gmer\gmer.exe[5108] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 00AF1BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\Documents and Settings\Lauren Rothermel\Desktop\gmer\gmer.exe[5108] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 00AF1C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\Documents and Settings\Lauren Rothermel\Desktop\gmer\gmer.exe[5108] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 00AF1C62 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe[5240] kernel32.dll!GetFileAttributesW 7C80B7EC 5 Bytes JMP 10001B9E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe[5240] kernel32.dll!FindFirstFileExW 7C80EB1D 5 Bytes JMP 10001AC8 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe[5240] kernel32.dll!FindNextFileW 7C80EFDA 7 Bytes JMP 10001B2E C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe[5240] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 10001B45 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe[5240] kernel32.dll!DeleteFileW 7C831F63 5 Bytes JMP 10001C2B C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe[5240] kernel32.dll!MoveFileExW 7C83568B 5 Bytes JMP 10001CFC C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe[5240] kernel32.dll!Module32FirstW 7C8652E7 5 Bytes JMP 10001BD5 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe[5240] kernel32.dll!Module32NextW 7C865484 5 Bytes JMP 10001C14 C:\WINDOWS\system32\fahokipa.dll
.text C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe[5240] PSAPI.DLL!EnumProcessModules 76BF1EF4 5 Bytes JMP 10001C62 C:\WINDOWS\system32\fahokipa.dll

—- User IAT/EAT - GMER 1.0.15 —-

IAT C:\WINDOWS\system32\mfevtps.exe[836] @ C:\WINDOWS\system32\CRYPT32.dll [ADVAPI32.dll!RegQueryValueExW] [00405995] C:\WINDOWS\system32\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.)
IAT C:\WINDOWS\system32\mfevtps.exe[836] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [004059CB] C:\WINDOWS\system32\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.)

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (McAfee Link Driver/McAfee, Inc.)

Device \FileSystem\Udfs \UdfsCdRom DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\meiudf \MeiUDF_Disk DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\meiudf \MeiUDF_CdRom DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Udfs \UdfsDisk DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions)

AttachedDevice \Driver\Tcpip \Device\Ip mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

Device \FileSystem\Cdfs \Cdfs A8CDF400
Device \FileSystem\Cdfs \Cdfs DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions)
—- Processes - GMER 1.0.15 —-

Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe [240] 0x01010000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [328] 0x00DB0000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Program Files\McAfee\VirusScan Enterprise\ShStat.exe [652] 0x10000000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\WINDOWS\AGRSMMSG.exe [740] 0x10000000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [808] 0x013D0000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe [816] 0x01200000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\WINDOWS\system32\mfevtps.exe [836] 0x006C0000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\WINDOWS\system32\winlogon.exe [900] 0x004A0000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\WINDOWS\system32\services.exe [948] 0x00630000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\WINDOWS\system32\lsass.exe [960] 0x10000000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Program Files\Toshiba\Tvs\TvsTray.exe [1296] 0x00C20000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Program Files\iPod\bin\iPodService.exe [1304] 0x10000000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\WINDOWS\system32\TPSMain.exe [1312] 0x00D10000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\WINDOWS\system32\dla\DLACTRLW.exe [1320] 0x00C50000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe [1340] 0x00C50000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe [1360] 0x00CC0000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [1616] 0x006D0000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Program Files\Bonjour\mDNSResponder.exe [1652] 0x00700000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Program Files\McAfee\Common Framework\udaterui.exe [1740] 0x010D0000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Program Files\ltmoh\Ltmoh.exe [1772] 0x00B50000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Program Files\Synaptics\SynTP\Toshiba.exe [1804] 0x00C90000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Program Files\Java\jre6\bin\jqs.exe [1968] 0x006D0000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\WINDOWS\Explorer.EXE [2004] 0x02E00000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe [2100] 0x10000000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\WINDOWS\RTHDCPL.EXE [2240] 0x10000000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\WINDOWS\system32\TPSBattM.exe [2576] 0x00BC0000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\WINDOWS\system32\ctfmon.exe [2748] 0x00BF0000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\WINDOWS\system32\RAMASST.exe [2800] 0x00B70000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Program Files\McAfee\Common Framework\McTray.exe [2884] 0x00CF0000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe [3948] 0x00E70000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe [4044] 0x00AC0000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\WINDOWS\system32\TDispVol.exe [4068] 0x10000000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\WINDOWS\system32\igfxpers.exe [4076] 0x10000000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\WINDOWS\ehome\ehtray.exe [4092] 0x10000000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Documents and Settings\Lauren Rothermel\Desktop\gmer\gmer.exe [5108] 0x00AF0000
Library C:\WINDOWS\system32\fahokipa.dll (*** hidden *** ) @ C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe [5240] 0x10000000

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\system32\duriguhu 6456 bytes
File C:\WINDOWS\system32\fahokipa.dll 61952 bytes executable
File C:\WINDOWS\system32\lilihepu.dll 61952 bytes executable
File C:\WINDOWS\system32\nojoredu.dll 61952 bytes executable

—- EOF - GMER 1.0.15 —-

Attachments:

Essexboy

Post #4March 29, 2010, 7:22 PM UTC

This one looks well rooted in the system

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
O2 - BHO: (no name) - {7ab39fa9-e866-48b5-8c13-2c55c009a731} - C:\WINDOWS\System32\lilihepu.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [faborolor] C:\WINDOWS\System32\jutizowi.DLL ()
O4 - HKLM..\Run: [ladowetobo] C:\WINDOWS\System32\nojoredu.dll ()
O15 - HKLM\..Trusted Domains: buy-internet-security10.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKCU\..Trusted Domains: buy-internet-security10.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: is-soft-download.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: is-software-download.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: is-software-download25.com ([]http in Trusted sites)
O20 - AppInit_DLLs: (c:\windows\system32\jutizowi.dll) - C:\WINDOWS\system32\jutizowi.dll ()
O20 - AppInit_DLLs: (fahokipa.dll) - File not found
O21 - SSODL: vedimasug - {15fa1b56-13a5-4fb3-a638-b98c092591e6} - C:\WINDOWS\system32\jutizowi.dll ()
O22 - SharedTaskScheduler: {15fa1b56-13a5-4fb3-a638-b98c092591e6} - mujuzedij - C:\WINDOWS\system32\jutizowi.dll ()
O27 - HKLM IFEO\MpCmdRun.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\MSASCui.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\MsMpEng.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O27 - HKLM IFEO\msseces.exe: Debugger - C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
O33 - MountPoints2\{28e4f2dd-2267-11df-917e-001302c7a1f0}\Shell\AutoRun\command - "" = 9g86.exe
O33 - MountPoints2\{28e4f2dd-2267-11df-917e-001302c7a1f0}\Shell\open\Command - "" = 9g86.exe
[2099/01/01 12:00:00 | 000,101,376 | -HS- | M] () – C:\WINDOWS\System32\pidezabi.dll
[2099/01/01 12:00:00 | 000,101,376 | -HS- | M] () – C:\WINDOWS\System32\jutizowi.dll
[2099/01/01 12:00:00 | 000,070,144 | -HS- | M] () – C:\WINDOWS\System32\yijazowi.dll
[2099/01/01 12:00:00 | 000,047,616 | -HS- | M] () – C:\WINDOWS\System32\seyohale.dll
[2099/01/01 12:00:00 | 000,047,616 | -HS- | M] () – C:\WINDOWS\System32\nohopeka.dll
[2099/01/01 12:00:00 | 000,047,616 | -HS- | M] () – C:\WINDOWS\System32\gudikabo.dll
[2010/03/29 13:14:01 | 000,000,316 | —- | M] () – C:\WINDOWS\tasks\jbrycjpa.job
[2010/03/29 13:00:03 | 000,000,296 | —- | M] () – C:\WINDOWS\tasks\cweduufd.job
[2010/03/29 13:00:00 | 000,000,296 | —- | M] () – C:\WINDOWS\tasks\yikfjrks.job
[2099/01/01 12:00:00 | 000,101,376 | -HS- | C] () – C:\WINDOWS\System32\pidezabi.dll
[2099/01/01 12:00:00 | 000,101,376 | -HS- | C] () – C:\WINDOWS\System32\jutizowi.dll
[2099/01/01 12:00:00 | 000,070,144 | -HS- | C] () – C:\WINDOWS\System32\yijazowi.dll
[2099/01/01 12:00:00 | 000,061,952 | -HS- | C] () – C:\WINDOWS\System32\nojoredu.dll
[2099/01/01 12:00:00 | 000,061,952 | -HS- | C] () – C:\WINDOWS\System32\lilihepu.dll
[2099/01/01 12:00:00 | 000,047,616 | -HS- | C] () – C:\WINDOWS\System32\seyohale.dll
[2099/01/01 12:00:00 | 000,047,616 | -HS- | C] () – C:\WINDOWS\System32\nohopeka.dll
[2099/01/01 12:00:00 | 000,047,616 | -HS- | C] () – C:\WINDOWS\System32\gudikabo.dll
[2010/03/29 10:42:37 | 000,000,296 | —- | C] () – C:\WINDOWS\tasks\cweduufd.job
[2010/03/29 13:00:03 | 000,000,296 | —- | M] () – C:\WINDOWS\Tasks\cweduufd.job
[2010/03/29 13:14:01 | 000,000,316 | —- | M] () – C:\WINDOWS\Tasks\jbrycjpa.job
[2010/03/29 13:00:00 | 000,000,296 | —- | M] () – C:\WINDOWS\Tasks\yikfjrks.job

:Files
C:\WINDOWS\system32\duriguhu
C:\WINDOWS\system32\fahokipa.dll 

:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

xxjoliet

Post #5March 30, 2010, 11:10 PM UTC

Attached are the 2 documents you requested. Thanks again.

Attachments:

Essexboy

Post #6March 31, 2010, 7:45 PM UTC

Are you still getting the popups ?

Update MBAM
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

xxjoliet

Post #7April 1, 2010, 2:01 PM UTC

No more popups are occurring. When I initially tried to run MBAM it did not work but I uninstalled it, reinstalled it, and updated it - and now it works. Here is the log for that: Malwarebytes' Anti-Malware 1.45 www.malwarebytes.org Database version: 3941 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 4/1/2010 10:00:29 AM mbam-log-2010-04-01 (10-00-29).txt Scan type: Quick scan Objects scanned: 109855 Time elapsed: 8 minute(s), 18 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 2 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faborolor (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ladowetobo (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Essexboy

Post #8April 1, 2010, 7:43 PM UTC

OK that looks good - what problems are you having at the moment ?

xxjoliet

Post #9April 2, 2010, 4:33 PM UTC

No more problems at the moment. Popups seemed to have resolved and MBAM runs just fine. Seems to be all cleaned up! Thank you!

Essexboy

Post #10April 2, 2010, 5:59 PM UTC

I will remove my tools now and give some recommendations, but I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day —– Your log now appears clean

A good workman always cleans up after himself so..Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself. MBAM can be uninstalled via control panel add/remove along with ERUNT. But they may be useful tools to keep

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Do not show hidden files and folders.
Click Yes to confirm.
Click OK.

XP
Now to get you off to a good start we will clean your restore points so that all the bad stuff is gone for good. Then if you need to restore at some stage you will be clean. There are several ways to reset your restore points, but this is my method:

Select Start > All Programs > Accessories > System tools > System Restore.
On the dialogue box that appears select Create a Restore Point
Click NEXT
Enter a name e.g. Clean
Click CREATE

You now have a clean restore point, to get rid of the bad ones:

Select Start > All Programs > Accessories > System tools > Disk Cleanup.
In the Drop down box that appears select your main drive e.g. C
Click OK
The System will do some calculation and the display a dialogue box with TABS
Select the More Options Tab.
At the bottom will be a system restore box with a CLEANUP button click this
Accept the Warning and select OK again, the program will close and you are done

SPRING CLEAN

Download TFC to your desktop

Open the file and close any other windows.
It will close all programs itself when run, make sure to let it run uninterrupted.
Click the Start button to begin the process. The program should not take long to finish its job
Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

THEN

Download Flush Flash from Here and follow the easy to use instructions on the same page

NEXT

Download and run Puran Disc Defragmenter

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

SpywareBlaster to help prevent spyware from installing in the first place.
[external image: Posted Image] Malwarebytes. Run weekly to keep your system clean

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?
Keep safe

Essexboy

Post #11April 3, 2010, 6:37 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

[Resolved] Nexplore popups & disabled Malwarebytes

✨ Ask AI

Ask AI