[Resolved] Computer freezes, google redirects

tad ghostal Topic Starter

Post #1April 25, 2010, 1:02 PM UTC

Sometimes on start up my laptop freezes, it gets to the desktop but before all the icons in the bottom right have appeared it freezes and I have to restart. When it does work there are 2 RUN DLL error messages. Also, Google redirects when I click on a search result. Any help would be greatly appreciated, thanks.

RPMcMurphy

Post #2April 26, 2010, 1:27 PM UTC

Hello tad ghostal and welcome to WhatTheTech. I’ll be happy to look over your log and help you with your issues. It will be very helpful if you follow these guidelines:

Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
Please do not run any scans or install/uninstall any applications without being directed to do so.
Please follow my instructions carefully and in the order they are posted.
Any underlined text in my posts indicates a clickable link.
You should print any instructions I give you for ease of use and reference.
If you have any questions at all, please stop and ask before proceeding.

🖼Click to load external image (Posted Image) Please download DDS by sUBs from one of the following links and save it to your desktop.

- DDS.scr
- DDS.pif
Disable any script blocking protection (How to Disable your Security Programs)
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.

—————————————————

Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

🖼Click to load external image (Posted Image) Download GMER Rootkit Scanner from here to your desktop.

Double click the exe file. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

==========================================
🖼Click to load external image (Posted Image) Try running GMER again for me

Make sure that your security software is disabled
Uncheck the box next to "Files" this time also
If you still can't run it, try in the safe mode (instructions below)

Follow these steps to reboot your computer into the Safe Mode:

Restart the computer.
As soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
Use the arrow keys to select the Safe mode menu item
Press Enter.

Please include the following in your next post:

DDS.txt and Attach.txt logs

GMER log

tad ghostal

Post #3April 28, 2010, 3:50 PM UTC

DDS log

DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 22:16:06.79 on 27/04/2010
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.2038.1382 [GMT 1:00]

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hotspot Shield\bin\hsswd.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hotspot Shield\bin\openvpntray.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Documents and Settings\User\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://uk.ask.com?o=15153&l;=dis
uSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_GB&c;=Q306&bd;=pavilion&pf;=laptop
uWindow Title = Internet Explorer Provided By Sky Broadband
uDefault_Page_URL = hxxp://www.sky.com
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=EN_GB&c;=Q306&bd;=pavilion&pf;=laptop
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=EN_GB&c;=Q306&bd;=pavilion&pf;=laptop
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\windows\system32\sdra64.exe,
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: Hotspot Shield Class: {f9e4a054-e9b1-4bc3-83a3-76a1ae736170} - c:\program files\hotspot shield\hssie\HssIE.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
uRun: [notepad] rundll32.exe c:\docume~1\locals~1\ntload.dll,_IWMPEvents@0
uRun: [Google Update] "c:\documents and settings\user\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe
mRun: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe
mRun: [RecGuard] c:\windows\sminst\RecGuard.exe
mRun: [H2O] c:\program files\syncrosoft\pos\h2o\cledx.exe
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [notepad] rundll32.exe c:\windows\system32\notepad.dll,_IWMPEvents@0
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\user\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\docume~1\user\startm~1\programs\startup\scandisk.lnk - c:\windows\system32\rundll32.exe
StartupFolder: c:\docume~1\user\startm~1\programs\startup\traffi~1.lnk - c:\program files\trafficcounter\TrafficCounter.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpphot~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
mPolicies-system: EnableLUA = 0 (0x0)
dPolicies-explorer: DisallowRun = 1 (0x1)
dPolicies-disallowrun: 1 = firefox.exe
dPolicies-disallowrun: 2 = opera.exe
dPolicies-disallowrun: 3 = chrome.exe
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~3\office10\EXCEL.EXE/3000
IE: {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {7F9DB11C-E358-4ca6-A83D-ACC663939424} - {9999A076-A9E2-4C99-8A2B-632FC9429223} - c:\program files\bonjour\ExplorerPlugin.dll
DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: {2F5D4F61-AEA9-4985-B0B9-2E57610D4CCA} = 93.188.162.100,93.188.166.43
TCP: {51889936-1C74-4EA3-84B2-19E6E9092993} = [removed],[removed]
TCP: {5E903B70-0FA7-4254-973B-C5433594C9CE} = [removed],[removed]
TCP: {9FBCC126-DB88-430B-9955-3C1A411D238B} = 93.188.162.100,93.188.166.43
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxdev.dll
LSA: Notification Packages = scecli dmocafr.dll
IFEO: RapportMgmtService.exe - ZASRAKOMONDOHUI31338.EXE
IFEO: RapportService.exe - ZASRAKOMONDOHUI31338.EXE

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\user\applic~1\mozilla\firefox\profiles\qc9jhu0z.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo.co.uk
FF - prefs.js: browser.startup.homepage - hxxp://uk.ask.com/?o=312&l;=dir
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe;=UTF-8&sourceid;=navclient&gfns;=1&q;=
FF - plugin: c:\documents and settings\user\application data\mozilla\firefox\profiles\qc9jhu0z.default\extensions\[removed]\plugins\npTVUAx.dll
FF - plugin: c:\documents and settings\user\local settings\application data\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - HiddenExtension: XULRunner: {5FEE9289-6ABD-4D55-9421-BF8C56AAAD90} - c:\documents and settings\user\local settings\application data\{5FEE9289-6ABD-4D55-9421-BF8C56AAAD90}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-6-5 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-8-14 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-8-14 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-8-14 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-8-14 297752]
R2 HssWd;Hotspot Shield Monitoring Service;c:\program files\hotspot shield\bin\hsswd.exe [2010-1-9 285744]
R2 NIHardwareService;NIHardwareService;c:\program files\common files\native instruments\hardware\NIHardwareService.exe [2009-12-8 3616768]
R3 automap;Automap MIDI Driver Service;c:\windows\system32\drivers\automap.sys [2008-12-15 7168]
R3 CLEDX;Team H2O CLEDX service;c:\windows\system32\drivers\cledx.sys [2008-2-26 33792]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 951632]
S3 NvnUsbAudio;Novation USB Audio Driver;c:\windows\system32\drivers\nvnusbaudio.sys [2008-12-15 31232]

=============== Created Last 30 ================

2010-04-09 01:07:47 0 d—–w- c:\docume~1\user\applic~1\TVU Networks
2010-03-29 19:48:58 0 d—–w- c:\docume~1\user\applic~1\codeblocks
2010-03-29 19:48:35 0 d—–w- c:\program files\CodeBlocks

==================== Find3M ====================

2010-04-19 12:12:36 65280 —-a-w- c:\docume~1\user\applic~1\GDIPFONTCACHEV1.DAT
2010-01-31 20:53:43 411368 —-a-w- c:\windows\system32\deploytk.dll
2008-11-19 21:56:22 22 –sha-w- c:\windows\sminst\HPCD.sys

============= FINISH: 22:16:36.17 ===============

Gmer log

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-28 16:42:51
Windows 5.1.2600 Service Pack 3
Running: x5bi9wn4.exe; Driver: C:\DOCUME~1\User\LOCALS~1\Temp\aglyqfog.sys

—- System - GMER 1.0.15 —-

SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xF74F787E]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xF74F7C10]

Code 89995578 ZwEnumerateKey
Code 89993C00 ZwFlushInstructionCache
Code 89B3DB06 IofCallDriver
Code 8963C716 IofCompleteRequest

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!IofCallDriver 804EF1A6 5 Bytes JMP 89B3DB0B
.text ntkrnlpa.exe!IofCompleteRequest 804EF236 5 Bytes JMP 8963C71B
PAGE ntkrnlpa.exe!ZwFlushInstructionCache 805B6812 5 Bytes JMP 89993C04
PAGE ntkrnlpa.exe!ZwEnumerateKey 80623FF0 5 Bytes JMP 8999557C

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001340AE
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00133E67
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0013405A
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00133FC5
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0014572E
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001405E3
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00140552
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001405B4
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0014061F
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00145863
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00141924
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00141958
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00141975
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00133909
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00147D78
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00147CA6
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00147DB7
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00147D10
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00147CC8
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00147D55
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00147D32
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00147C84
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[128] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00147CEC
.text C:\WINDOWS\system32\spoolsv.exe[264] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00A240AE
.text C:\WINDOWS\system32\spoolsv.exe[264] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00A23E67
.text C:\WINDOWS\system32\spoolsv.exe[264] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 00A2405A
.text C:\WINDOWS\system32\spoolsv.exe[264] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00A23FC5
.text C:\WINDOWS\system32\spoolsv.exe[264] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 00A3572E
.text C:\WINDOWS\system32\spoolsv.exe[264] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 00A305E3
.text C:\WINDOWS\system32\spoolsv.exe[264] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00A30552
.text C:\WINDOWS\system32\spoolsv.exe[264] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 00A305B4
.text C:\WINDOWS\system32\spoolsv.exe[264] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 00A3061F
.text C:\WINDOWS\system32\spoolsv.exe[264] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00A35863
.text C:\WINDOWS\system32\spoolsv.exe[264] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00A31924
.text C:\WINDOWS\system32\spoolsv.exe[264] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00A31958
.text C:\WINDOWS\system32\spoolsv.exe[264] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00A31975
.text C:\WINDOWS\system32\spoolsv.exe[264] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00A23909
.text C:\WINDOWS\system32\spoolsv.exe[264] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00A37D78
.text C:\WINDOWS\system32\spoolsv.exe[264] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00A37CA6
.text C:\WINDOWS\system32\spoolsv.exe[264] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00A37DB7
.text C:\WINDOWS\system32\spoolsv.exe[264] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00A37D10
.text C:\WINDOWS\system32\spoolsv.exe[264] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00A37CC8
.text C:\WINDOWS\system32\spoolsv.exe[264] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00A37D55
.text C:\WINDOWS\system32\spoolsv.exe[264] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00A37D32
.text C:\WINDOWS\system32\spoolsv.exe[264] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00A37C84
.text C:\WINDOWS\system32\spoolsv.exe[264] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00A37CEC
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001340AE
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00133E67
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0013405A
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00133FC5
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0014572E
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001405E3
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00140552
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001405B4
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0014061F
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00145863
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00141924
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00141958
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00141975
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00133909
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00147D78
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00147CA6
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00147DB7
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00147D10
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00147CC8
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00147D55
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00147D32
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00147C84
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[344] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00147CEC
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001440AE
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00143E67
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0014405A
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00143FC5
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0015572E
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001505E3
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00150552
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001505B4
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0015061F
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00155863
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00151924
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00151958
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00151975
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00143909
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00157D78
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00157CA6
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00157DB7
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00157D10
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00157CC8
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00157D55
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00157D32
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00157C84
.text C:\PROGRA~1\AVG\AVG8\avgtray.exe[376] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00157CEC
.text C:\WINDOWS\system32\svchost.exe[508] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 006540AE
.text C:\WINDOWS\system32\svchost.exe[508] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00653E67
.text C:\WINDOWS\system32\svchost.exe[508] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0065405A
.text C:\WINDOWS\system32\svchost.exe[508] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00653FC5
.text C:\WINDOWS\system32\svchost.exe[508] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0066572E
.text C:\WINDOWS\system32\svchost.exe[508] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 006605E3
.text C:\WINDOWS\system32\svchost.exe[508] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00660552
.text C:\WINDOWS\system32\svchost.exe[508] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 006605B4
.text C:\WINDOWS\system32\svchost.exe[508] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0066061F
.text C:\WINDOWS\system32\svchost.exe[508] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00665863
.text C:\WINDOWS\system32\svchost.exe[508] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00667D78
.text C:\WINDOWS\system32\svchost.exe[508] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00667CA6
.text C:\WINDOWS\system32\svchost.exe[508] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00667DB7
.text C:\WINDOWS\system32\svchost.exe[508] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00667D10
.text C:\WINDOWS\system32\svchost.exe[508] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00667CC8
.text C:\WINDOWS\system32\svchost.exe[508] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00667D55
.text C:\WINDOWS\system32\svchost.exe[508] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00667D32
.text C:\WINDOWS\system32\svchost.exe[508] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00667C84
.text C:\WINDOWS\system32\svchost.exe[508] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00667CEC
.text C:\WINDOWS\system32\svchost.exe[508] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00653909
.text C:\WINDOWS\system32\svchost.exe[508] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00661924
.text C:\WINDOWS\system32\svchost.exe[508] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00661958
.text C:\WINDOWS\system32\svchost.exe[508] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00661975
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 033940AE
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 03393E67
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0339405A
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 03393FC5
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 033A572E
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 033A05E3
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 033A0552
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 033A05B4
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 033A061F
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 033A5863
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 033A1924
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] WS2_32.dll!send 71AB4C27 5 Bytes JMP 033A1958
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 033A1975
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 03393909
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 033A7D78
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 033A7CA6
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 033A7DB7
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 033A7D10
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 033A7CC8
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 033A7D55
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 033A7D32
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 033A7C84
.text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[556] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 033A7CEC
.text C:\WINDOWS\Explorer.EXE[564] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 01EB40AE
.text C:\WINDOWS\Explorer.EXE[564] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 01EB3E67
.text C:\WINDOWS\Explorer.EXE[564] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 01EB405A
.text C:\WINDOWS\Explorer.EXE[564] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 01EB3FC5
.text C:\WINDOWS\Explorer.EXE[564] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 01EC572E
.text C:\WINDOWS\Explorer.EXE[564] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 01EC05E3
.text C:\WINDOWS\Explorer.EXE[564] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 01EC0552
.text C:\WINDOWS\Explorer.EXE[564] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 01EC05B4
.text C:\WINDOWS\Explorer.EXE[564] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 01EC061F
.text C:\WINDOWS\Explorer.EXE[564] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 01EC5863
.text C:\WINDOWS\Explorer.EXE[564] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 01EB3909
.text C:\WINDOWS\Explorer.EXE[564] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 01EC7D78
.text C:\WINDOWS\Explorer.EXE[564] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 01EC7CA6
.text C:\WINDOWS\Explorer.EXE[564] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 01EC7DB7
.text C:\WINDOWS\Explorer.EXE[564] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 01EC7D10
.text C:\WINDOWS\Explorer.EXE[564] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 01EC7CC8
.text C:\WINDOWS\Explorer.EXE[564] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 01EC7D55
.text C:\WINDOWS\Explorer.EXE[564] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 01EC7D32
.text C:\WINDOWS\Explorer.EXE[564] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 01EC7C84
.text C:\WINDOWS\Explorer.EXE[564] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 01EC7CEC
.text C:\WINDOWS\Explorer.EXE[564] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 01EC1924
.text C:\WINDOWS\Explorer.EXE[564] WS2_32.dll!send 71AB4C27 5 Bytes JMP 01EC1958
.text C:\WINDOWS\Explorer.EXE[564] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 01EC1975
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 008240AE
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00823E67
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0082405A
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00823FC5
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00831924
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00831958
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00831975
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0083572E
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 008305E3
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00830552
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 008305B4
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0083061F
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00835863
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00823909
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00837D78
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00837CA6
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00837DB7
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00837D10
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00837CC8
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00837D55
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00837D32
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00837C84
.text C:\Program Files\Bonjour\mDNSResponder.exe[580] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00837CEC
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00B040AE
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00B03E67
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 00B0405A
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00B03FC5
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] WS2_32.DLL!closesocket 71AB3E2B 5 Bytes JMP 00B11924
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] WS2_32.DLL!send 71AB4C27 5 Bytes JMP 00B11958
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] WS2_32.DLL!WSASend 71AB68FA 5 Bytes JMP 00B11975
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 00B1572E
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 00B105E3
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00B10552
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 00B105B4
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 00B1061F
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00B15863
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00B03909
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00B17D78
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00B17CA6
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00B17DB7
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00B17D10
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00B17CC8
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00B17D55
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00B17D32
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00B17C84
.text C:\Program Files\Hotspot Shield\bin\openvpnas.exe[636] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00B17CEC
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001440AE
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00143E67
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0014405A
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00143FC5
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0015572E
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001505E3
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00150552
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001505B4
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0015061F
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00155863
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00151924
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00151958
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00151975
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00143909
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00157D78
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00157CA6
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00157DB7
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00157D10
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00157CC8
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00157D55
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00157D32
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00157C84
.text C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe[712] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00157CEC
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00C640AE
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00C63E67
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 00C6405A
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00C63FC5
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00C71924
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00C71958
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00C71975
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 00C7572E
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 00C705E3
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00C70552
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 00C705B4
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 00C7061F
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00C75863
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00C63909
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00C77D78
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00C77CA6
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00C77DB7
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00C77D10
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00C77CC8
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00C77D55
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00C77D32
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00C77C84
.text C:\PROGRA~1\AVG\AVG8\avgnsx.exe[816] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00C77CEC
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 000840AE
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00083E67
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0008405A
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00083FC5
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0009572E
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 000905E3
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00090552
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 000905B4
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0009061F
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00095863
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00091924
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00091958
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00091975
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00083909
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00097D78
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00097CA6
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00097DB7
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00097D10
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00097CC8
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00097D55
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00097D32
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00097C84
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[840] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00097CEC
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001340AE
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00133E67
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0013405A
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00133FC5
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00141924
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00141958
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00141975
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0014572E
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001405E3
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00140552
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001405B4
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0014061F
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00145863
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00147D78
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00147CA6
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00147DB7
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00147D10
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00147CC8
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00147D55
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00147D32
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00147C84
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00147CEC
.text C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe[896] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00133909
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001440AE
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00143E67
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0014405A
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00143FC5
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0015572E
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001505E3
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00150552
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001505B4
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0015061F
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00155863
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00157D78
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00157CA6
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00157DB7
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00157D10
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00157CC8
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00157D55
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00157D32
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00157C84
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00157CEC
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00143909
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00151924
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00151958
.text C:\Program Files\Java\jre6\bin\jusched.exe[928] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00151975
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001340AE
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00133E67
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0013405A
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00133FC5
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00141924
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00141958
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00141975
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0014572E
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001405E3
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00140552
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001405B4
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0014061F
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00145863
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00133909
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00147D78
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00147CA6
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00147DB7
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00147D10
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00147CC8
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00147D55
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00147D32
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00147C84
.text C:\Program Files\Hotspot Shield\bin\hsswd.exe[976] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00147CEC
.text C:\WINDOWS\System32\alg.exe[996] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 000840AE
.text C:\WINDOWS\System32\alg.exe[996] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00083E67
.text C:\WINDOWS\System32\alg.exe[996] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0008405A
.text C:\WINDOWS\System32\alg.exe[996] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00083FC5
.text C:\WINDOWS\System32\alg.exe[996] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0009572E
.text C:\WINDOWS\System32\alg.exe[996] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 000905E3
.text C:\WINDOWS\System32\alg.exe[996] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00090552
.text C:\WINDOWS\System32\alg.exe[996] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 000905B4
.text C:\WINDOWS\System32\alg.exe[996] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0009061F
.text C:\WINDOWS\System32\alg.exe[996] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00095863
.text C:\WINDOWS\System32\alg.exe[996] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00091924
.text C:\WINDOWS\System32\alg.exe[996] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00091958
.text C:\WINDOWS\System32\alg.exe[996] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00091975
.text C:\WINDOWS\System32\alg.exe[996] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00083909
.text C:\WINDOWS\System32\alg.exe[996] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00097D78
.text C:\WINDOWS\System32\alg.exe[996] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00097CA6
.text C:\WINDOWS\System32\alg.exe[996] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00097DB7
.text C:\WINDOWS\System32\alg.exe[996] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00097D10
.text C:\WINDOWS\System32\alg.exe[996] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00097CC8
.text C:\WINDOWS\System32\alg.exe[996] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00097D55
.text C:\WINDOWS\System32\alg.exe[996] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00097D32
.text C:\WINDOWS\System32\alg.exe[996] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00097C84
.text C:\WINDOWS\System32\alg.exe[996] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00097CEC
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001340AE
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00133E67
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0013405A
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00133FC5
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00141924
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00141958
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00141975
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0014572E
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001405E3
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00140552
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001405B4
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0014061F
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00145863
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00133909
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00147D78
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00147CA6
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00147DB7
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00147D10
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00147CC8
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00147D55
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00147D32
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00147C84
.text C:\Program Files\Java\jre6\bin\jqs.exe[1052] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00147CEC
.text C:\WINDOWS\system32\services.exe[1264] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00E840AE
.text C:\WINDOWS\system32\services.exe[1264] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00E83E67
.text C:\WINDOWS\system32\services.exe[1264] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 00E8405A
.text C:\WINDOWS\system32\services.exe[1264] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00E83FC5
.text C:\WINDOWS\system32\services.exe[1264] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 00E9572E
.text C:\WINDOWS\system32\services.exe[1264] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 00E905E3
.text C:\WINDOWS\system32\services.exe[1264] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00E90552
.text C:\WINDOWS\system32\services.exe[1264] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 00E905B4
.text C:\WINDOWS\system32\services.exe[1264] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 00E9061F
.text C:\WINDOWS\system32\services.exe[1264] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00E95863
.text C:\WINDOWS\system32\services.exe[1264] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00E91924
.text C:\WINDOWS\system32\services.exe[1264] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00E91958
.text C:\WINDOWS\system32\services.exe[1264] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00E91975
.text C:\WINDOWS\system32\services.exe[1264] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00E83909
.text C:\WINDOWS\system32\services.exe[1264] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00E97D78
.text C:\WINDOWS\system32\services.exe[1264] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00E97CA6
.text C:\WINDOWS\system32\services.exe[1264] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00E97DB7
.text C:\WINDOWS\system32\services.exe[1264] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00E97D10
.text C:\WINDOWS\system32\services.exe[1264] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00E97CC8
.text C:\WINDOWS\system32\services.exe[1264] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00E97D55
.text C:\WINDOWS\system32\services.exe[1264] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00E97D32
.text C:\WINDOWS\system32\services.exe[1264] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00E97C84
.text C:\WINDOWS\system32\services.exe[1264] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00E97CEC
.text C:\WINDOWS\system32\lsass.exe[1276] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00F740AE
.text C:\WINDOWS\system32\lsass.exe[1276] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00F73E67
.text C:\WINDOWS\system32\lsass.exe[1276] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 00F7405A
.text C:\WINDOWS\system32\lsass.exe[1276] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00F73FC5
.text C:\WINDOWS\system32\lsass.exe[1276] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 00F8572E
.text C:\WINDOWS\system32\lsass.exe[1276] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 00F805E3
.text C:\WINDOWS\system32\lsass.exe[1276] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00F80552
.text C:\WINDOWS\system32\lsass.exe[1276] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 00F805B4
.text C:\WINDOWS\system32\lsass.exe[1276] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 00F8061F
.text C:\WINDOWS\system32\lsass.exe[1276] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00F85863
.text C:\WINDOWS\system32\lsass.exe[1276] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00F81924
.text C:\WINDOWS\system32\lsass.exe[1276] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00F81958
.text C:\WINDOWS\system32\lsass.exe[1276] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00F81975
.text C:\WINDOWS\system32\lsass.exe[1276] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00F73909
.text C:\WINDOWS\system32\lsass.exe[1276] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00F87D78
.text C:\WINDOWS\system32\lsass.exe[1276] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00F87CA6
.text C:\WINDOWS\system32\lsass.exe[1276] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00F87DB7
.text C:\WINDOWS\system32\lsass.exe[1276] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00F87D10
.text C:\WINDOWS\system32\lsass.exe[1276] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00F87CC8
.text C:\WINDOWS\system32\lsass.exe[1276] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00F87D55
.text C:\WINDOWS\system32\lsass.exe[1276] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00F87D32
.text C:\WINDOWS\system32\lsass.exe[1276] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00F87C84
.text C:\WINDOWS\system32\lsass.exe[1276] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00F87CEC
.text C:\WINDOWS\system32\svchost.exe[1452] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00C03E67
.text C:\WINDOWS\system32\svchost.exe[1532] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00C440AE
.text C:\WINDOWS\system32\svchost.exe[1532] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00C43E67
.text C:\WINDOWS\system32\svchost.exe[1532] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 00C4405A
.text C:\WINDOWS\system32\svchost.exe[1532] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00C43FC5
.text C:\WINDOWS\system32\svchost.exe[1532] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 00C5572E
.text C:\WINDOWS\system32\svchost.exe[1532] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 00C505E3
.text C:\WINDOWS\system32\svchost.exe[1532] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00C50552
.text C:\WINDOWS\system32\svchost.exe[1532] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 00C505B4
.text C:\WINDOWS\system32\svchost.exe[1532] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 00C5061F
.text C:\WINDOWS\system32\svchost.exe[1532] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00C55863
.text C:\WINDOWS\system32\svchost.exe[1532] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00C51924
.text C:\WINDOWS\system32\svchost.exe[1532] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00C51958
.text C:\WINDOWS\system32\svchost.exe[1532] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00C51975
.text C:\WINDOWS\system32\svchost.exe[1532] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00C43909
.text C:\WINDOWS\system32\svchost.exe[1532] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00C57D78
.text C:\WINDOWS\system32\svchost.exe[1532] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00C57CA6
.text C:\WINDOWS\system32\svchost.exe[1532] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00C57DB7
.text C:\WINDOWS\system32\svchost.exe[1532] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00C57D10
.text C:\WINDOWS\system32\svchost.exe[1532] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00C57CC8
.text C:\WINDOWS\system32\svchost.exe[1532] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00C57D55
.text C:\WINDOWS\system32\svchost.exe[1532] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00C57D32
.text C:\WINDOWS\system32\svchost.exe[1532] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00C57C84
.text C:\WINDOWS\system32\svchost.exe[1532] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00C57CEC
.text C:\WINDOWS\System32\svchost.exe[1572] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 021440AE
.text C:\WINDOWS\System32\svchost.exe[1572] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 02143E67
.text C:\WINDOWS\System32\svchost.exe[1572] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0214405A
.text C:\WINDOWS\System32\svchost.exe[1572] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 02143FC5
.text C:\WINDOWS\System32\svchost.exe[1572] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0215572E
.text C:\WINDOWS\System32\svchost.exe[1572] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 021505E3
.text C:\WINDOWS\System32\svchost.exe[1572] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 02150552
.text C:\WINDOWS\System32\svchost.exe[1572] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 021505B4
.text C:\WINDOWS\System32\svchost.exe[1572] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0215061F
.text C:\WINDOWS\System32\svchost.exe[1572] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 02155863
.text C:\WINDOWS\System32\svchost.exe[1572] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 02151924
.text C:\WINDOWS\System32\svchost.exe[1572] WS2_32.dll!send 71AB4C27 5 Bytes JMP 02151958
.text C:\WINDOWS\System32\svchost.exe[1572] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 02151975
.text C:\WINDOWS\System32\svchost.exe[1572] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 02143909
.text C:\WINDOWS\System32\svchost.exe[1572] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 02157D78
.text C:\WINDOWS\System32\svchost.exe[1572] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 02157CA6
.text C:\WINDOWS\System32\svchost.exe[1572] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 02157DB7
.text C:\WINDOWS\System32\svchost.exe[1572] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 02157D10
.text C:\WINDOWS\System32\svchost.exe[1572] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 02157CC8
.text C:\WINDOWS\System32\svchost.exe[1572] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 02157D55
.text C:\WINDOWS\System32\svchost.exe[1572] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 02157D32
.text C:\WINDOWS\System32\svchost.exe[1572] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 02157C84
.text C:\WINDOWS\System32\svchost.exe[1572] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 02157CEC
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001440AE
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00143E67
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0014405A
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00143FC5
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0015572E
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001505E3
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00150552
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001505B4
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0015061F
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00155863
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00151924
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00151958
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00151975
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00143909
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00157D78
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00157CA6
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00157DB7
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00157D10
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00157CC8
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00157D55
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00157D32
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00157C84
.text C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe[1620] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00157CEC
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001340AE
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00133E67
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0013405A
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00133FC5
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0014572E
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001405E3
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00140552
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001405B4
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0014061F
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00145863
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00141924
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00141958
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00141975
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00133909
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00147D78
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00147CA6
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00147DB7
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00147D10
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00147CC8
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00147D55
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00147D32
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00147C84
.text C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe[1644] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00147CEC
.text C:\WINDOWS\system32\igfxtray.exe[1676] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001440AE
.text C:\WINDOWS\system32\igfxtray.exe[1676] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00143E67
.text C:\WINDOWS\system32\igfxtray.exe[1676] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0014405A
.text C:\WINDOWS\system32\igfxtray.exe[1676] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00143FC5
.text C:\WINDOWS\system32\igfxtray.exe[1676] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0015572E
.text C:\WINDOWS\system32\igfxtray.exe[1676] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001505E3
.text C:\WINDOWS\system32\igfxtray.exe[1676] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00150552
.text C:\WINDOWS\system32\igfxtray.exe[1676] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001505B4
.text C:\WINDOWS\system32\igfxtray.exe[1676] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0015061F
.text C:\WINDOWS\system32\igfxtray.exe[1676] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00155863
.text C:\WINDOWS\system32\igfxtray.exe[1676] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00151924
.text C:\WINDOWS\system32\igfxtray.exe[1676] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00151958
.text C:\WINDOWS\system32\igfxtray.exe[1676] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00151975
.text C:\WINDOWS\system32\igfxtray.exe[1676] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00143909
.text C:\WINDOWS\system32\igfxtray.exe[1676] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00157D78
.text C:\WINDOWS\system32\igfxtray.exe[1676] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00157CA6
.text C:\WINDOWS\system32\igfxtray.exe[1676] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00157DB7
.text C:\WINDOWS\system32\igfxtray.exe[1676] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00157D10
.text C:\WINDOWS\system32\igfxtray.exe[1676] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00157CC8
.text C:\WINDOWS\system32\igfxtray.exe[1676] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00157D55
.text C:\WINDOWS\system32\igfxtray.exe[1676] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00157D32
.text C:\WINDOWS\system32\igfxtray.exe[1676] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00157C84
.text C:\WINDOWS\system32\igfxtray.exe[1676] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00157CEC
.text C:\WINDOWS\system32\hkcmd.exe[1732] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001440AE
.text C:\WINDOWS\system32\hkcmd.exe[1732] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00143E67
.text C:\WINDOWS\system32\hkcmd.exe[1732] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0014405A
.text C:\WINDOWS\system32\hkcmd.exe[1732] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00143FC5
.text C:\WINDOWS\system32\hkcmd.exe[1732] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0015572E
.text C:\WINDOWS\system32\hkcmd.exe[1732] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001505E3
.text C:\WINDOWS\system32\hkcmd.exe[1732] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00150552
.text C:\WINDOWS\system32\hkcmd.exe[1732] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001505B4
.text C:\WINDOWS\system32\hkcmd.exe[1732] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0015061F
.text C:\WINDOWS\system32\hkcmd.exe[1732] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00155863
.text C:\WINDOWS\system32\hkcmd.exe[1732] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00151924
.text C:\WINDOWS\system32\hkcmd.exe[1732] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00151958
.text C:\WINDOWS\system32\hkcmd.exe[1732] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00151975
.text C:\WINDOWS\system32\hkcmd.exe[1732] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00143909
.text C:\WINDOWS\system32\hkcmd.exe[1732] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00157D78
.text C:\WINDOWS\system32\hkcmd.exe[1732] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00157CA6
.text C:\WINDOWS\system32\hkcmd.exe[1732] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00157DB7
.text C:\WINDOWS\system32\hkcmd.exe[1732] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00157D10
.text C:\WINDOWS\system32\hkcmd.exe[1732] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00157CC8
.text C:\WINDOWS\system32\hkcmd.exe[1732] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00157D55
.text C:\WINDOWS\system32\hkcmd.exe[1732] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00157D32
.text C:\WINDOWS\system32\hkcmd.exe[1732] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00157C84
.text C:\WINDOWS\system32\hkcmd.exe[1732] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00157CEC
.text C:\WINDOWS\system32\svchost.exe[1748] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 006540AE
.text C:\WINDOWS\system32\svchost.exe[1748] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00653E67
.text C:\WINDOWS\system32\svchost.exe[1748] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0065405A
.text C:\WINDOWS\system32\svchost.exe[1748] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00653FC5
.text C:\WINDOWS\system32\svchost.exe[1748] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0066572E
.text C:\WINDOWS\system32\svchost.exe[1748] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 006605E3
.text C:\WINDOWS\system32\svchost.exe[1748] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00660552
.text C:\WINDOWS\system32\svchost.exe[1748] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 006605B4
.text C:\WINDOWS\system32\svchost.exe[1748] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0066061F
.text C:\WINDOWS\system32\svchost.exe[1748] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00665863
.text C:\WINDOWS\system32\svchost.exe[1748] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00661924
.text C:\WINDOWS\system32\svchost.exe[1748] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00661958
.text C:\WINDOWS\system32\svchost.exe[1748] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00661975
.text C:\WINDOWS\system32\svchost.exe[1748] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00653909
.text C:\WINDOWS\system32\svchost.exe[1748] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00667D78
.text C:\WINDOWS\system32\svchost.exe[1748] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00667CA6
.text C:\WINDOWS\system32\svchost.exe[1748] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00667DB7
.text C:\WINDOWS\system32\svchost.exe[1748] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00667D10
.text C:\WINDOWS\system32\svchost.exe[1748] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00667CC8
.text C:\WINDOWS\system32\svchost.exe[1748] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00667D55
.text C:\WINDOWS\system32\svchost.exe[1748] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00667D32
.text C:\WINDOWS\system32\svchost.exe[1748] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00667C84
.text C:\WINDOWS\system32\svchost.exe[1748] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00667CEC
.text C:\WINDOWS\system32\svchost.exe[1784] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00A040AE
.text C:\WINDOWS\system32\svchost.exe[1784] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00A03E67
.text C:\WINDOWS\system32\svchost.exe[1784] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 00A0405A
.text C:\WINDOWS\system32\svchost.exe[1784] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00A03FC5
.text C:\WINDOWS\system32\svchost.exe[1784] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 00A1572E
.text C:\WINDOWS\system32\svchost.exe[1784] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 00A105E3
.text C:\WINDOWS\system32\svchost.exe[1784] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00A10552
.text C:\WINDOWS\system32\svchost.exe[1784] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 00A105B4
.text C:\WINDOWS\system32\svchost.exe[1784] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 00A1061F
.text C:\WINDOWS\system32\svchost.exe[1784] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00A15863
.text C:\WINDOWS\system32\svchost.exe[1784] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00A11924
.text C:\WINDOWS\system32\svchost.exe[1784] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00A11958
.text C:\WINDOWS\system32\svchost.exe[1784] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00A11975
.text C:\WINDOWS\system32\svchost.exe[1784] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00A03909
.text C:\WINDOWS\system32\svchost.exe[1784] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00A17D78
.text C:\WINDOWS\system32\svchost.exe[1784] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00A17CA6
.text C:\WINDOWS\system32\svchost.exe[1784] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00A17DB7
.text C:\WINDOWS\system32\svchost.exe[1784] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00A17D10
.text C:\WINDOWS\system32\svchost.exe[1784] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00A17CC8
.text C:\WINDOWS\system32\svchost.exe[1784] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00A17D55
.text C:\WINDOWS\system32\svchost.exe[1784] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00A17D32
.text C:\WINDOWS\system32\svchost.exe[1784] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00A17C84
.text C:\WINDOWS\system32\svchost.exe[1784] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00A17CEC
.text C:\WINDOWS\system32\wdfmgr.exe[1844] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 000740AE
.text C:\WINDOWS\system32\wdfmgr.exe[1844] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00073E67
.text C:\WINDOWS\system32\wdfmgr.exe[1844] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0007405A
.text C:\WINDOWS\system32\wdfmgr.exe[1844] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00073FC5
.text C:\WINDOWS\system32\wdfmgr.exe[1844] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0008572E
.text C:\WINDOWS\system32\wdfmgr.exe[1844] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 000805E3
.text C:\WINDOWS\system32\wdfmgr.exe[1844] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00080552
.text C:\WINDOWS\system32\wdfmgr.exe[1844] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 000805B4
.text C:\WINDOWS\system32\wdfmgr.exe[1844] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0008061F
.text C:\WINDOWS\system32\wdfmgr.exe[1844] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00085863
.text C:\WINDOWS\system32\wdfmgr.exe[1844] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00081924
.text C:\WINDOWS\system32\wdfmgr.exe[1844] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00081958
.text C:\WINDOWS\system32\wdfmgr.exe[1844] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00081975
.text C:\WINDOWS\system32\wdfmgr.exe[1844] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00073909
.text C:\WINDOWS\system32\wdfmgr.exe[1844] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00087D78
.text C:\WINDOWS\system32\wdfmgr.exe[1844] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00087CA6
.text C:\WINDOWS\system32\wdfmgr.exe[1844] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00087DB7
.text C:\WINDOWS\system32\wdfmgr.exe[1844] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00087D10
.text C:\WINDOWS\system32\wdfmgr.exe[1844] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00087CC8
.text C:\WINDOWS\system32\wdfmgr.exe[1844] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00087D55
.text C:\WINDOWS\system32\wdfmgr.exe[1844] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00087D32
.text C:\WINDOWS\system32\wdfmgr.exe[1844] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00087C84
.text C:\WINDOWS\system32\wdfmgr.exe[1844] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00087CEC
.text C:\WINDOWS\system32\igfxpers.exe[1868] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001440AE
.text C:\WINDOWS\system32\igfxpers.exe[1868] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00143E67
.text C:\WINDOWS\system32\igfxpers.exe[1868] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0014405A
.text C:\WINDOWS\system32\igfxpers.exe[1868] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00143FC5
.text C:\WINDOWS\system32\igfxpers.exe[1868] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0015572E
.text C:\WINDOWS\system32\igfxpers.exe[1868] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001505E3
.text C:\WINDOWS\system32\igfxpers.exe[1868] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00150552
.text C:\WINDOWS\system32\igfxpers.exe[1868] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001505B4
.text C:\WINDOWS\system32\igfxpers.exe[1868] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0015061F
.text C:\WINDOWS\system32\igfxpers.exe[1868] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00155863
.text C:\WINDOWS\system32\igfxpers.exe[1868] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00151924
.text C:\WINDOWS\system32\igfxpers.exe[1868] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00151958
.text C:\WINDOWS\system32\igfxpers.exe[1868] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00151975
.text C:\WINDOWS\system32\igfxpers.exe[1868] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00143909
.text C:\WINDOWS\system32\igfxpers.exe[1868] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00157D78
.text C:\WINDOWS\system32\igfxpers.exe[1868] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00157CA6
.text C:\WINDOWS\system32\igfxpers.exe[1868] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00157DB7
.text C:\WINDOWS\system32\igfxpers.exe[1868] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00157D10
.text C:\WINDOWS\system32\igfxpers.exe[1868] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00157CC8
.text C:\WINDOWS\system32\igfxpers.exe[1868] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00157D55
.text C:\WINDOWS\system32\igfxpers.exe[1868] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00157D32
.text C:\WINDOWS\system32\igfxpers.exe[1868] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00157C84
.text C:\WINDOWS\system32\igfxpers.exe[1868] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00157CEC
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001440AE
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00143E67
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0014405A
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00143FC5
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0015572E
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001505E3
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00150552
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001505B4
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0015061F
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00155863
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00151924
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00151958
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00151975
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00143909
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00157D78
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00157CA6
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00157DB7
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00157D10
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00157CC8
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00157D55
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00157D32
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00157C84
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1928] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00157CEC
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001440AE
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00143E67
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0014405A
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00143FC5
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0015572E
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001505E3
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00150552
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001505B4
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0015061F
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00155863
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00151924
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00151958
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00151975
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00143909
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00157D78
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00157CA6
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00157DB7
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00157D10
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00157CC8
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00157D55
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00157D32
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00157C84
.text C:\Program Files\HP\QuickPlay\QPService.exe[1988] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00157CEC
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001440AE
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00143E67
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0014405A
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00143FC5
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0015572E
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001505E3
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00150552
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001505B4
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0015061F
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00155863
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00151924
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00151958
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00151975
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00143909
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00157D78
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00157CA6
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00157DB7
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00157D10
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00157CC8
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00157D55
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00157D32
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00157C84
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe[2004] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00157CEC
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001440AE
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00143E67
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0014405A
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00143FC5
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0015572E
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001505E3
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00150552
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001505B4
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0015061F
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00155863
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00151924
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00151958
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00151975
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00143909
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00157D78
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00157CA6
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00157DB7
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00157D10
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00157CC8
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00157D55
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00157D32
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00157C84
.text C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe[2044] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00157CEC
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001440AE
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00143E67
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0014405A
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00143FC5
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0015572E
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001505E3
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00150552
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001505B4
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0015061F
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00155863
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00151924
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00151958
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00151975
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00143909
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00157D78
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00157CA6
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00157DB7
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00157D10
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00157CC8
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00157D55
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00157D32
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00157C84
.text C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE[2160] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00157CEC
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 002340AE
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00233E67
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0023405A
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00233FC5
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] WININET.DLL!InternetCloseHandle 771C4D94 5 Bytes JMP 00247D78
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] WININET.DLL!HttpSendRequestA 771C60A9 5 Bytes JMP 00247CA6
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] WININET.DLL!HttpQueryInfoA 771C79CA 5 Bytes JMP 00247DB7
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] WININET.DLL!InternetReadFile 771C82F2 5 Bytes JMP 00247D10
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] WININET.DLL!HttpSendRequestExW 771CEA01 5 Bytes JMP 00247CC8
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] WININET.DLL!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00247D55
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] WININET.DLL!InternetReadFileExA 771F9230 5 Bytes JMP 00247D32
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] WININET.DLL!HttpSendRequestW 77212FEC 5 Bytes JMP 00247C84
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] WININET.DLL!HttpSendRequestExA 772130F1 5 Bytes JMP 00247CEC
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00233909
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0024572E
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 002405E3
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00240552
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 002405B4
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0024061F
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00245863
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00241924
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00241958
.text C:\Program Files\Hotspot Shield\bin\openvpntray.exe[2180] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00241975
.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[2204] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001440AE
.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[2204] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00143E67
.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[2204] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0014405A
.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[2204] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00143FC5
.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[2204] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0015572E
.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[2204] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001505E3
.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[2204] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00150552
.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[2204] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001505B4
.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[2204] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0015061F
.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[2204] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00155863
.text C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe[2204] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00143909
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001340AE
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00133E67
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0013405A
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00133FC5
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00147D78
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00147CA6
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00147DB7
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00147D10
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00147CC8
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00147D55
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00147D32
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00147C84
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00147CEC
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00133909
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0014572E
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001405E3
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00140552
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001405B4
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0014061F
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00145863
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00141924
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00141958
.text C:\Program Files\AVG\AVG8\avgupd.exe[2268] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00141975
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001440AE
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00143E67
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0014405A
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00143FC5
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0015572E
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001505E3
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00150552
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001505B4
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0015061F
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00155863
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00151924
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00151958
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00151975
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00143909
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00157D78
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00157CA6
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00157DB7
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00157D10
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00157CC8
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00157D55
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00157D32
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00157C84
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[2696] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00157CEC
.text C:\Program Files\OpenOffice.org 3\program\soffice.bin[2736] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 000440AE
.text C:\Program Files\OpenOffice.org 3\program\soffice.bin[2736] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00043E67
.text C:\Program Files\OpenOffice.org 3\program\soffice.bin[2736] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0004405A
.text C:\Program Files\OpenOffice.org 3\program\soffice.bin[2736] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00043FC5
.text C:\Program Files\OpenOffice.org 3\program\soffice.bin[2736] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0005572E
.text C:\Program Files\OpenOffice.org 3\program\soffice.bin[2736] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 000505E3
.text C:\Program Files\OpenOffice.org 3\program\soffice.bin[2736] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00050552
.text C:\Program Files\OpenOffice.org 3\program\soffice.bin[2736] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 000505B4
.text C:\Program Files\OpenOffice.org 3\program\soffice.bin[2736] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0005061F
.text C:\Program Files\OpenOffice.org 3\program\soffice.bin[2736] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00055863
.text C:\Program Files\OpenOffice.org 3\program\soffice.bin[2736] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00051924
.text C:\Program Files\OpenOffice.org 3\program\soffice.bin[2736] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00051958
.text C:\Program Files\OpenOffice.org 3\program\soffice.bin[2736] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00051975
.text C:\Program Files\OpenOffice.org 3\program\soffice.bin[2736] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00043909
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 04E040AE
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 04E03E67
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 04E0405A
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 04E03FC5
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 04E1572E
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 04E105E3
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 04E10552
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 04E105B4
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 04E1061F
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 04E15863
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 04E11924
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] WS2_32.dll!send 71AB4C27 5 Bytes JMP 04E11958
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 04E11975
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 04E03909
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 04E17D78
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 04E17CA6
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 04E17DB7
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 04E17D10
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 04E17CC8
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 04E17D55
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 04E17D32
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 04E17C84
.text C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe[2760] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 04E17CEC
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 001440AE
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00143E67
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0014405A
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00143FC5
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0015572E
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 001505E3
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00150552
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 001505B4
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0015061F
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00155863
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00151924
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00151958
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00151975
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00143909
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00157D78
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00157CA6
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00157DB7
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00157D10
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00157CC8
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00157D55
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00157D32
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00157C84
.text C:\Documents and Settings\User\Desktop\x5bi9wn4.exe[2796] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00157CEC
.text C:\WINDOWS\System32\svchost.exe[3240] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 000840AE
.text C:\WINDOWS\System32\svchost.exe[3240] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00083E67
.text C:\WINDOWS\System32\svchost.exe[3240] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0008405A
.text C:\WINDOWS\System32\svchost.exe[3240] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00083FC5
.text C:\WINDOWS\System32\svchost.exe[3240] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0009572E
.text C:\WINDOWS\System32\svchost.exe[3240] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 000905E3
.text C:\WINDOWS\System32\svchost.exe[3240] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00090552
.text C:\WINDOWS\System32\svchost.exe[3240] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 000905B4
.text C:\WINDOWS\System32\svchost.exe[3240] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0009061F
.text C:\WINDOWS\System32\svchost.exe[3240] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00095863
.text C:\WINDOWS\System32\svchost.exe[3240] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00091924
.text C:\WINDOWS\System32\svchost.exe[3240] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00091958
.text C:\WINDOWS\System32\svchost.exe[3240] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00091975
.text C:\WINDOWS\System32\svchost.exe[3240] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00083909
.text C:\WINDOWS\System32\svchost.exe[3240] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00097D78
.text C:\WINDOWS\System32\svchost.exe[3240] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00097CA6
.text C:\WINDOWS\System32\svchost.exe[3240] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00097DB7
.text C:\WINDOWS\System32\svchost.exe[3240] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00097D10
.text C:\WINDOWS\System32\svchost.exe[3240] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00097CC8
.text C:\WINDOWS\System32\svchost.exe[3240] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00097D55
.text C:\WINDOWS\System32\svchost.exe[3240] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00097D32
.text C:\WINDOWS\System32\svchost.exe[3240] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00097C84
.text C:\WINDOWS\System32\svchost.exe[3240] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00097CEC
.text C:\WINDOWS\system32\wuauclt.exe[3728] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 000840AE
.text C:\WINDOWS\system32\wuauclt.exe[3728] ntdll.dll!NtCreateThread 7C90D1AE 5 Bytes JMP 00083E67
.text C:\WINDOWS\system32\wuauclt.exe[3728] ntdll.dll!NtQueryDirectoryFile 7C90D76E 5 Bytes JMP 0008405A
.text C:\WINDOWS\system32\wuauclt.exe[3728] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00083FC5
.text C:\WINDOWS\system32\wuauclt.exe[3728] USER32.dll!TranslateMessage 7E418BF6 5 Bytes JMP 0009572E
.text C:\WINDOWS\system32\wuauclt.exe[3728] USER32.dll!DefWindowProcW 7E428D20 5 Bytes JMP 000905E3
.text C:\WINDOWS\system32\wuauclt.exe[3728] USER32.dll!BeginPaint 7E428FE9 5 Bytes JMP 00090552
.text C:\WINDOWS\system32\wuauclt.exe[3728] USER32.dll!EndPaint 7E428FFD 5 Bytes JMP 000905B4
.text C:\WINDOWS\system32\wuauclt.exe[3728] USER32.dll!DefWindowProcA 7E42C17E 5 Bytes JMP 0009061F
.text C:\WINDOWS\system32\wuauclt.exe[3728] USER32.dll!GetClipboardData 7E430DBA 5 Bytes JMP 00095863
.text C:\WINDOWS\system32\wuauclt.exe[3728] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00091924
.text C:\WINDOWS\system32\wuauclt.exe[3728] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00091958
.text C:\WINDOWS\system32\wuauclt.exe[3728] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00091975
.text C:\WINDOWS\system32\wuauclt.exe[3728] CRYPT32.dll!PFXImportCertStore 77AEFF8F 5 Bytes JMP 00083909
.text C:\WINDOWS\system32\wuauclt.exe[3728] WININET.dll!InternetCloseHandle 771C4D94 5 Bytes JMP 00097D78
.text C:\WINDOWS\system32\wuauclt.exe[3728] WININET.dll!HttpSendRequestA 771C60A9 5 Bytes JMP 00097CA6
.text C:\WINDOWS\system32\wuauclt.exe[3728] WININET.dll!HttpQueryInfoA 771C79CA 5 Bytes JMP 00097DB7
.text C:\WINDOWS\system32\wuauclt.exe[3728] WININET.dll!InternetReadFile 771C82F2 5 Bytes JMP 00097D10
.text C:\WINDOWS\system32\wuauclt.exe[3728] WININET.dll!HttpSendRequestExW 771CEA01 5 Bytes JMP 00097CC8
.text C:\WINDOWS\system32\wuauclt.exe[3728] WININET.dll!InternetQueryDataAvailable 771D8A37 5 Bytes JMP 00097D55
.text C:\WINDOWS\system32\wuauclt.exe[3728] WININET.dll!InternetReadFileExA 771F9230 5 Bytes JMP 00097D32
.text C:\WINDOWS\system32\wuauclt.exe[3728] WININET.dll!HttpSendRequestW 77212FEC 5 Bytes JMP 00097C84
.text C:\WINDOWS\system32\wuauclt.exe[3728] WININET.dll!HttpSendRequestExA 772130F1 5 Bytes JMP 00097CEC

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 eabfiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Development Company, L.P.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- Threads - GMER 1.0.15 —-

Thread avgrsx.exe [808:1656] 0720CE25
Thread avgrsx.exe [808:2520] 0723CE25
—- Processes - GMER 1.0.15 —-

Library \\?\globalroot\systemroot\system32\gxvxcmpxyfwmqtxwskdsxtphvywpwiypdqbrp.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1452] 0x10000000

—- Services - GMER 1.0.15 —-

Service C:\WINDOWS\system32\drivers\gxvxcmxowkbmurrilrqujvsdrukejolwxvdlw.sys (*** hidden *** ) [SYSTEM] gxvxcserv.sys <– ROOTKIT !!!

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\gxvxcserv.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\gxvxcserv.sys@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\gxvxcserv.sys@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\gxvxcserv.sys@imagepath \systemroot\system32\drivers\gxvxcmxowkbmurrilrqujvsdrukejolwxvdlw.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\gxvxcserv.sys@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\gxvxcserv.sys\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\gxvxcserv.sys\modules@gxvxcserv \\?\globalroot\systemroot\system32\drivers\gxvxcmxowkbmurrilrqujvsdrukejolwxvdlw.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\gxvxcserv.sys\modules@gxvxcl \\?\globalroot\systemroot\system32\gxvxcmpxyfwmqtxwskdsxtphvywpwiypdqbrp.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\gxvxcserv.sys\modules@gxvxcclk \\?\globalroot\systemroot\system32\gxvxcnkfrvaxralmkrurbtnqtjwfpkbpyoveq.dll
Reg HKLM\SYSTEM\ControlSet002\Services\gxvxcserv.sys (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\gxvxcserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet002\Services\gxvxcserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet002\Services\gxvxcserv.sys@imagepath \systemroot\system32\drivers\gxvxcmxowkbmurrilrqujvsdrukejolwxvdlw.sys
Reg HKLM\SYSTEM\ControlSet002\Services\gxvxcserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet002\Services\gxvxcserv.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\gxvxcserv.sys\modules@gxvxcserv \\?\globalroot\systemroot\system32\drivers\gxvxcmxowkbmurrilrqujvsdrukejolwxvdlw.sys
Reg HKLM\SYSTEM\ControlSet002\Services\gxvxcserv.sys\modules@gxvxcl \\?\globalroot\systemroot\system32\gxvxcmpxyfwmqtxwskdsxtphvywpwiypdqbrp.dll
Reg HKLM\SYSTEM\ControlSet002\Services\gxvxcserv.sys\modules@gxvxcclk \\?\globalroot\systemroot\system32\gxvxcnkfrvaxralmkrurbtnqtjwfpkbpyoveq.dll
Reg HKLM\SYSTEM\ControlSet003\Services\gxvxcserv.sys (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\gxvxcserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\gxvxcserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\gxvxcserv.sys@imagepath \systemroot\system32\drivers\gxvxcmxowkbmurrilrqujvsdrukejolwxvdlw.sys
Reg HKLM\SYSTEM\ControlSet003\Services\gxvxcserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\gxvxcserv.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\gxvxcserv.sys\modules@gxvxcserv \\?\globalroot\systemroot\system32\drivers\gxvxcmxowkbmurrilrqujvsdrukejolwxvdlw.sys
Reg HKLM\SYSTEM\ControlSet003\Services\gxvxcserv.sys\modules@gxvxcl \\?\globalroot\systemroot\system32\gxvxcmpxyfwmqtxwskdsxtphvywpwiypdqbrp.dll
Reg HKLM\SYSTEM\ControlSet003\Services\gxvxcserv.sys\modules@gxvxcclk \\?\globalroot\systemroot\system32\gxvxcnkfrvaxralmkrurbtnqtjwfpkbpyoveq.dll
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xC8 0x28 0x51 0xAF …
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x6A 0x9C 0xD6 0x61 …
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0x25 0xDA 0xEC 0x7E …
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x86 0x8C 0x21 0x01 …
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xF5 0x1D 0x4D 0x73 …
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xB0 0x18 0xED 0xA7 …
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0x31 0x77 0xE1 0xBA …
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x01 0x3A 0x48 0xFC …
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0xB2 0x46 0x9A 0xE2 …
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0x3D 0xCE 0xEA 0x26 …
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0xF8 0x31 0x0F 0xA9 …
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0xFA 0xEA 0x66 0x7F …

—- EOF - GMER 1.0.15 —-

Attachments:

📎Attach.txt

tad ghostal

Post #4April 28, 2010, 3:54 PM UTC

I had a few problems getting Gmer to work, it kept crashing, and I can't boot into safe mode. The Gmer log is from a scan with 'Files' unchecked as well.

RPMcMurphy

Post #5April 28, 2010, 6:53 PM UTC

tad_ghostal,

🖼Click to load external image (Posted Image) You are infected with a trojan know to sometimes have backdoor properties. Backdoor Trojans are very dangerous because they use advanced techniques (backdoors) to bypass security mechanisms and steal sensitive information which they send back to the hacker. All passwords should be changed immediately using a different computer and, if necessary, banking and credit card institutions should be notified of the possible security breach.

🖼Click to load external image (Posted Image) Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please include the following in your next post:
ComboFix log

tad ghostal

Post #6April 29, 2010, 12:43 PM UTC

Thanks for the quick reply, I really appreciate the help. I downloaded Combofix to my desktop, clicked on the icon, then clicked 'Run' in the window that opened but nothing happened. This happened before when I downloaded Malwarebytes Anti-malware, I could not get it to run, but when I tried clicking it again a few weeks later it worked.

RPMcMurphy

Post #7April 29, 2010, 1:36 PM UTC

Delete your current copy of ComboFix, then follow these instructions:

Download Combofix from any of the links below. Rename it to tadg.com before saving it to your desktop.

Link 1
Link 2

[external image: Posted Image]

[external image: Posted Image]

* IMPORTANT !!! Save tadg.com to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on tadg.com & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

tad ghostal

Post #8April 29, 2010, 2:42 PM UTC

ComboFix 10-04-28.08 - User 29/04/2010 15:19:50.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.2038.1570 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\tadg.com.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\User\Local Settings\Application Data\{5FEE9289-6ABD-4D55-9421-BF8C56AAAD90}
c:\documents and settings\User\Local Settings\Application Data\{5FEE9289-6ABD-4D55-9421-BF8C56AAAD90}\chrome.manifest
c:\documents and settings\User\Local Settings\Application Data\{5FEE9289-6ABD-4D55-9421-BF8C56AAAD90}\chrome\content\_cfg.js
c:\documents and settings\User\Local Settings\Application Data\{5FEE9289-6ABD-4D55-9421-BF8C56AAAD90}\chrome\content\overlay.xul
c:\documents and settings\User\Local Settings\Application Data\{5FEE9289-6ABD-4D55-9421-BF8C56AAAD90}\install.rdf
c:\documents and settings\User\Start Menu\Programs\StartUp\scandisk.lnk
C:\readme.rtf
c:\windows\dmocafr.dll
c:\windows\system32\drivers\gxvxcewswwowbevpyxgwrqxnkfxhklxavymrm.sys
c:\windows\system32\drivers\gxvxcmxowkbmurrilrqujvsdrukejolwxvdlw.sys
c:\windows\system32\drivers\gxvxcwamxeafrmmcvndwilroybaxwppyoviwt.sys
c:\windows\system32\gxvxccount
c:\windows\system32\gxvxcmpxyfwmqtxwskdsxtphvywpwiypdqbrp.dll
c:\windows\system32\gxvxcnkfrvaxralmkrurbtnqtjwfpkbpyoveq.dll
c:\windows\system32\lowsec
c:\windows\system32\lowsec\local.ds
c:\windows\system32\lowsec\user.ds
c:\windows\system32\lowsec\user.ds.lll
c:\windows\system32\sdra64.exe
c:\windows\system32\spool\prtprocs\w32x86\000049e1.tmp
c:\windows\system32\spool\prtprocs\w32x86\00006b02.tmp

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_gxvxcserv.sys
——-\Legacy_gxvxcserv.sys
——-\Legacy_SVCHOST

((((((((((((((((((((((((( Files Created from 2010-03-28 to 2010-04-29 )))))))))))))))))))))))))))))))
.

2010-04-24 19:53 . 2010-04-29 12:58 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\Temp
2010-04-22 19:45 . 2010-04-22 19:45 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\Threat Expert
2010-04-12 07:36 . 2010-04-12 07:36 ——– d-s—w- c:\documents and settings\NetworkService\Temporary Internet Files
2010-04-12 07:36 . 2010-04-12 07:36 ——– d-s—w- c:\documents and settings\NetworkService\History
2010-04-12 07:36 . 2010-04-12 07:36 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2010-04-09 01:07 . 2010-04-09 01:08 5514304 —-a-w- c:\documents and settings\User\Application Data\TVU Networks\AutoUpgrade\TVUPlayer2.5.2.2.exe
2010-04-09 01:07 . 2010-04-09 01:07 ——– d—–w- c:\documents and settings\User\Application Data\TVU Networks
2010-04-02 22:05 . 2010-04-02 22:05 ——– d—–w- c:\program files\QuickTime
2010-04-02 22:05 . 2010-04-02 22:05 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-04-02 22:05 . 2010-04-02 22:05 ——– d—–w- c:\program files\Common Files\Apple
2010-04-02 22:05 . 2010-04-02 22:05 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\Apple
2010-04-02 22:05 . 2010-04-02 22:05 ——– d—–w- c:\program files\Apple Software Update
2010-04-02 22:04 . 2010-04-02 22:04 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\Apple Computer

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-29 14:33 . 2009-11-23 23:54 ——– d—–w- c:\documents and settings\User\Application Data\uTorrent
2010-04-27 19:55 . 2009-06-10 03:54 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-04-25 12:23 . 2009-08-14 19:38 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2010-04-21 15:12 . 2010-01-26 23:25 ——– d—–w- c:\documents and settings\User\Application Data\vlc
2010-04-18 22:46 . 2010-03-15 18:44 120 —-a-w- c:\windows\Kgaqafarip.dat
2010-04-18 19:05 . 2010-03-15 18:44 0 —-a-w- c:\windows\Vvusitulusasiy.bin
2010-03-30 01:44 . 2010-03-29 19:48 ——– d—–w- c:\documents and settings\User\Application Data\codeblocks
2010-03-29 19:48 . 2010-03-29 19:48 ——– d—–w- c:\program files\CodeBlocks
2010-03-26 14:02 . 2009-06-03 21:27 ——– d—–w- c:\program files\Hotspot Shield
2010-03-18 20:52 . 2010-01-31 21:05 1 —-a-w- c:\documents and settings\User\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-02-01 11:40 . 2008-01-22 17:48 65280 —-a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-31 20:53 . 2009-11-09 00:01 411368 —-a-w- c:\windows\system32\deploytk.dll
2008-11-19 21:56 . 2008-11-19 21:56 22 –sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-07-24 08:55 1090816 —-a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2009-06-03 21:27 218160 —-a-w- c:\program files\Hotspot Shield\hssie\HssIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-11-23 289584]
"Google Update"="c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-04-24 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-02-15 454656]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-04-17 61952]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-01 761946]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-04-11 102400]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-23 131072]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2006-01-26 40960]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"H2O"="c:\program files\SyncroSoft\Pos\H2O\cledx.exe" [2005-10-23 385024]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2010-03-18 2046816]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-31 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\User\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]
Traffic Counter.lnk - c:\program files\TrafficCounter\TrafficCounter.exe [2010-2-23 278528]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
HP Photosmart Premier Fast Start.lnk - c:\program files\Hp\Digital Imaging\bin\hpqthb08.exe [2005-9-24 73728]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"DisallowRun"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\disallowrun]
"1"= firefox.exe
"2"= opera.exe
"3"= chrome.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-14 19:38 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"c:\\Program Files\\StreamTorrent 1.0\\StreamTorrent.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Novation\\Automap Universal\\AutomapServer.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [6/5/2009 5:26 AM 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [8/14/2009 8:38 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [8/14/2009 8:38 PM 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [8/14/2009 8:38 PM 297752]
R2 HssWd;Hotspot Shield Monitoring Service;c:\program files\Hotspot Shield\bin\hsswd.exe [1/9/2010 12:42 AM 285744]
R2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [12/8/2009 7:26 PM 3616768]
R3 automap;Automap MIDI Driver Service;c:\windows\system32\drivers\automap.sys [12/15/2008 3:57 PM 7168]
R3 CLEDX;Team H2O CLEDX service;c:\windows\system32\drivers\cledx.sys [2/26/2008 12:57 PM 33792]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 8:06 PM 951632]
S3 NvnUsbAudio;Novation USB Audio Driver;c:\windows\system32\drivers\nvnusbaudio.sys [12/15/2008 3:56 PM 31232]
.
Contents of the 'Scheduled Tasks' folder

2010-04-16 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 19:06]

2010-04-12 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-04-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3161424866-1566932716-876338741-1006Core.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-24 19:53]

2010-04-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3161424866-1566932716-876338741-1006UA.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-24 19:53]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://uk.ask.com?o=15153&l=dis
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=Q306&bd=pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: {{08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\qc9jhu0z.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo.co.uk
FF - prefs.js: browser.startup.homepage - hxxp://uk.ask.com/?o=312&l=dir
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - plugin: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\qc9jhu0z.default\extensions\[removed]\plugins\npTVUAx.dll
FF - plugin: c:\documents and settings\User\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Malwarebytes Anti-Malware (reboot) - c:\program files\Malwarebytes' Anti-Malware\mbam.exe

**************************************************************************
scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ????R????????@???????@

scanning hidden files …

scan completed successfully
hidden files:

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3356)
c:\progra~1\WINDOW~1\wmpband.dll
.
———————— Other Running Processes ————————
.
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\Hotspot Shield\HssWPR\hsssrv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\wscntfy.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\progra~1\HPQ\Shared\HPQTOA~1.EXE
c:\program files\Hotspot Shield\bin\openvpntray.exe
.
**************************************************************************
.
Completion time: 2010-04-29 15:35:13 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-29 14:35

Pre-Run: 37,198,012,416 bytes free
Post-Run: 37,844,389,888 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - A1E14333A0A111684D7694C1EA97E9FE

RPMcMurphy

Post #9April 29, 2010, 5:16 PM UTC

Hi,

That's looking better. How is your PC running now?

🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above http://

http://forums.whatthetech.com/Computer_freezes_google_redirects_t111753.html

Collect::
c:\windows\Kgaqafarip.dat
c:\windows\Vvusitulusasiy.bin

Registry::
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"DisallowRun"= -

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\disallowrun]
"1"= -
"2"= -
"3"= -

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe (tadg.com) as you see in the screenshot below.

[external image: Posted Image]

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.

Once the update is complete, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, adware, dialers, and other riskware
- Archives
- E-mail databases
Click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View report… at the bottom.
Click the Save report… button.

[external image: Posted Image]
Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

Please include the following in your next post:

ComboFix log

Kaspersky log

tad ghostal

Post #10April 29, 2010, 8:57 PM UTC

ComboFix 10-04-28.08 - User 29/04/2010 19:10:01.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.2038.1445 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\tadg.com.exe
Command switches used :: c:\documents and settings\User\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

file zipped: c:\windows\Kgaqafarip.dat
file zipped: c:\windows\Vvusitulusasiy.bin
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Kgaqafarip.dat
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\_000007_.tmp.dll
c:\windows\system32\_000008_.tmp.dll
c:\windows\system32\_000009_.tmp.dll
c:\windows\system32\_000013_.tmp.dll
c:\windows\Vvusitulusasiy.bin

.
((((((((((((((((((((((((( Files Created from 2010-03-28 to 2010-04-29 )))))))))))))))))))))))))))))))
.

2010-04-29 17:36 . 2009-11-21 15:51 471552 ——w- c:\windows\system32\dllcache\aclayers.dll
2010-04-29 17:36 . 2009-07-10 13:27 1315328 ——w- c:\windows\system32\dllcache\msoe.dll
2010-04-29 17:34 . 2009-10-15 16:28 81920 ——w- c:\windows\system32\dllcache\fontsub.dll
2010-04-29 17:34 . 2009-10-15 16:28 119808 ——w- c:\windows\system32\dllcache\t2embed.dll
2010-04-29 17:32 . 2009-06-21 21:44 153088 ——w- c:\windows\system32\dllcache\triedit.dll
2010-04-29 17:32 . 2009-10-23 15:28 3558912 ——w- c:\windows\system32\dllcache\moviemk.exe
2010-04-29 17:31 . 2010-02-12 10:03 293376 ——w- c:\windows\system32\browserchoice.exe
2010-04-29 17:29 . 2009-08-13 15:16 512000 ——w- c:\windows\system32\dllcache\jscript.dll
2010-04-29 17:25 . 2009-08-06 18:23 274288 —-a-w- c:\windows\system32\mucltui.dll
2010-04-29 17:25 . 2009-08-06 18:23 215920 —-a-w- c:\windows\system32\muweb.dll
2010-04-29 17:25 . 2010-04-29 17:28 ——– d—–w- c:\windows\LastGood
2010-04-29 14:05 . 2010-04-29 14:35 ——– d—–w- C:\tadg.com
2010-04-24 19:53 . 2010-04-29 12:58 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\Temp
2010-04-22 19:45 . 2010-04-22 19:45 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\Threat Expert
2010-04-12 07:36 . 2010-04-12 07:36 ——– d-s—w- c:\documents and settings\NetworkService\Temporary Internet Files
2010-04-12 07:36 . 2010-04-12 07:36 ——– d-s—w- c:\documents and settings\NetworkService\History
2010-04-12 07:36 . 2010-04-12 07:36 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2010-04-09 01:07 . 2010-04-09 01:08 5514304 —-a-w- c:\documents and settings\User\Application Data\TVU Networks\AutoUpgrade\TVUPlayer2.5.2.2.exe
2010-04-09 01:07 . 2010-04-09 01:07 ——– d—–w- c:\documents and settings\User\Application Data\TVU Networks
2010-04-02 22:05 . 2010-04-02 22:05 ——– d—–w- c:\program files\QuickTime
2010-04-02 22:05 . 2010-04-02 22:05 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-04-02 22:05 . 2010-04-02 22:05 ——– d—–w- c:\program files\Common Files\Apple
2010-04-02 22:05 . 2010-04-02 22:05 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\Apple
2010-04-02 22:05 . 2010-04-02 22:05 ——– d—–w- c:\program files\Apple Software Update
2010-04-02 22:04 . 2010-04-02 22:04 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\Apple Computer

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-29 17:57 . 2009-11-17 00:52 ——– d—–w- c:\program files\Microsoft Silverlight
2010-04-29 17:56 . 2010-04-29 17:56 ——– d—–w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-04-29 14:36 . 2009-11-23 23:54 ——– d—–w- c:\documents and settings\User\Application Data\uTorrent
2010-04-27 19:55 . 2009-06-10 03:54 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-04-25 12:23 . 2009-08-14 19:38 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2010-04-21 15:12 . 2010-01-26 23:25 ——– d—–w- c:\documents and settings\User\Application Data\vlc
2010-03-30 01:44 . 2010-03-29 19:48 ——– d—–w- c:\documents and settings\User\Application Data\codeblocks
2010-03-29 19:48 . 2010-03-29 19:48 ——– d—–w- c:\program files\CodeBlocks
2010-03-26 14:02 . 2009-06-03 21:27 ——– d—–w- c:\program files\Hotspot Shield
2010-03-18 20:52 . 2010-01-31 21:05 1 —-a-w- c:\documents and settings\User\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-03-10 04:33 . 2010-03-10 04:33 1509888 —-a-w- c:\windows\system32\SET240.tmp
2010-03-10 04:33 . 2010-03-10 04:33 1025024 —-a-w- c:\windows\system32\SET243.tmp
2010-03-09 11:09 . 2004-08-04 21:00 430080 —-a-w- c:\windows\system32\vbscript.dll
2010-02-26 05:43 . 2010-02-26 05:43 667136 —-a-w- c:\windows\system32\SET23D.tmp
2010-02-26 05:43 . 2010-02-26 05:43 627712 —-a-w- c:\windows\system32\SET23E.tmp
2010-02-26 05:43 . 2010-02-26 05:43 3073024 —-a-w- c:\windows\system32\SET241.tmp
2010-02-26 05:43 . 2004-08-04 21:00 81920 —-a-w- c:\windows\system32\ieencode.dll
2010-02-24 13:11 . 2005-01-19 12:26 455680 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-16 14:08 . 2004-08-04 21:00 2146304 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 13:25 . 2004-08-04 21:00 2024448 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 04:33 . 2004-08-04 21:00 100864 —-a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2004-08-04 21:00 226880 —-a-w- c:\windows\system32\drivers\tcpip6.sys
2010-02-01 11:40 . 2008-01-22 17:48 65280 —-a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-31 20:53 . 2009-11-09 00:01 411368 —-a-w- c:\windows\system32\deploytk.dll
2008-11-19 21:56 . 2008-11-19 21:56 22 –sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-04-29_14.31.51 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-11 18:41 . 2009-07-11 18:41 97280 c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd\ATL80.dll
+ 2004-08-04 21:00 . 2009-08-06 18:24 53472 c:\windows\system32\wuauclt.exe
+ 2004-08-04 21:00 . 2008-05-09 10:53 90112 c:\windows\system32\wshext.dll
- 2004-08-04 21:00 . 2008-04-14 04:42 90112 c:\windows\system32\wshext.dll
+ 2009-06-04 02:01 . 2010-01-23 08:11 46080 c:\windows\system32\tzchange.exe
+ 2004-08-04 21:00 . 2009-06-12 12:31 76288 c:\windows\system32\telnet.exe
- 2005-06-29 01:21 . 2007-08-10 19:46 26488 c:\windows\system32\spupdsvc.exe
+ 2005-06-29 01:21 . 2007-07-27 09:41 26488 c:\windows\system32\spupdsvc.exe
+ 2006-07-18 03:57 . 2009-05-26 11:40 17272 c:\windows\system32\spmsg.dll
- 2006-07-18 03:57 . 2008-07-09 07:38 17272 c:\windows\system32\spmsg.dll
+ 2010-04-29 17:25 . 2009-08-06 18:24 44768 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.4.7600.226\wups2.dll
+ 2010-04-29 17:25 . 2009-08-06 18:24 35552 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.4.7600.226\wups.dll
- 2006-03-27 16:07 . 2010-04-29 14:23 53616 c:\windows\system32\perfc009.dat
+ 2006-03-27 16:07 . 2010-04-29 14:35 53616 c:\windows\system32\perfc009.dat
+ 2004-08-04 21:00 . 2009-11-27 17:11 17920 c:\windows\system32\msyuv.dll
+ 2004-08-04 21:00 . 2009-11-27 16:07 28672 c:\windows\system32\msvidc32.dll
- 2004-08-04 21:00 . 2008-04-14 04:42 11264 c:\windows\system32\msrle32.dll
+ 2004-08-04 21:00 . 2009-11-27 16:07 11264 c:\windows\system32\msrle32.dll
+ 2004-08-04 21:00 . 2009-11-27 16:07 48128 c:\windows\system32\iyuv_32.dll
+ 2005-10-18 05:14 . 2009-10-15 16:28 81920 c:\windows\system32\fontsub.dll
+ 2004-08-04 21:00 . 2009-06-24 11:18 92928 c:\windows\system32\drivers\ksecdd.sys
+ 2004-08-04 21:00 . 2009-08-06 18:24 53472 c:\windows\system32\dllcache\wuauclt.exe
+ 2008-05-09 10:53 . 2008-05-09 10:53 90112 c:\windows\system32\dllcache\wshext.dll
+ 2009-06-25 08:25 . 2009-06-25 08:25 54272 c:\windows\system32\dllcache\wdigest.dll
+ 2009-06-12 12:31 . 2009-06-12 12:31 76288 c:\windows\system32\dllcache\telnet.exe
- 2009-06-04 02:02 . 2009-02-03 19:59 56832 c:\windows\system32\dllcache\secur32.dll
+ 2009-06-04 02:02 . 2009-06-25 08:25 56832 c:\windows\system32\dllcache\secur32.dll
+ 2009-10-12 13:38 . 2009-10-12 13:38 79872 c:\windows\system32\dllcache\raschap.dll
+ 2009-11-27 17:11 . 2009-11-27 17:11 17920 c:\windows\system32\dllcache\msyuv.dll
+ 2009-11-27 16:07 . 2009-11-27 16:07 28672 c:\windows\system32\dllcache\msvidc32.dll
+ 2009-11-27 16:07 . 2009-11-27 16:07 11264 c:\windows\system32\dllcache\msrle32.dll
+ 2009-09-04 21:03 . 2009-09-04 21:03 58880 c:\windows\system32\dllcache\msasn1.dll
+ 2009-06-24 11:18 . 2009-06-24 11:18 92928 c:\windows\system32\dllcache\ksecdd.sys
+ 2009-11-27 16:07 . 2009-11-27 16:07 48128 c:\windows\system32\dllcache\iyuv_32.dll
- 2009-06-04 02:03 . 2009-02-20 08:10 81920 c:\windows\system32\dllcache\ieencode.dll
+ 2009-06-04 02:03 . 2010-02-26 05:43 81920 c:\windows\system32\dllcache\ieencode.dll
+ 2009-12-14 07:08 . 2009-12-14 07:08 33280 c:\windows\system32\dllcache\csrsrv.dll
+ 2004-08-04 21:00 . 2009-08-06 18:24 96480 c:\windows\system32\dllcache\cdm.dll
+ 2010-01-13 14:01 . 2010-01-13 14:01 86016 c:\windows\system32\dllcache\cabview.dll
+ 2009-11-27 16:07 . 2009-11-27 16:07 84992 c:\windows\system32\dllcache\avifil32.dll
+ 2009-07-17 19:01 . 2009-07-17 19:01 58880 c:\windows\system32\dllcache\atl.dll
+ 2004-08-04 21:00 . 2009-12-14 07:08 33280 c:\windows\system32\csrsrv.dll
+ 2004-08-04 21:00 . 2009-08-06 18:24 96480 c:\windows\system32\cdm.dll
+ 2004-08-04 21:00 . 2010-01-13 14:01 86016 c:\windows\system32\cabview.dll
- 2004-08-04 21:00 . 2008-04-14 04:41 84992 c:\windows\system32\avifil32.dll
+ 2004-08-04 21:00 . 2009-11-27 16:07 84992 c:\windows\system32\avifil32.dll
+ 2009-06-24 18:56 . 2009-06-24 18:56 73728 c:\windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe
+ 2008-05-27 23:49 . 2008-05-27 23:49 77824 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
- 2007-04-13 19:58 . 2007-04-13 19:58 77824 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
- 2007-04-13 19:57 . 2007-04-13 19:57 86016 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorie.dll
+ 2008-05-27 23:49 . 2008-05-27 23:49 86016 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorie.dll
+ 2008-05-27 23:49 . 2008-05-27 23:49 81920 c:\windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
- 2007-04-13 19:57 . 2007-04-13 19:57 81920 c:\windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
+ 2008-05-28 00:30 . 2008-05-28 00:30 32768 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
- 2007-04-13 20:30 . 2007-04-13 20:30 32768 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
+ 2010-04-29 17:25 . 2008-10-16 13:09 43544 c:\windows\LastGood\system32\wups2.dll
+ 2010-04-29 17:25 . 2008-10-16 13:08 34328 c:\windows\LastGood\system32\wups.dll
+ 2010-04-29 17:25 . 2008-10-16 13:09 51224 c:\windows\LastGood\system32\wuauclt.exe
+ 2010-04-29 17:25 . 2008-10-16 13:09 92696 c:\windows\LastGood\system32\cdm.dll
+ 2010-04-29 17:52 . 2010-04-29 17:52 32768 c:\windows\Installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}\icon.exe
+ 2009-11-27 17:11 . 2009-11-27 17:11 17920 c:\windows\Driver Cache\i386\msyuv.dll
+ 2009-11-27 16:07 . 2009-11-27 16:07 48128 c:\windows\Driver Cache\i386\iyuv_32.dll
+ 2010-04-29 17:54 . 2010-04-29 17:54 90112 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_5463f2b0\System.Drawing.Design.dll
+ 2010-04-29 17:54 . 2010-04-29 17:54 61440 c:\windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_a9da8011\CustomMarshalers.dll
+ 2004-08-04 21:00 . 2009-11-27 16:07 8704 c:\windows\system32\tsbyuv.dll
+ 2009-11-27 16:07 . 2009-11-27 16:07 8704 c:\windows\system32\dllcache\tsbyuv.dll
+ 2009-11-27 16:07 . 2009-11-27 16:07 8704 c:\windows\Driver Cache\i386\tsbyuv.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
+ 2004-08-04 21:00 . 2009-08-06 18:24 209632 c:\windows\system32\wuweb.dll
+ 2004-08-04 21:00 . 2009-08-06 18:24 327896 c:\windows\system32\wucltui.dll
+ 2004-08-04 21:00 . 2009-08-06 18:23 575704 c:\windows\system32\wuapi.dll
- 2004-08-04 21:00 . 2008-04-14 04:42 155648 c:\windows\system32\wscript.exe
+ 2004-08-04 21:00 . 2008-05-08 11:24 155648 c:\windows\system32\wscript.exe
+ 2004-08-11 17:45 . 2009-04-10 00:01 530280 c:\windows\system32\wmspdmod.dll
+ 2004-08-11 17:45 . 2009-07-13 09:08 286720 c:\windows\system32\wmpdxm.dll
+ 2004-08-04 21:00 . 2009-06-10 06:14 132096 c:\windows\system32\wkssvc.dll
- 2004-08-04 21:00 . 2008-04-14 04:42 132096 c:\windows\system32\wkssvc.dll
+ 2004-08-04 21:00 . 2009-08-26 08:00 247326 c:\windows\system32\strmdll.dll
- 2004-08-04 21:00 . 2008-10-03 10:02 247326 c:\windows\system32\strmdll.dll
+ 2004-08-04 21:00 . 2008-05-09 10:53 172032 c:\windows\system32\scrrun.dll
- 2004-08-04 21:00 . 2008-04-14 04:42 172032 c:\windows\system32\scrrun.dll
- 2004-08-04 21:00 . 2008-04-14 04:42 180224 c:\windows\system32\scrobj.dll
+ 2004-08-04 21:00 . 2008-05-09 10:53 180224 c:\windows\system32\scrobj.dll
- 2006-03-27 16:07 . 2010-04-29 14:23 381560 c:\windows\system32\perfh009.dat
+ 2006-03-27 16:07 . 2010-04-29 14:35 381560 c:\windows\system32\perfh009.dat
+ 2004-08-04 21:00 . 2009-08-05 09:01 204800 c:\windows\system32\mswebdvd.dll
- 2004-08-04 21:00 . 2008-04-14 04:42 343040 c:\windows\system32\mspaint.exe
+ 2004-08-04 21:00 . 2009-12-16 18:43 343040 c:\windows\system32\mspaint.exe
+ 2004-08-04 21:00 . 2009-06-25 08:25 730112 c:\windows\system32\lsasrv.dll
+ 2004-08-04 21:00 . 2009-05-07 15:32 345600 c:\windows\system32\localspl.dll
- 2004-08-04 21:00 . 2008-04-14 04:41 512000 c:\windows\system32\jscript.dll
+ 2004-08-04 21:00 . 2009-08-13 15:16 512000 c:\windows\system32\jscript.dll
+ 2005-07-03 10:11 . 2010-02-26 05:43 251904 c:\windows\system32\iepeers.dll
- 2005-07-03 10:11 . 2008-04-14 04:41 251904 c:\windows\system32\iepeers.dll
+ 2005-05-10 08:17 . 2009-12-31 16:50 353792 c:\windows\system32\drivers\srv.sys
+ 2004-08-04 21:00 . 2009-08-06 18:24 209632 c:\windows\system32\dllcache\wuweb.dll
+ 2004-08-04 21:00 . 2009-08-06 18:24 327896 c:\windows\system32\dllcache\wucltui.dll
+ 2004-08-04 21:00 . 2009-08-06 18:23 575704 c:\windows\system32\dllcache\wuapi.dll
+ 2008-05-08 11:24 . 2008-05-08 11:24 155648 c:\windows\system32\dllcache\wscript.exe
+ 2004-08-11 17:45 . 2009-04-10 00:01 530280 c:\windows\system32\dllcache\wmspdmod.dll
+ 2009-07-13 09:08 . 2009-07-13 09:08 286720 c:\windows\system32\dllcache\wmpdxm.dll
+ 2009-06-10 06:14 . 2009-06-10 06:14 132096 c:\windows\system32\dllcache\wkssvc.dll
+ 2009-12-24 06:59 . 2009-12-24 06:59 177664 c:\windows\system32\dllcache\wintrust.dll
+ 2009-06-04 02:03 . 2010-02-26 05:43 667136 c:\windows\system32\dllcache\wininet.dll
+ 2010-03-09 11:09 . 2010-03-09 11:09 430080 c:\windows\system32\dllcache\vbscript.dll
+ 2009-06-04 02:03 . 2010-02-26 05:43 627712 c:\windows\system32\dllcache\urlmon.dll
+ 2009-06-04 02:05 . 2010-02-11 12:02 226880 c:\windows\system32\dllcache\tcpip6.sys
- 2009-06-03 21:23 . 2008-10-03 10:02 247326 c:\windows\system32\dllcache\strmdll.dll
+ 2009-06-03 21:23 . 2009-08-26 08:00 247326 c:\windows\system32\dllcache\strmdll.dll
+ 2009-06-04 02:07 . 2009-12-31 16:50 353792 c:\windows\system32\dllcache\srv.sys
+ 2009-12-08 09:23 . 2009-12-08 09:23 474112 c:\windows\system32\dllcache\shlwapi.dll
+ 2008-05-09 10:53 . 2008-05-09 10:53 172032 c:\windows\system32\dllcache\scrrun.dll
+ 2008-05-09 10:53 . 2008-05-09 10:53 180224 c:\windows\system32\dllcache\scrobj.dll
+ 2009-06-04 02:01 . 2009-06-25 08:25 147456 c:\windows\system32\dllcache\schannel.dll
+ 2009-04-15 14:51 . 2009-04-15 14:51 585216 c:\windows\system32\dllcache\rpcrt4.dll
+ 2009-10-12 13:38 . 2009-10-12 13:38 149504 c:\windows\system32\dllcache\rastls.dll
+ 2009-10-13 10:30 . 2009-10-13 10:30 270336 c:\windows\system32\dllcache\oakley.dll
+ 2009-08-05 09:01 . 2009-08-05 09:01 204800 c:\windows\system32\dllcache\mswebdvd.dll
+ 2009-06-25 08:25 . 2009-09-11 14:18 136192 c:\windows\system32\dllcache\msv1_0.dll
+ 2009-12-16 18:43 . 2009-12-16 18:43 343040 c:\windows\system32\dllcache\mspaint.exe
+ 2009-06-04 02:08 . 2010-02-24 13:11 455680 c:\windows\system32\dllcache\mrxsmb.sys
+ 2009-06-04 02:12 . 2009-06-25 08:25 730112 c:\windows\system32\dllcache\lsasrv.dll
+ 2009-05-07 15:32 . 2009-05-07 15:32 345600 c:\windows\system32\dllcache\localspl.dll
+ 2009-06-25 08:25 . 2009-06-25 08:25 301568 c:\windows\system32\dllcache\kerberos.dll
+ 2010-02-26 05:43 . 2010-02-26 05:43 251904 c:\windows\system32\dllcache\iepeers.dll
+ 2008-05-07 09:07 . 2008-05-07 09:07 135168 c:\windows\system32\dllcache\cscript.exe
+ 2010-02-12 04:33 . 2010-02-12 04:33 100864 c:\windows\system32\dllcache\6to4svc.dll
+ 2004-08-04 21:00 . 2008-05-07 09:07 135168 c:\windows\system32\cscript.exe
- 2007-04-13 19:58 . 2007-04-13 19:58 102400 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
+ 2008-05-27 23:49 . 2008-05-27 23:49 102400 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
+ 2008-05-27 23:48 . 2008-05-27 23:48 315392 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
- 2007-04-13 19:56 . 2007-04-13 19:56 315392 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
- 2007-04-13 20:30 . 2007-04-13 20:30 258048 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
+ 2008-05-28 00:30 . 2008-05-28 00:30 258048 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
+ 2010-04-29 17:25 . 2008-10-16 13:13 202776 c:\windows\LastGood\system32\wuweb.dll
+ 2010-04-29 17:25 . 2008-10-16 13:12 323608 c:\windows\LastGood\system32\wucltui.dll
+ 2010-04-29 17:25 . 2008-10-16 13:12 561688 c:\windows\LastGood\system32\wuapi.dll
+ 2010-04-29 17:56 . 2010-04-29 17:56 470528 c:\windows\Installer\b857dc.msi
+ 2010-04-29 17:52 . 2010-04-29 17:52 195584 c:\windows\Installer\b857ba.msi
+ 2010-04-29 17:52 . 2010-04-29 17:52 429568 c:\windows\Installer\b857b4.msi
+ 2010-04-29 17:52 . 2010-04-29 17:52 248832 c:\windows\Installer\b857ab.msi
+ 2009-06-04 02:08 . 2010-02-24 13:11 455680 c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2009-06-05 02:04 . 2009-06-05 02:04 835584 c:\windows\assembly\temp\ENV3BJRZ7F\System.Drawing.dll
+ 2010-04-29 17:54 . 2010-04-29 17:54 835584 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_5af6f425\System.Drawing.dll
+ 2010-04-29 17:35 . 2009-08-13 13:55 1748992 c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll
+ 2009-07-20 23:03 . 2009-07-20 23:03 1348432 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9876.0_x-ww_a621d1d5\msxml4.dll
+ 2004-08-04 21:00 . 2009-08-06 18:23 1929952 c:\windows\system32\wuaueng.dll
+ 2004-08-11 17:45 . 2009-05-20 11:44 2355200 c:\windows\system32\WMVCore.dll
+ 2004-08-11 17:45 . 2009-07-13 09:08 5537792 c:\windows\system32\wmp.dll
- 2004-08-11 17:45 . 2007-04-30 07:20 5537792 c:\windows\system32\wmp.dll
+ 2004-08-04 21:00 . 2009-08-14 13:21 1850624 c:\windows\system32\win32k.sys
+ 2004-08-04 21:00 . 2009-07-17 16:22 1435648 c:\windows\system32\query.dll
- 2004-08-04 21:00 . 2008-04-14 04:42 1435648 c:\windows\system32\query.dll
+ 2005-08-30 11:54 . 2009-11-27 17:11 1291776 c:\windows\system32\quartz.dll
+ 2009-11-09 00:53 . 2009-07-31 09:05 1372672 c:\windows\system32\msxml6.dll
+ 2009-07-20 23:05 . 2009-07-20 23:05 1348432 c:\windows\system32\msxml4.dll
+ 2004-08-04 21:00 . 2009-06-10 08:19 2066432 c:\windows\system32\mstscax.dll
+ 2004-08-04 21:00 . 2009-08-06 18:23 1929952 c:\windows\system32\dllcache\wuaueng.dll
+ 2004-08-11 17:45 . 2009-05-20 11:44 2355200 c:\windows\system32\dllcache\WMVCore.dll
+ 2009-07-13 09:08 . 2009-07-13 09:08 5537792 c:\windows\system32\dllcache\wmp.dll
+ 2009-06-04 02:05 . 2009-08-14 13:21 1850624 c:\windows\system32\dllcache\win32k.sys
+ 2009-06-04 02:03 . 2010-03-10 04:33 1509888 c:\windows\system32\dllcache\shdocvw.dll
+ 2009-07-17 16:22 . 2009-07-17 16:22 1435648 c:\windows\system32\dllcache\query.dll
+ 2009-06-04 02:12 . 2009-11-27 17:11 1291776 c:\windows\system32\dllcache\quartz.dll
+ 2009-06-04 02:12 . 2010-02-17 08:10 2189952 c:\windows\system32\dllcache\ntoskrnl.exe
+ 2009-06-04 02:12 . 2010-02-16 13:25 2024448 c:\windows\system32\dllcache\ntkrpamp.exe
+ 2009-02-07 18:02 . 2010-02-16 13:25 2066816 c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2009-06-04 02:12 . 2010-02-16 14:08 2146304 c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2009-11-09 00:53 . 2009-07-31 09:05 1372672 c:\windows\system32\dllcache\msxml6.dll
+ 2009-06-04 02:04 . 2009-07-31 04:35 1172480 c:\windows\system32\dllcache\msxml3.dll
+ 2009-06-10 08:19 . 2009-06-10 08:19 2066432 c:\windows\system32\dllcache\mstscax.dll
+ 2009-06-04 02:03 . 2010-02-26 05:43 3073024 c:\windows\system32\dllcache\mshtml.dll
+ 2010-03-10 04:33 . 2010-03-10 04:33 1025024 c:\windows\system32\dllcache\browseui.dll
+ 2008-05-28 00:35 . 2008-05-28 00:35 1265664 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
- 2007-04-13 20:35 . 2007-04-13 20:35 1265664 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
- 2007-04-13 20:35 . 2007-04-13 20:35 1232896 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.dll
+ 2008-05-28 00:35 . 2008-05-28 00:35 1232896 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.dll
- 2007-04-13 19:57 . 2007-04-13 19:57 2514944 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
+ 2008-05-27 23:48 . 2008-05-27 23:48 2514944 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
+ 2008-05-27 23:48 . 2008-05-27 23:48 2523136 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
- 2007-04-13 19:57 . 2007-04-13 19:57 2523136 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
- 2007-04-13 19:50 . 2007-04-13 19:50 2142208 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
+ 2008-05-27 23:43 . 2008-05-27 23:43 2142208 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
+ 2010-04-29 17:25 . 2008-10-16 13:13 1809944 c:\windows\LastGood\system32\wuaueng.dll
+ 2009-06-04 02:12 . 2010-02-17 08:10 2189952 c:\windows\Driver Cache\i386\ntoskrnl.exe
+ 2009-06-04 02:12 . 2010-02-16 13:25 2024448 c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2009-02-07 18:02 . 2010-02-16 13:25 2066816 c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2009-06-04 02:12 . 2010-02-16 14:08 2146304 c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2009-06-05 02:04 . 2009-06-05 02:04 2088960 c:\windows\assembly\temp\Q08GOW5DLV\System.Xml.dll
+ 2009-06-05 02:03 . 2009-06-05 02:03 1966080 c:\windows\assembly\temp\DNW5ENW5EN\System.dll
+ 2009-06-05 02:03 . 2009-06-05 02:03 1232896 c:\windows\assembly\temp\BLT1AIRZ8H\System.dll
+ 2009-06-05 02:04 . 2009-06-05 02:04 3018752 c:\windows\assembly\temp\8KS09HPX6E\System.Windows.Forms.dll
+ 2009-06-05 02:04 . 2009-06-05 02:04 3391488 c:\windows\assembly\temp\2CKS08GOV2\mscorlib.dll
+ 2010-04-29 17:54 . 2010-04-29 17:54 1966080 c:\windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_abc7030b\System.dll
+ 2010-04-29 17:54 . 2010-04-29 17:54 2088960 c:\windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_d6f04675\System.Xml.dll
+ 2010-04-29 17:54 . 2010-04-29 17:54 3018752 c:\windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_971e427b\System.Windows.Forms.dll
+ 2010-04-29 17:54 . 2010-04-29 17:54 1470464 c:\windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_8d850bab\System.Design.dll
+ 2010-04-29 17:54 . 2010-04-29 17:54 3391488 c:\windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_7e9bc831\mscorlib.dll
+ 2010-04-29 17:53 . 2010-04-29 17:53 1232896 c:\windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
- 2009-06-05 02:03 . 2009-06-05 02:03 1232896 c:\windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
- 2009-06-05 02:03 . 2009-06-05 02:03 1265664 c:\windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
+ 2010-04-29 17:53 . 2010-04-29 17:53 1265664 c:\windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
+ 2009-08-14 19:33 . 2010-04-06 09:52 31971272 c:\windows\system32\MRT.exe
+ 2009-08-10 20:08 . 2009-08-10 20:08 11315712 c:\windows\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp
+ 2010-04-29 17:57 . 2010-04-29 17:57 15710720 c:\windows\Installer\b857e4.msp
+ 2009-08-10 13:09 . 2009-08-10 13:09 17254912 c:\windows\Installer\b857d1.msp
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-07-24 08:55 1090816 —-a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2009-06-03 21:27 218160 —-a-w- c:\program files\Hotspot Shield\hssie\HssIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-11-23 289584]
"Google Update"="c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-04-24 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-02-15 454656]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-04-17 61952]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-01 761946]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-04-11 102400]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-23 131072]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2006-01-26 40960]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"H2O"="c:\program files\SyncroSoft\Pos\H2O\cledx.exe" [2005-10-23 385024]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2010-03-18 2046816]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-31 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\User\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]
Traffic Counter.lnk - c:\program files\TrafficCounter\TrafficCounter.exe [2010-2-23 278528]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
HP Photosmart Premier Fast Start.lnk - c:\program files\Hp\Digital Imaging\bin\hpqthb08.exe [2005-9-24 73728]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-14 19:38 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"c:\\Program Files\\StreamTorrent 1.0\\StreamTorrent.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Novation\\Automap Universal\\AutomapServer.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [05/06/2009 05:26 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [14/08/2009 20:38 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [14/08/2009 20:38 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [14/08/2009 20:38 297752]
R2 HssWd;Hotspot Shield Monitoring Service;c:\program files\Hotspot Shield\bin\hsswd.exe [09/01/2010 00:42 285744]
R2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [08/12/2009 19:26 3616768]
R3 automap;Automap MIDI Driver Service;c:\windows\system32\drivers\automap.sys [15/12/2008 15:57 7168]
R3 CLEDX;Team H2O CLEDX service;c:\windows\system32\drivers\cledx.sys [26/02/2008 12:57 33792]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [09/03/2009 20:06 951632]
S3 NvnUsbAudio;Novation USB Audio Driver;c:\windows\system32\drivers\nvnusbaudio.sys [15/12/2008 15:56 31232]
.
Contents of the 'Scheduled Tasks' folder

2010-04-16 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 19:06]

2010-04-12 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-04-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3161424866-1566932716-876338741-1006Core.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-24 19:53]

2010-04-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3161424866-1566932716-876338741-1006UA.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-24 19:53]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://uk.ask.com?o=15153&l=dis
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=Q306&bd=pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: {{08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\qc9jhu0z.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo.co.uk
FF - prefs.js: browser.startup.homepage - hxxp://uk.ask.com/?o=312&l=dir
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - plugin: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\qc9jhu0z.default\extensions\[removed]\plugins\npTVUAx.dll
FF - plugin: c:\documents and settings\User\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-29 19:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ????R????????@???????@

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-04-29 19:14:57
ComboFix-quarantined-files.txt 2010-04-29 18:14
ComboFix2.txt 2010-04-29 14:35

Pre-Run: 37,027,979,264 bytes free
Post-Run: 36,989,648,896 bytes free

- - End Of File - - BE9469C39108645237E3A41470385ECF
Upload was successful

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Thursday, April 29, 2010
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Thursday, April 29, 2010 18:39:11
Records in database: 4003689
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Objects scanned: 81831
Threats found: 11
Infected objects found: 18
Suspicious objects found: 0
Scan duration: 02:02:53

File name / Threat / Threats count
C:\Documents and Settings\User\Application Data\Sun\Java\Deployment\cache\6.0\39\2c869fe7-59d3010f Infected: Exploit.OSX.Smid.c 1
C:\Documents and Settings\User\Application Data\Sun\Java\Deployment\cache\6.0\46\1862f8ee-4bd1af1a Infected: Exploit.OSX.Smid.b 1
C:\Program Files\EasyBits\KidsReady\Setup.exe Infected: Trojan.Win32.KillWin.iy 1
C:\Qoobox\Quarantine\C\WINDOWS\dmocafr.dll.vir Infected: Trojan-Downloader.Win32.Mufanom.iez 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\gxvxcewswwowbevpyxgwrqxnkfxhklxavymrm.sys.vir Infected: Packed.Win32.TDSS.z 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\gxvxcmxowkbmurrilrqujvsdrukejolwxvdlw.sys.vir Infected: Trojan.Win32.Tdss.aghr 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\gxvxcwamxeafrmmcvndwilroybaxwppyoviwt.sys.vir Infected: Packed.Win32.TDSS.z 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\gxvxcmpxyfwmqtxwskdsxtphvywpwiypdqbrp.dll.vir Infected: Trojan.Win32.Agent2.kit 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\gxvxcnkfrvaxralmkrurbtnqtjwfpkbpyoveq.dll.vir Infected: Trojan.Win32.Agent2.kny 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\_sdra64_.exe.zip Infected: Trojan-Spy.Win32.Zbot.ainv 1
C:\System Volume Information\_restore{6D05FAB2-7A62-4A96-A638-2F0B6A273527}\RP0\A0000001.dll Infected: Trojan.Win32.Agent2.kit 1
C:\System Volume Information\_restore{6D05FAB2-7A62-4A96-A638-2F0B6A273527}\RP0\A0000002.sys Infected: Trojan.Win32.Tdss.aghr 1
C:\System Volume Information\_restore{6D05FAB2-7A62-4A96-A638-2F0B6A273527}\RP0\A0000003.dll Infected: Trojan.Win32.Agent2.kny 1
C:\System Volume Information\_restore{6D05FAB2-7A62-4A96-A638-2F0B6A273527}\RP1\A0000077.dll Infected: Trojan-Downloader.Win32.Mufanom.iez 1
C:\System Volume Information\_restore{6D05FAB2-7A62-4A96-A638-2F0B6A273527}\RP1\A0000078.sys Infected: Packed.Win32.TDSS.z 1
C:\System Volume Information\_restore{6D05FAB2-7A62-4A96-A638-2F0B6A273527}\RP1\A0000079.sys Infected: Packed.Win32.TDSS.z 1
C:\_OTL\MovedFiles\03022010_164845\C_WINDOWS\system32\ecrm.goo Infected: Trojan.Win32.Fregee.l 1
C:\_OTL\MovedFiles\03022010_164845\C_WINDOWS\system32\qtru.lfo Infected: Trojan.Win32.Fregee.o 1

Selected area has been scanned.

tad ghostal

Post #11April 29, 2010, 8:58 PM UTC

Everything seems to be working OK now.

RPMcMurphy

Post #12April 29, 2010, 9:08 PM UTC

It looks like you used OTL last month. Do you still have it installed?

tad ghostal

Post #13April 29, 2010, 9:38 PM UTC

Yes I do. Got to go, thanks for the help, I'll check back tomorrow.

RPMcMurphy

Post #14April 30, 2010, 12:18 PM UTC

tad_ghostal,

🖼Click to load external image (Posted Image) Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Files
C:\Documents and Settings\User\Application Data\Sun\Java\Deployment\cache\6.0\39\2c869fe7-59d3010f
C:\Documents and Settings\User\Application Data\Sun\Java\Deployment\cache\6.0\46\1862f8ee-4bd1af1a

:Commands
[EmptyFlash]
[EmptyTemp]

Then click the Run Fix button at the top
Let the program run unhindered, it will reboot when it is done and produce a log

🖼Click to load external image (Posted Image) You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

Click the Update tab
Click Check for Updates
If an update is found, it will download and install the latest version.
The program will close to update and reopen.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Please include the following in your next post:

OTL Fix log
MBAM log

A new DDS.txt log

tad ghostal

Post #15April 30, 2010, 3:51 PM UTC

All processes killed
========== FILES ==========
C:\Documents and Settings\User\Application Data\Sun\Java\Deployment\cache\6.0\39\2c869fe7-59d3010f moved successfully.
C:\Documents and Settings\User\Application Data\Sun\Java\Deployment\cache\6.0\46\1862f8ee-4bd1af1a moved successfully.
========== COMMANDS ==========
Error: Unable to interpret <[EmptyFlash]> in the current context!

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 16786 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 16786 bytes

User: User
->Temp folder emptied: 105934561 bytes
->Temporary Internet Files folder emptied: 5385319 bytes
->Java cache emptied: 38186605 bytes
->FireFox cache emptied: 85984655 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 225.00 mb

OTL by OldTimer - Version 3.1.30.3 log created on 04302010_162835

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

30/04/2010 16:45:38
mbam-log-2010-04-30 (16-45-38).txt

Scan type: Quick scan
Objects scanned: 123274
Time elapsed: 6 minute(s), 1 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 10
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{3446af26-b8d7-199b-4cfc-6fd764ca5c9f} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{4776c4dc-e894-7c06-2148-5d73cef5f905} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{3446af26-b8d7-199b-4cfc-6fd764ca5c9f} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{4776c4dc-e894-7c06-2148-5d73cef5f905} (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 16:48:49.14 on 30/04/2010
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.2038.1500 [GMT 1:00]

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\Program Files\Hotspot Shield\bin\hsswd.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\notepad.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\Hotspot Shield\bin\openvpntray.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\AVG\AVG8\avgui.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\User\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://uk.ask.com?o=15153&l=dis
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=Q306&bd=pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: Hotspot Shield Class: {f9e4a054-e9b1-4bc3-83a3-76a1ae736170} - c:\program files\hotspot shield\hssie\HssIE.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
uRun: [Google Update] "c:\documents and settings\user\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe
mRun: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe
mRun: [RecGuard] c:\windows\sminst\RecGuard.exe
mRun: [H2O] c:\program files\syncrosoft\pos\h2o\cledx.exe
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\user\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\docume~1\user\startm~1\programs\startup\traffi~1.lnk - c:\program files\trafficcounter\TrafficCounter.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpphot~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office10\EXCEL.EXE/3000
IE: {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {7F9DB11C-E358-4ca6-A83D-ACC663939424} - {9999A076-A9E2-4C99-8A2B-632FC9429223} - c:\program files\bonjour\ExplorerPlugin.dll
DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxdev.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\user\applic~1\mozilla\firefox\profiles\qc9jhu0z.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo.co.uk
FF - prefs.js: browser.startup.homepage - hxxp://uk.ask.com/?o=312&l=dir
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - plugin: c:\documents and settings\user\application data\mozilla\firefox\profiles\qc9jhu0z.default\extensions\[removed]\plugins\npTVUAx.dll
FF - plugin: c:\documents and settings\user\local settings\application data\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-6-5 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-8-14 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-8-14 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-8-14 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-8-14 297752]
R2 HssWd;Hotspot Shield Monitoring Service;c:\program files\hotspot shield\bin\hsswd.exe [2010-1-9 285744]
R2 NIHardwareService;NIHardwareService;c:\program files\common files\native instruments\hardware\NIHardwareService.exe [2009-12-8 3616768]
R3 automap;Automap MIDI Driver Service;c:\windows\system32\drivers\automap.sys [2008-12-15 7168]
R3 CLEDX;Team H2O CLEDX service;c:\windows\system32\drivers\cledx.sys [2008-2-26 33792]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 951632]
S3 NvnUsbAudio;Novation USB Audio Driver;c:\windows\system32\drivers\nvnusbaudio.sys [2008-12-15 31232]

=============== Created Last 30 ================

2010-04-29 18:08:43 0 d—–w- C:\tadg.com29446t
2010-04-29 17:56:28 0 d—–w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-04-29 17:36:32 471552 ——w- c:\windows\system32\dllcache\aclayers.dll
2010-04-29 17:36:09 1315328 ——w- c:\windows\system32\dllcache\msoe.dll
2010-04-29 17:34:59 81920 ——w- c:\windows\system32\dllcache\fontsub.dll
2010-04-29 17:34:59 119808 ——w- c:\windows\system32\dllcache\t2embed.dll
2010-04-29 17:34:46 128512 ——w- c:\windows\system32\dllcache\dhtmled.ocx
2010-04-29 17:32:45 153088 ——w- c:\windows\system32\dllcache\triedit.dll
2010-04-29 17:32:36 3558912 ——w- c:\windows\system32\dllcache\moviemk.exe
2010-04-29 17:31:39 293376 ——w- c:\windows\system32\browserchoice.exe
2010-04-29 17:29:30 512000 ——w- c:\windows\system32\dllcache\jscript.dll
2010-04-29 17:25:27 274288 —-a-w- c:\windows\system32\mucltui.dll
2010-04-29 17:25:27 215920 —-a-w- c:\windows\system32\muweb.dll
2010-04-29 17:25:27 16736 —-a-w- c:\windows\system32\mucltui.dll.mui
2010-04-29 14:07:17 0 d-sha-r- C:\cmdcons
2010-04-29 14:05:54 98816 —-a-w- c:\windows\sed.exe
2010-04-29 14:05:54 77312 —-a-w- c:\windows\MBR.exe
2010-04-29 14:05:54 256512 —-a-w- c:\windows\PEV.exe
2010-04-29 14:05:54 161792 —-a-w- c:\windows\SWREG.exe
2010-04-29 14:05:40 0 d—–w- C:\tadg.com
2010-04-09 01:07:47 0 d—–w- c:\docume~1\user\applic~1\TVU Networks

==================== Find3M ====================

2010-04-29 14:39:38 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 14:39:26 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-19 12:12:36 65280 —-a-w- c:\docume~1\user\applic~1\GDIPFONTCACHEV1.DAT
2010-03-10 04:33:41 1509888 ——w- c:\windows\system32\dllcache\shdocvw.dll
2010-03-10 04:33:38 1025024 ——w- c:\windows\system32\dllcache\browseui.dll
2010-03-09 11:09:18 430080 —-a-w- c:\windows\system32\vbscript.dll
2010-03-09 11:09:18 430080 ——w- c:\windows\system32\dllcache\vbscript.dll
2010-02-26 05:43:57 667136 —-a-w- c:\windows\system32\wininet.dll
2010-02-26 05:43:57 667136 ——w- c:\windows\system32\dllcache\wininet.dll
2010-02-26 05:43:57 627712 ——w- c:\windows\system32\dllcache\urlmon.dll
2010-02-26 05:43:55 3073024 ——w- c:\windows\system32\dllcache\mshtml.dll
2010-02-26 05:43:54 81920 —-a-w- c:\windows\system32\ieencode.dll
2010-02-26 05:43:54 81920 ——w- c:\windows\system32\dllcache\ieencode.dll
2010-02-26 05:43:54 251904 ——w- c:\windows\system32\dllcache\iepeers.dll
2010-02-24 13:11:07 455680 ——w- c:\windows\system32\dllcache\mrxsmb.sys
2010-02-17 08:10:28 2189952 ——w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-02-16 14:08:49 2146304 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 14:08:49 2146304 ——w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-02-16 13:25:04 2066816 ——w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-02-16 13:25:04 2024448 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-16 13:25:04 2024448 ——w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-02-12 04:33:11 100864 —-a-w- c:\windows\system32\6to4svc.dll
2010-02-12 04:33:11 100864 ——w- c:\windows\system32\dllcache\6to4svc.dll
2010-02-11 12:02:15 226880 ——w- c:\windows\system32\dllcache\tcpip6.sys
2010-01-31 20:53:43 411368 —-a-w- c:\windows\system32\deploytk.dll
2008-11-19 21:56:22 22 –sha-w- c:\windows\sminst\HPCD.sys

============= FINISH: 16:49:12.06 ===============

✨ Ask AI

Ask AI