[Solved] being redirected

74C Topic Starter

Post #1May 27, 2010, 2:27 AM UTC

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:17:52 PM, on 5/26/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\stsystra.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NETGEAR\WN111v2\WN111V2.exe
C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Chris\Local Settings\Temporary Internet Files\Content.IE5\S0E75YWI\HiJackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [jswtrayutil] "C:\Program Files\NETGEAR\WN111v2\jswtrayutil.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: NETGEAR WN111v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WN111v2\WN111V2.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo…20Installer.cab
O16 - DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} (Bl_camera Control) - http://peakbjj.viewnetcam.com:50000/bl_camera.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\NETGEAR\WN111v2\jswpsapi.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe

–
End of file - 9467 bytes

RPMcMurphy

Post #2May 27, 2010, 3:30 PM UTC

Hello 74C and welcome to WhatTheTech. I’ll be happy to look over your log and help you with your issues. It will be very helpful if you follow these guidelines:

Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
Please do not run any scans or install/uninstall any applications without being directed to do so.
Please follow my instructions carefully and in the order they are posted.
Any underlined text in my posts indicates a clickable link.
You should print any instructions I give you for ease of use and reference.
If you have any questions at all, please stop and ask before proceeding.

🖼Click to load external image (Posted Image) Please download DDS by sUBs from one of the following links and save it to your desktop.

- DDS.scr
- DDS.pif
Disable any script blocking protection (How to Disable your Security Programs)
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.

—————————————————

Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

🖼Click to load external image (Posted Image) Download GMER Rootkit Scanner from here to your desktop.

Double click the exe file. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)a
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If you have trouble running GEMR:

Make sure that your security software is disabled
Uncheck the box next to "Files" this time also
If you still can't run it, try in the Safe Mode

Please include the following in your next post:

DDS and Attach.txt logs

GMER log

74C

Post #3May 29, 2010, 4:24 AM UTC

Hello RPMcMurphy. Thank you for your help.

DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 22:40:25.13 on Fri 05/28/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.287 [GMT -5:00]

AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\stsystra.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NETGEAR\WN111v2\WN111V2.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Documents and Settings\Chris\Desktop\dds.scr

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [jswtrayutil] "c:\program files\netgear\wn111v2\jswtrayutil.exe"
mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"
mRun: [CTSysVol] c:\program files\creative\sbaudigy2zs\surround mixer\CTSysVol.exe /r
mRun: [CTDVDDET] "c:\program files\creative\sbaudigy2zs\dvdaudio\CTDVDDET.EXE"
mRun: [CTHelper] CTHELPER.EXE
mRun: [UpdReg] c:\windows\UpdReg.EXE
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wn111v2\WN111V2.exe
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxps://activatemyfios.verizon.net/sdcCommon/download/FIOS/Verizon%20FiOS%20Installer.cab
DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} - hxxp://peakbjj.viewnetcam.com:50000/bl_camera.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: GoToAssist - c:\program files\citrix\gotoassist\514\G2AWinLogon.dll

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-5-26 64288]
R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-11-4 214664]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-2-4 1314704]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2010-1-24 93320]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2010-1-24 359952]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2010-1-24 144704]
R3 JSWSCIMD;jswscimd Service;c:\windows\system32\drivers\jswscimd.sys [2008-10-1 57440]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-1-24 79816]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-1-24 35272]
R3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2010-1-24 34248]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [2003-7-24 17149]
S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\netgear\wn111v2\jswpsapi.exe [2008-2-27 360547]
S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2010-1-24 40552]
S3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service;c:\windows\system32\drivers\WN111v2.sys [2008-9-30 453120]
S4 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2010-1-24 606736]

=============== Created Last 30 ================

2010-05-27 02:50:32 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-05-27 01:51:59 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-05-27 01:51:55 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-05-27 01:50:26 0 dc-h–w- c:\docume~1\alluse~1\applic~1\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-05-27 01:49:55 0 d—–w- c:\program files\Lavasoft
2010-05-21 04:37:56 53664 —ha-w- c:\windows\system32\mlfcache.dat
2010-05-14 22:34:17 0 d—–w- c:\docume~1\chris\applic~1\Verizon
2010-05-12 20:26:01 0 d—–w- c:\program files\common files\SupportSoft
2010-05-12 20:26:00 0 d—–w- c:\windows\FIOS
2010-05-12 20:23:00 0 d—–w- c:\program files\Verizon
2010-05-12 20:16:12 0 d—–w- c:\docume~1\chris\applic~1\TechWizard

==================== Find3M ====================

2010-03-10 06:15:52 420352 —-a-w- c:\windows\system32\vbscript.dll
2010-01-29 04:52:09 32768 –sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012010011820100125\index.dat
2010-01-29 04:52:09 32768 –sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012010012820100129\index.dat

============= FINISH: 22:41:44.04 ===============

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-05-28 22:58:05
Windows 5.1.2600 Service Pack 3
Running: 22k74mqf.exe; Driver: C:\DOCUME~1\Chris\LOCALS~1\Temp\kfdcapoc.sys

—- System - GMER 1.0.15 —-

SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xF758287E]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xF7582BFE]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xEE47278A]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xEE472738]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xEE47274C]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xEE472837]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xEE472863]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateKey [0xEE4728D1]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateValueKey [0xEE4728BB]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xEE4727CA]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0xEE4728FD]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xEE47280D]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xEE472710]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xEE472724]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xEE47279E]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryKey [0xEE472939]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0xEE4728A5]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryValueKey [0xEE47288F]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xEE47284D]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0xEE472925]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0xEE472911]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0xEE472776]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xEE472762]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xEE4727F9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnloadKey [0xEE4728E7]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xEE4727E0]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xEE4727B4]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwYieldExecution 80504AF4 7 Bytes JMP EE4727B8 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtCreateFile 80579084 5 Bytes JMP EE47278E \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtMapViewOfSection 805B1FE6 7 Bytes JMP EE4727CE \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwUnmapViewOfSection 805B2DF4 5 Bytes JMP EE4727E4 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwProtectVirtualMemory 805B83CA 7 Bytes JMP EE4727A2 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtOpenProcess 805CB3FA 5 Bytes JMP EE472714 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtOpenThread 805CB686 5 Bytes JMP EE472728 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtSetInformationProcess 805CDE44 5 Bytes JMP EE472766 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwCreateProcessEx 805D1134 7 Bytes JMP EE472750 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwCreateProcess 805D11EA 5 Bytes JMP EE47273C \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwSetContextThread 805D16F4 5 Bytes JMP EE47277A \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwTerminateProcess 805D2982 5 Bytes JMP EE4727FD \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwQueryValueKey 806219EC 7 Bytes JMP EE472893 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwUnloadKey 80622064 7 Bytes JMP EE4728EB \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwQueryMultipleValueKey 80622916 7 Bytes JMP EE4728A9 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwRenameKey 806231EA 7 Bytes JMP EE472851 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwDeleteKey 80623C64 7 Bytes JMP EE47283B \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwDeleteValueKey 80623E34 7 Bytes JMP EE472867 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwEnumerateKey 80624014 7 Bytes JMP EE4728D5 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwEnumerateValueKey 8062427E 7 Bytes JMP EE4728BF \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwOpenKey 80624BA6 5 Bytes JMP EE472811 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwQueryKey 80624EE8 7 Bytes JMP EE47293D \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwRestoreKey 806251A8 5 Bytes JMP EE472915 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwReplaceKey 8062589C 5 Bytes JMP EE472929 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwNotifyChangeKey 806259B6 5 Bytes JMP EE472901 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
init C:\WINDOWS\system32\DRIVERS\mohfilt.sys entry point in "init" section [0xF791D720]

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\system32\svchost.exe[544] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00CE0FE5
.text C:\WINDOWS\system32\svchost.exe[544] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00CE007D
.text C:\WINDOWS\system32\svchost.exe[544] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00CE0F92
.text C:\WINDOWS\system32\svchost.exe[544] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00CE006C
.text C:\WINDOWS\system32\svchost.exe[544] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00CE0FAF
.text C:\WINDOWS\system32\svchost.exe[544] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00CE0040
.text C:\WINDOWS\system32\svchost.exe[544] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00CE0098
.text C:\WINDOWS\system32\svchost.exe[544] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00CE0F5C
.text C:\WINDOWS\system32\svchost.exe[544] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00CE00CE
.text C:\WINDOWS\system32\svchost.exe[544] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00CE00BD
.text C:\WINDOWS\system32\svchost.exe[544] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00CE00DF
.text C:\WINDOWS\system32\svchost.exe[544] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00CE0051
.text C:\WINDOWS\system32\svchost.exe[544] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00CE0000
.text C:\WINDOWS\system32\svchost.exe[544] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00CE0F6D
.text C:\WINDOWS\system32\svchost.exe[544] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00CE0025
.text C:\WINDOWS\system32\svchost.exe[544] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00CE0FD4
.text C:\WINDOWS\system32\svchost.exe[544] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00CE0F35
.text C:\WINDOWS\system32\svchost.exe[544] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00BD0036
.text C:\WINDOWS\system32\svchost.exe[544] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00BD0073
.text C:\WINDOWS\system32\svchost.exe[544] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00BD0FE5
.text C:\WINDOWS\system32\svchost.exe[544] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00BD001B
.text C:\WINDOWS\system32\svchost.exe[544] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00BD0058
.text C:\WINDOWS\system32\svchost.exe[544] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00BD0000
.text C:\WINDOWS\system32\svchost.exe[544] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00BD0047
.text C:\WINDOWS\system32\svchost.exe[544] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00BD0FC0
.text C:\WINDOWS\system32\svchost.exe[544] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00BC0047
.text C:\WINDOWS\system32\svchost.exe[544] msvcrt.dll!system 77C293C7 5 Bytes JMP 00BC002C
.text C:\WINDOWS\system32\svchost.exe[544] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00BC0FC6
.text C:\WINDOWS\system32\svchost.exe[544] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00BC0000
.text C:\WINDOWS\system32\svchost.exe[544] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00BC0011
.text C:\WINDOWS\system32\svchost.exe[544] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00BC0FE3
.text C:\WINDOWS\system32\svchost.exe[544] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 00BA0FEF
.text C:\WINDOWS\system32\svchost.exe[544] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 00BA000A
.text C:\WINDOWS\system32\svchost.exe[544] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 00BA0FDE
.text C:\WINDOWS\system32\svchost.exe[544] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 00BA0FCD
.text C:\WINDOWS\system32\svchost.exe[544] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BB0000
.text C:\WINDOWS\Explorer.EXE[868] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00B7000A
.text C:\WINDOWS\Explorer.EXE[868] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00C1000A
.text C:\WINDOWS\Explorer.EXE[868] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00B6000C
.text C:\WINDOWS\Explorer.EXE[868] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 02360000
.text C:\WINDOWS\Explorer.EXE[868] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 02360F69
.text C:\WINDOWS\Explorer.EXE[868] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 02360F7A
.text C:\WINDOWS\Explorer.EXE[868] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 02360F97
.text C:\WINDOWS\Explorer.EXE[868] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 02360FA8
.text C:\WINDOWS\Explorer.EXE[868] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0236002F
.text C:\WINDOWS\Explorer.EXE[868] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 02360085
.text C:\WINDOWS\Explorer.EXE[868] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 02360F3D
.text C:\WINDOWS\Explorer.EXE[868] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 02360F2C
.text C:\WINDOWS\Explorer.EXE[868] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 023600C5
.text C:\WINDOWS\Explorer.EXE[868] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 023600E0
.text C:\WINDOWS\Explorer.EXE[868] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 0236004A
.text C:\WINDOWS\Explorer.EXE[868] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 02360FE5
.text C:\WINDOWS\Explorer.EXE[868] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 02360F4E
.text C:\WINDOWS\Explorer.EXE[868] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 02360FC3
.text C:\WINDOWS\Explorer.EXE[868] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 02360FD4
.text C:\WINDOWS\Explorer.EXE[868] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 023600AA
.text C:\WINDOWS\Explorer.EXE[868] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 021D0FCA
.text C:\WINDOWS\Explorer.EXE[868] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 021D0F94
.text C:\WINDOWS\Explorer.EXE[868] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 021D0FE5
.text C:\WINDOWS\Explorer.EXE[868] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 021D001B
.text C:\WINDOWS\Explorer.EXE[868] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 021D0051
.text C:\WINDOWS\Explorer.EXE[868] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 021D0000
.text C:\WINDOWS\Explorer.EXE[868] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 021D0FB9
.text C:\WINDOWS\Explorer.EXE[868] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [3D, 8A]
.text C:\WINDOWS\Explorer.EXE[868] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 021D0036
.text C:\WINDOWS\Explorer.EXE[868] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 01B9004E
.text C:\WINDOWS\Explorer.EXE[868] msvcrt.dll!system 77C293C7 5 Bytes JMP 01B90FB9
.text C:\WINDOWS\Explorer.EXE[868] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 01B90FD4
.text C:\WINDOWS\Explorer.EXE[868] msvcrt.dll!_open 77C2F566 5 Bytes JMP 01B9000C
.text C:\WINDOWS\Explorer.EXE[868] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 01B90029
.text C:\WINDOWS\Explorer.EXE[868] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 01B90FEF
.text C:\WINDOWS\Explorer.EXE[868] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 01AB000A
.text C:\WINDOWS\Explorer.EXE[868] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 01AB0FEF
.text C:\WINDOWS\Explorer.EXE[868] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 01AB0025
.text C:\WINDOWS\Explorer.EXE[868] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 01AB0FD4
.text C:\WINDOWS\Explorer.EXE[868] WS2_32.dll!socket 71AB4211 5 Bytes JMP 01AC0000
.text C:\WINDOWS\system32\services.exe[1200] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BC0FEF
.text C:\WINDOWS\system32\services.exe[1200] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BC0F30
.text C:\WINDOWS\system32\services.exe[1200] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BC0025
.text C:\WINDOWS\system32\services.exe[1200] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BC0F57
.text C:\WINDOWS\system32\services.exe[1200] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BC0F68
.text C:\WINDOWS\system32\services.exe[1200] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BC000A
.text C:\WINDOWS\system32\services.exe[1200] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BC0EFA
.text C:\WINDOWS\system32\services.exe[1200] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BC0042
.text C:\WINDOWS\system32\services.exe[1200] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BC0EBD
.text C:\WINDOWS\system32\services.exe[1200] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BC0ECE
.text C:\WINDOWS\system32\services.exe[1200] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00BC0071
.text C:\WINDOWS\system32\services.exe[1200] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00BC0F79
.text C:\WINDOWS\system32\services.exe[1200] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00BC0FD4
.text C:\WINDOWS\system32\services.exe[1200] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00BC0F0B
.text C:\WINDOWS\system32\services.exe[1200] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00BC0F9E
.text C:\WINDOWS\system32\services.exe[1200] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00BC0FB9
.text C:\WINDOWS\system32\services.exe[1200] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00BC0EE9
.text C:\WINDOWS\system32\services.exe[1200] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00070036
.text C:\WINDOWS\system32\services.exe[1200] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00070F9E
.text C:\WINDOWS\system32\services.exe[1200] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00070FE5
.text C:\WINDOWS\system32\services.exe[1200] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0007001B
.text C:\WINDOWS\system32\services.exe[1200] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00070FAF
.text C:\WINDOWS\system32\services.exe[1200] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 0007000A
.text C:\WINDOWS\system32\services.exe[1200] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 0007005B
.text C:\WINDOWS\system32\services.exe[1200] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00070FCA
.text C:\WINDOWS\system32\services.exe[1200] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00060FB4
.text C:\WINDOWS\system32\services.exe[1200] msvcrt.dll!system 77C293C7 5 Bytes JMP 0006003F
.text C:\WINDOWS\system32\services.exe[1200] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00060FD9
.text C:\WINDOWS\system32\services.exe[1200] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00060000
.text C:\WINDOWS\system32\services.exe[1200] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 0006002E
.text C:\WINDOWS\system32\services.exe[1200] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0006001D
.text C:\WINDOWS\system32\services.exe[1200] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 00040000
.text C:\WINDOWS\system32\services.exe[1200] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 00040FE5
.text C:\WINDOWS\system32\services.exe[1200] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 00040FCA
.text C:\WINDOWS\system32\services.exe[1200] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 00040FB9
.text C:\WINDOWS\system32\services.exe[1200] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00050FEF
.text C:\WINDOWS\system32\lsass.exe[1212] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 01190FEF
.text C:\WINDOWS\system32\lsass.exe[1212] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 01190F5C
.text C:\WINDOWS\system32\lsass.exe[1212] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 01190F77
.text C:\WINDOWS\system32\lsass.exe[1212] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0119005B
.text C:\WINDOWS\system32\lsass.exe[1212] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 01190F9E
.text C:\WINDOWS\system32\lsass.exe[1212] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 01190025
.text C:\WINDOWS\system32\lsass.exe[1212] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 01190F1F
.text C:\WINDOWS\system32\lsass.exe[1212] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 01190F30
.text C:\WINDOWS\system32\lsass.exe[1212] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 01190EDF
.text C:\WINDOWS\system32\lsass.exe[1212] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 01190EFA
.text C:\WINDOWS\system32\lsass.exe[1212] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 01190ECE
.text C:\WINDOWS\system32\lsass.exe[1212] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 01190040
.text C:\WINDOWS\system32\lsass.exe[1212] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 01190FD4
.text C:\WINDOWS\system32\lsass.exe[1212] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 01190F4B
.text C:\WINDOWS\system32\lsass.exe[1212] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 01190014
.text C:\WINDOWS\system32\lsass.exe[1212] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 01190FC3
.text C:\WINDOWS\system32\lsass.exe[1212] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 01190078
.text C:\WINDOWS\system32\lsass.exe[1212] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 01180FD4
.text C:\WINDOWS\system32\lsass.exe[1212] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 0118006C
.text C:\WINDOWS\system32\lsass.exe[1212] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 01180025
.text C:\WINDOWS\system32\lsass.exe[1212] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0118000A
.text C:\WINDOWS\system32\lsass.exe[1212] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 01180051
.text C:\WINDOWS\system32\lsass.exe[1212] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 01180FEF
.text C:\WINDOWS\system32\lsass.exe[1212] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 01180FAF
.text C:\WINDOWS\system32\lsass.exe[1212] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [38, 89]
.text C:\WINDOWS\system32\lsass.exe[1212] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 01180040
.text C:\WINDOWS\system32\lsass.exe[1212] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00FF0FAB
.text C:\WINDOWS\system32\lsass.exe[1212] msvcrt.dll!system 77C293C7 5 Bytes JMP 00FF002C
.text C:\WINDOWS\system32\lsass.exe[1212] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00FF0FC6
.text C:\WINDOWS\system32\lsass.exe[1212] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00FF0FE3
.text C:\WINDOWS\system32\lsass.exe[1212] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00FF001B
.text C:\WINDOWS\system32\lsass.exe[1212] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00FF0000
.text C:\WINDOWS\system32\lsass.exe[1212] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00FE0000
.text C:\WINDOWS\system32\lsass.exe[1212] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 00FD0000
.text C:\WINDOWS\system32\lsass.exe[1212] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 00FD0FDB
.text C:\WINDOWS\system32\lsass.exe[1212] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 00FD0011
.text C:\WINDOWS\system32\lsass.exe[1212] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 00FD0FCA
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00E2000A
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00E3000A
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00E1000C
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00380FB9
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 0038005B
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00380FD4
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00380000
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00380F9E
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00380FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00380036
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00380025
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDAC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E473F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4671 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E46DC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4542 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E45A4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E47A2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4606 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 0039004B
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] msvcrt.dll!system 77C293C7 5 Bytes JMP 0039003A
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00390FD4
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00390FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00390029
.text C:\Program Files\Internet Explorer\iexplore.exe[1332] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0039000C
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 02450FEF
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 02450F5F
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 02450F7A
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 02450F8B
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 02450FB2
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 02450054
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 02450F27
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 02450F4E
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 024500A5
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 02450F0C
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 024500C0
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 02450FCD
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 02450014
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 02450079
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 02450FDE
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 0245002F
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 0245008A
.text C:\WINDOWS\system32\svchost.exe[1440] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 02440FE5
.text C:\WINDOWS\system32\svchost.exe[1440] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 02440FB6
.text C:\WINDOWS\system32\svchost.exe[1440] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 02440036
.text C:\WINDOWS\system32\svchost.exe[1440] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0244001B
.text C:\WINDOWS\system32\svchost.exe[1440] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 0244007D
.text C:\WINDOWS\system32\svchost.exe[1440] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 0244000A
.text C:\WINDOWS\system32\svchost.exe[1440] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 0244006C
.text C:\WINDOWS\system32\svchost.exe[1440] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 0244005B
.text C:\WINDOWS\system32\svchost.exe[1440] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 02430027
.text C:\WINDOWS\system32\svchost.exe[1440] msvcrt.dll!system 77C293C7 5 Bytes JMP 02430F9C
.text C:\WINDOWS\system32\svchost.exe[1440] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 0243000C
.text C:\WINDOWS\system32\svchost.exe[1440] msvcrt.dll!_open 77C2F566 5 Bytes JMP 02430FEF
.text C:\WINDOWS\system32\svchost.exe[1440] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 02430FB7
.text C:\WINDOWS\system32\svchost.exe[1440] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 02430FD2
.text C:\WINDOWS\system32\svchost.exe[1440] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 02410FE5
.text C:\WINDOWS\system32\svchost.exe[1440] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 02410000
.text C:\WINDOWS\system32\svchost.exe[1440] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 0241001B
.text C:\WINDOWS\system32\svchost.exe[1440] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 0241002C
.text C:\WINDOWS\system32\svchost.exe[1440] WS2_32.dll!socket 71AB4211 5 Bytes JMP 02420FEF
.text C:\WINDOWS\system32\svchost.exe[1540] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 01160FEF
.text C:\WINDOWS\system32\svchost.exe[1540] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 01160F6D
.text C:\WINDOWS\system32\svchost.exe[1540] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 01160F7E
.text C:\WINDOWS\system32\svchost.exe[1540] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 01160F9B
.text C:\WINDOWS\system32\svchost.exe[1540] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 01160058
.text C:\WINDOWS\system32\svchost.exe[1540] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 01160FC0
.text C:\WINDOWS\system32\svchost.exe[1540] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 01160089
.text C:\WINDOWS\system32\svchost.exe[1540] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 01160F41
.text C:\WINDOWS\system32\svchost.exe[1540] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 011600BF
.text C:\WINDOWS\system32\svchost.exe[1540] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 01160F26
.text C:\WINDOWS\system32\svchost.exe[1540] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 011600DA
.text C:\WINDOWS\system32\svchost.exe[1540] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 0116003D
.text C:\WINDOWS\system32\svchost.exe[1540] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 01160000
.text C:\WINDOWS\system32\svchost.exe[1540] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 01160F52
.text C:\WINDOWS\system32\svchost.exe[1540] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 0116002C
.text C:\WINDOWS\system32\svchost.exe[1540] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 0116001B
.text C:\WINDOWS\system32\svchost.exe[1540] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 011600AE
.text C:\WINDOWS\system32\svchost.exe[1540] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 01150025
.text C:\WINDOWS\system32\svchost.exe[1540] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 01150FA8
.text C:\WINDOWS\system32\svchost.exe[1540] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 01150FDE
.text C:\WINDOWS\system32\svchost.exe[1540] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 01150014
.text C:\WINDOWS\system32\svchost.exe[1540] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 0115005B
.text C:\WINDOWS\system32\svchost.exe[1540] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 01150FEF
.text C:\WINDOWS\system32\svchost.exe[1540] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 01150FB9
.text C:\WINDOWS\system32\svchost.exe[1540] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [35, 89]
.text C:\WINDOWS\system32\svchost.exe[1540] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 01150040
.text C:\WINDOWS\system32\svchost.exe[1540] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00FF0FA3
.text C:\WINDOWS\system32\svchost.exe[1540] msvcrt.dll!system 77C293C7 5 Bytes JMP 00FF002E
.text C:\WINDOWS\system32\svchost.exe[1540] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00FF001D
.text C:\WINDOWS\system32\svchost.exe[1540] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00FF0FEF
.text C:\WINDOWS\system32\svchost.exe[1540] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00FF0FBE
.text C:\WINDOWS\system32\svchost.exe[1540] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00FF000C
.text C:\WINDOWS\system32\svchost.exe[1540] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 00FD0000
.text C:\WINDOWS\system32\svchost.exe[1540] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 00FD0FEF
.text C:\WINDOWS\system32\svchost.exe[1540] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 00FD001B
.text C:\WINDOWS\system32\svchost.exe[1540] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 00FD002C
.text C:\WINDOWS\system32\svchost.exe[1540] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00FE0FE5
.text C:\Program Files\Messenger\msmsgs.exe[1580] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 01B60FEF
.text C:\Program Files\Messenger\msmsgs.exe[1580] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 01B60FA1
.text C:\Program Files\Messenger\msmsgs.exe[1580] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 01B6008C
.text C:\Program Files\Messenger\msmsgs.exe[1580] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 01B6006F
.text C:\Program Files\Messenger\msmsgs.exe[1580] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 01B60FB2
.text C:\Program Files\Messenger\msmsgs.exe[1580] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 01B60039
.text C:\Program Files\Messenger\msmsgs.exe[1580] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 01B600A7
.text C:\Program Files\Messenger\msmsgs.exe[1580] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 01B60F5F
.text C:\Program Files\Messenger\msmsgs.exe[1580] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 01B60F29
.text C:\Program Files\Messenger\msmsgs.exe[1580] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 01B600C2
.text C:\Program Files\Messenger\msmsgs.exe[1580] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 01B60F18
.text C:\Program Files\Messenger\msmsgs.exe[1580] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 01B60054
.text C:\Program Files\Messenger\msmsgs.exe[1580] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 01B60014
.text C:\Program Files\Messenger\msmsgs.exe[1580] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 01B60F86
.text C:\Program Files\Messenger\msmsgs.exe[1580] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 01B60FCD
.text C:\Program Files\Messenger\msmsgs.exe[1580] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 01B60FDE
.text C:\Program Files\Messenger\msmsgs.exe[1580] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 01B60F44
.text C:\Program Files\Messenger\msmsgs.exe[1580] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00FF0042
.text C:\Program Files\Messenger\msmsgs.exe[1580] msvcrt.dll!system 77C293C7 5 Bytes JMP 00FF0FB7
.text C:\Program Files\Messenger\msmsgs.exe[1580] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00FF001D
.text C:\Program Files\Messenger\msmsgs.exe[1580] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00FF0FEF
.text C:\Program Files\Messenger\msmsgs.exe[1580] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00FF0FC8
.text C:\Program Files\Messenger\msmsgs.exe[1580] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00FF000C
.text C:\Program Files\Messenger\msmsgs.exe[1580] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 01B50FD4
.text C:\Program Files\Messenger\msmsgs.exe[1580] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 01B5005B
.text C:\Program Files\Messenger\msmsgs.exe[1580] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 01B50025
.text C:\Program Files\Messenger\msmsgs.exe[1580] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 01B5000A
.text C:\Program Files\Messenger\msmsgs.exe[1580] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 01B5004A
.text C:\Program Files\Messenger\msmsgs.exe[1580] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 01B50FEF
.text C:\Program Files\Messenger\msmsgs.exe[1580] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 01B50FA8
.text C:\Program Files\Messenger\msmsgs.exe[1580] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [D5, 89] {AAD 0x89}
.text C:\Program Files\Messenger\msmsgs.exe[1580] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 01B50FC3
.text C:\Program Files\Messenger\msmsgs.exe[1580] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00FE0000
.text C:\Program Files\Messenger\msmsgs.exe[1580] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 00FA0000
.text C:\Program Files\Messenger\msmsgs.exe[1580] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 00FA0FE5
.text C:\Program Files\Messenger\msmsgs.exe[1580] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 00FA001B
.text C:\Program Files\Messenger\msmsgs.exe[1580] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 00FA0FCA
.text C:\WINDOWS\System32\svchost.exe[1696] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 009A000A
.text C:\WINDOWS\System32\svchost.exe[1696] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 009B000A
.text C:\WINDOWS\System32\svchost.exe[1696] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 0099000C
.text C:\WINDOWS\System32\svchost.exe[1696] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 021D0FEF
.text C:\WINDOWS\System32\svchost.exe[1696] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 021D0078
.text C:\WINDOWS\System32\svchost.exe[1696] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 021D0067
.text C:\WINDOWS\System32\svchost.exe[1696] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 021D0056
.text C:\WINDOWS\System32\svchost.exe[1696] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 021D0F97
.text C:\WINDOWS\System32\svchost.exe[1696] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 021D0FC3
.text C:\WINDOWS\System32\svchost.exe[1696] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 021D00C1
.text C:\WINDOWS\System32\svchost.exe[1696] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 021D00A6
.text C:\WINDOWS\System32\svchost.exe[1696] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 021D0F43
.text C:\WINDOWS\System32\svchost.exe[1696] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 021D00DC
.text C:\WINDOWS\System32\svchost.exe[1696] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 021D00F7
.text C:\WINDOWS\System32\svchost.exe[1696] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 021D0FA8
.text C:\WINDOWS\System32\svchost.exe[1696] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 021D0FD4
.text C:\WINDOWS\System32\svchost.exe[1696] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 021D0089
.text C:\WINDOWS\System32\svchost.exe[1696] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 021D0025
.text C:\WINDOWS\System32\svchost.exe[1696] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 021D000A
.text C:\WINDOWS\System32\svchost.exe[1696] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 021D0F5E
.text C:\WINDOWS\System32\svchost.exe[1696] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 021C0014
.text C:\WINDOWS\System32\svchost.exe[1696] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 021C0F83
.text C:\WINDOWS\System32\svchost.exe[1696] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 021C0FCD
.text C:\WINDOWS\System32\svchost.exe[1696] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 021C0FDE
.text C:\WINDOWS\System32\svchost.exe[1696] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 021C0040
.text C:\WINDOWS\System32\svchost.exe[1696] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 021C0FEF
.text C:\WINDOWS\System32\svchost.exe[1696] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 021C0F9E
.text C:\WINDOWS\System32\svchost.exe[1696] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [3C, 8A] {CMP AL, 0x8a}
.text C:\WINDOWS\System32\svchost.exe[1696] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 021C0025
.text C:\WINDOWS\System32\svchost.exe[1696] USER32.dll!GetCursorPos 7E42974E 5 Bytes JMP 021E000A
.text C:\WINDOWS\System32\svchost.exe[1696] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 00F1000A
.text C:\WINDOWS\System32\svchost.exe[1696] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 021B007A
.text C:\WINDOWS\System32\svchost.exe[1696] msvcrt.dll!system 77C293C7 5 Bytes JMP 021B005F
.text C:\WINDOWS\System32\svchost.exe[1696] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 021B0029
.text C:\WINDOWS\System32\svchost.exe[1696] msvcrt.dll!_open 77C2F566 5 Bytes JMP 021B0FEF
.text C:\WINDOWS\System32\svchost.exe[1696] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 021B004E
.text C:\WINDOWS\System32\svchost.exe[1696] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 021B0018
.text C:\WINDOWS\System32\svchost.exe[1696] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 02190000
.text C:\WINDOWS\System32\svchost.exe[1696] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 02190025
.text C:\WINDOWS\System32\svchost.exe[1696] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 02190FE5
.text C:\WINDOWS\System32\svchost.exe[1696] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 02190FD4
.text C:\WINDOWS\System32\svchost.exe[1696] WS2_32.dll!socket 71AB4211 5 Bytes JMP 021A000A
.text C:\WINDOWS\system32\svchost.exe[1748] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00A80FE5
.text C:\WINDOWS\system32\svchost.exe[1748] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00A80F5E
.text C:\WINDOWS\system32\svchost.exe[1748] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00A80053
.text C:\WINDOWS\system32\svchost.exe[1748] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00A80F6F
.text C:\WINDOWS\system32\svchost.exe[1748] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00A80F8A
.text C:\WINDOWS\system32\svchost.exe[1748] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00A80F9B
.text C:\WINDOWS\system32\svchost.exe[1748] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00A80F2B
.text C:\WINDOWS\system32\svchost.exe[1748] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00A80F3C
.text C:\WINDOWS\system32\svchost.exe[1748] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00A80EEE
.text C:\WINDOWS\system32\svchost.exe[1748] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00A80EFF
.text C:\WINDOWS\system32\svchost.exe[1748] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00A80098
.text C:\WINDOWS\system32\svchost.exe[1748] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00A80022
.text C:\WINDOWS\system32\svchost.exe[1748] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00A80000
.text C:\WINDOWS\system32\svchost.exe[1748] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00A80F4D
.text C:\WINDOWS\system32\svchost.exe[1748] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00A80FC0
.text C:\WINDOWS\system32\svchost.exe[1748] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00A80011
.text C:\WINDOWS\system32\svchost.exe[1748] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00A80F1A
.text C:\WINDOWS\system32\svchost.exe[1748] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00A70FCD
.text C:\WINDOWS\system32\svchost.exe[1748] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00A70FA1
.text C:\WINDOWS\system32\svchost.exe[1748] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00A7001E
.text C:\WINDOWS\system32\svchost.exe[1748] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00A70FDE
.text C:\WINDOWS\system32\svchost.exe[1748] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00A7005E
.text C:\WINDOWS\system32\svchost.exe[1748] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00A70FEF
.text C:\WINDOWS\system32\svchost.exe[1748] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00A70FBC
.text C:\WINDOWS\system32\svchost.exe[1748] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [C7, 88]
.text C:\WINDOWS\system32\svchost.exe[1748] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00A70043
.text C:\WINDOWS\system32\svchost.exe[1748] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00A60F9C
.text C:\WINDOWS\system32\svchost.exe[1748] msvcrt.dll!system 77C293C7 5 Bytes JMP 00A60027
.text C:\WINDOWS\system32\svchost.exe[1748] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00A6000C
.text C:\WINDOWS\system32\svchost.exe[1748] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00A60FEF
.text C:\WINDOWS\system32\svchost.exe[1748] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00A60FB7
.text C:\WINDOWS\system32\svchost.exe[1748] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00A60FD2
.text C:\WINDOWS\system32\svchost.exe[1748] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 001C0FEF
.text C:\WINDOWS\system32\svchost.exe[1748] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 001C0014
.text C:\WINDOWS\system32\svchost.exe[1748] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 001C0FD4
.text C:\WINDOWS\system32\svchost.exe[1748] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 001C0FB9
.text C:\WINDOWS\system32\svchost.exe[1748] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00A50FE5
.text C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C80FEF
.text C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C80F6D
.text C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C80062
.text C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C80F88
.text C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C80FAF
.text C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C80036
.text C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C80F4B
.text C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C80F5C
.text C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C800B8
.text C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C80F29
.text C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00C80EFA
.text C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00C80051
.text C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C80FD4
.text C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00C8007D
.text C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00C8001B
.text C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00C8000A
.text C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00C80F3A
.text C:\WINDOWS\system32\svchost.exe[1952] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00C7003D
.text C:\WINDOWS\system32\svchost.exe[1952] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00C7007A
.text C:\WINDOWS\system32\svchost.exe[1952] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00C7002C
.text C:\WINDOWS\system32\svchost.exe[1952] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00C70011
.text C:\WINDOWS\system32\svchost.exe[1952] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00C70069
.text C:\WINDOWS\system32\svchost.exe[1952] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00C70000
.text C:\WINDOWS\system32\svchost.exe[1952] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00C70FD1
.text C:\WINDOWS\system32\svchost.exe[1952] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [E7, 88] {OUT 0x88, EAX}
.text C:\WINDOWS\system32\svchost.exe[1952] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00C7004E
.text C:\WINDOWS\system32\svchost.exe[1952] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00C60049
.text C:\WINDOWS\system32\svchost.exe[1952] msvcrt.dll!system 77C293C7 5 Bytes JMP 00C60038
.text C:\WINDOWS\system32\svchost.exe[1952] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00C6001D
.text C:\WINDOWS\system32\svchost.exe[1952] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00C60FE3
.text C:\WINDOWS\system32\svchost.exe[1952] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00C60FC8
.text C:\WINDOWS\system32\svchost.exe[1952] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00C60000
.text C:\WINDOWS\system32\svchost.exe[1952] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 001B0FEF
.text C:\WINDOWS\system32\svchost.exe[1952] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 001B0FDE
.text C:\WINDOWS\system32\svchost.exe[1952] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 001B0FC3
.text C:\WINDOWS\system32\svchost.exe[1952] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 001B001E
.text C:\WINDOWS\system32\svchost.exe[1952] WS2_32.dll!socket 71AB4211 5 Bytes JMP 001C0FEF
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[2268] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0041C130 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[2268] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 0041C1B0 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\WINDOWS\system32\svchost.exe[2772] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00E90FEF
.text C:\WINDOWS\system32\svchost.exe[2772] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00E9004C
.text C:\WINDOWS\system32\svchost.exe[2772] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00E9003B
.text C:\WINDOWS\system32\svchost.exe[2772] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00E90F61
.text C:\WINDOWS\system32\svchost.exe[2772] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00E90F72
.text C:\WINDOWS\system32\svchost.exe[2772] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00E90F8D
.text C:\WINDOWS\system32\svchost.exe[2772] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00E90F2B
.text C:\WINDOWS\system32\svchost.exe[2772] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00E90F3C
.text C:\WINDOWS\system32\svchost.exe[2772] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00E90EE4
.text C:\WINDOWS\system32\svchost.exe[2772] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00E90EFF
.text C:\WINDOWS\system32\svchost.exe[2772] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00E900A2
.text C:\WINDOWS\system32\svchost.exe[2772] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00E9001E
.text C:\WINDOWS\system32\svchost.exe[2772] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00E90FDE
.text C:\WINDOWS\system32\svchost.exe[2772] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00E9005D
.text C:\WINDOWS\system32\svchost.exe[2772] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00E90FA8
.text C:\WINDOWS\system32\svchost.exe[2772] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00E90FC3
.text C:\WINDOWS\system32\svchost.exe[2772] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00E90F10
.text C:\WINDOWS\system32\svchost.exe[2772] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00E80FCA
.text C:\WINDOWS\system32\svchost.exe[2772] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00E8003D
.text C:\WINDOWS\system32\svchost.exe[2772] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00E80FE5
.text C:\WINDOWS\system32\svchost.exe[2772] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00E8001B
.text C:\WINDOWS\system32\svchost.exe[2772] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00E8002C
.text C:\WINDOWS\system32\svchost.exe[2772] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00E8000A
.text C:\WINDOWS\system32\svchost.exe[2772] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00E80F8A
.text C:\WINDOWS\system32\svchost.exe[2772] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [08, 89]
.text C:\WINDOWS\system32\svchost.exe[2772] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00E80FAF
.text C:\WINDOWS\system32\svchost.exe[2772] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00E70FA6
.text C:\WINDOWS\system32\svchost.exe[2772] msvcrt.dll!system 77C293C7 5 Bytes JMP 00E70FB7
.text C:\WINDOWS\system32\svchost.exe[2772] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00E7001D
.text C:\WINDOWS\system32\svchost.exe[2772] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00E70000
.text C:\WINDOWS\system32\svchost.exe[2772] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00E70FC8
.text C:\WINDOWS\system32\svchost.exe[2772] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00E70FE3
.text C:\WINDOWS\system32\svchost.exe[2772] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 001C0FEF
.text C:\WINDOWS\system32\svchost.exe[2772] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 001C0FD4
.text C:\WINDOWS\system32\svchost.exe[2772] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 001C000A
.text C:\WINDOWS\system32\svchost.exe[2772] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 001C0FB9
.text C:\WINDOWS\system32\svchost.exe[2772] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00E60FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00E2000A
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00E3000A
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00E1000C
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 0038002C
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00380073
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0038001B
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00380000
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00380058
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00380FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00380047
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00380FC0
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9A75 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD101 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDAC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E25466E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E473F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4671 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E46DC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4542 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E45A4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E47A2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4606 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00390FDB
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] msvcrt.dll!system 77C293C7 5 Bytes JMP 00390066
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 0039003A
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] msvcrt.dll!_open 77C2F566 5 Bytes JMP 0039000C
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00390055
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00390029
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 3E2EDB20 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2968] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 3E3E4AA7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\WINDOWS\system32\dllhost.exe[3184] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 01050FEF
.text C:\WINDOWS\system32\dllhost.exe[3184] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 0105009D
.text C:\WINDOWS\system32\dllhost.exe[3184] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 01050082
.text C:\WINDOWS\system32\dllhost.exe[3184] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 01050F9E
.text C:\WINDOWS\system32\dllhost.exe[3184] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 0105005B
.text C:\WINDOWS\system32\dllhost.exe[3184] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 01050040
.text C:\WINDOWS\system32\dllhost.exe[3184] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 010500C9
.text C:\WINDOWS\system32\dllhost.exe[3184] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 010500B8
.text C:\WINDOWS\system32\dllhost.exe[3184] kernel32.dll!CreateProcessW 7C802336 1 Byte [E9]
.text C:\WINDOWS\system32\dllhost.exe[3184] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 01050F3A
.text C:\WINDOWS\system32\dllhost.exe[3184] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 01050F4B
.text C:\WINDOWS\system32\dllhost.exe[3184] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 01050F29
.text C:\WINDOWS\system32\dllhost.exe[3184] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 01050FC3
.text C:\WINDOWS\system32\dllhost.exe[3184] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 01050FD4
.text C:\WINDOWS\system32\dllhost.exe[3184] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 01050F8D
.text C:\WINDOWS\system32\dllhost.exe[3184] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 0105002F
.text C:\WINDOWS\system32\dllhost.exe[3184] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 0105000A
.text C:\WINDOWS\system32\dllhost.exe[3184] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 01050F5C
.text C:\WINDOWS\system32\dllhost.exe[3184] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 01030F9C
.text C:\WINDOWS\system32\dllhost.exe[3184] msvcrt.dll!system 77C293C7 5 Bytes JMP 01030027
.text C:\WINDOWS\system32\dllhost.exe[3184] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 01030FC8
.text C:\WINDOWS\system32\dllhost.exe[3184] msvcrt.dll!_open 77C2F566 5 Bytes JMP 01030FE3
.text C:\WINDOWS\system32\dllhost.exe[3184] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 01030FB7
.text C:\WINDOWS\system32\dllhost.exe[3184] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 01030000
.text C:\WINDOWS\system32\dllhost.exe[3184] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 01040040
.text C:\WINDOWS\system32\dllhost.exe[3184] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 01040FCA
.text C:\WINDOWS\system32\dllhost.exe[3184] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0104001B
.text C:\WINDOWS\system32\dllhost.exe[3184] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 01040000
.text C:\WINDOWS\system32\dllhost.exe[3184] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 01040087
.text C:\WINDOWS\system32\dllhost.exe[3184] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 01040FEF
.text C:\WINDOWS\system32\dllhost.exe[3184] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 01040076
.text C:\WINDOWS\system32\dllhost.exe[3184] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 0104005B
.text C:\WINDOWS\system32\dllhost.exe[3184] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 01010FEF
.text C:\WINDOWS\system32\dllhost.exe[3184] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 0101000A
.text C:\WINDOWS\system32\dllhost.exe[3184] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 01010FD4
.text C:\WINDOWS\system32\dllhost.exe[3184] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 01010025
.text C:\WINDOWS\system32\dllhost.exe[3184] WS2_32.dll!socket 71AB4211 5 Bytes JMP 01020FEF

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

—- EOF - GMER 1.0.15 —-

Attachments:

📎Attach.txt

RPMcMurphy

Post #4May 29, 2010, 3:50 PM UTC

74C,

Can you elaborate on your symptoms for me? I don't see any malware in your logs. Please run this for me so I can have a little closer look:

🖼Click to load external image (Posted Image) Download OTL to your desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Custom Scan box paste this in:
netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and include them in your next post.

Please include the following in your next post:

OTL Logs

Describe your symptoms in as much detail as you can

74C

Post #5June 2, 2010, 9:09 PM UTC

Hello Sorry for the delayed response. I started having trouble getting on the internet after my first posts. I called Verizon and they said everything was working on their end. We could not aqquire the IP address and got the message "the RPC server is unavailable". After talking with Verizon I had to do a system restore and was able to connect. I did the last scan you told me too and had it all pasted, then pushed send and got the message "Internet Explorer cannot display webpage" which is the same message I got when trying to download windows updates when my probelms started. This is also same message I get now whenever trying to connect to internet. Now I cannot connect at all to the internet from my pc at home even after doing system restore to an earlier time point. The original probem was that I was getting redirected to advertisement websites after searching for soemthing on google, then clicking the link s that google listed. To actually get to a website, I had to type the address in the address window, then I could get there. Also, I had windows to advertisement sites popping up at random times when I was at a legitimate site like MSN. I appreciate any ideas. Not sure what I can do without connecting. Thanks for your help.

RPMcMurphy

Post #6June 2, 2010, 9:20 PM UTC

Hi, Do you have access to a properly working PC with either a CD burner or USB drive that you could use to transfer files and logs until we get you reconnected? Is your infected machine behind a router? Do you have any other PCs in your home? Are they able to connect to the internet?

74C

Post #7June 4, 2010, 1:15 PM UTC

I was able to borrow my father in laws laptop, I dont think it has a burner on it, but we could use a memory stick to tranfer data. Although I am concerned that a virus could transfer from my computer to the laptop through the memory stick. Could this happen? The infected machine is behind a router. And I did get connected with the laptop (wireless) Thanks

RPMcMurphy

Post #8June 4, 2010, 2:19 PM UTC

74C,

If the laptop has Windows Vista or Windows 7, just don't allow anything to autrorun when you insert the USB stick into the laptop. If it has Windows XP this will prevent you from cross infecting it:

Download Flash_Disinfector.exe from HERE and save it to your desktop.

Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
Wait until it has finished scanning and then exit the program.
Reboot your computer when done.

Download these on the laptop, then copy them to the desktop of the infected PC to run them. Until we get your connection restrored you will have to copy the logs back to the laptop to post them:

🖼Click to load external image (Posted Image) Download TDSSKiller and save it to your Desktop.

Extract the file and run it.
Once completed it will create a log in your C:\ drive called TDSSKiller_* (* denotes version & date)
Please post the content of that log TDSSKiller

🖼Click to load external image (Posted Image) Download OTL to your desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Custom Scan box paste this in:
netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and include them in your next post.

Please include the following in your next post:

OTL & OTL Extras logs

TDSSKiller log

74C

Post #9June 8, 2010, 2:51 AM UTC

Hello

21:04:03:421 0168 TDSS rootkit removing tool 2.3.2.0 May 31 2010 10:39:48
21:04:03:421 0168 ================================================================================
21:04:03:421 0168 SystemInfo:

21:04:03:421 0168 OS Version: 5.1.2600 ServicePack: 3.0
21:04:03:421 0168 Product type: Workstation
21:04:03:421 0168 ComputerName: HOME-6C42F4DA9A
21:04:03:421 0168 UserName: Chris
21:04:03:421 0168 Windows directory: C:\WINDOWS
21:04:03:421 0168 Processor architecture: Intel x86
21:04:03:421 0168 Number of processors: 2
21:04:03:421 0168 Page size: 0x1000
21:04:03:421 0168 Boot type: Normal boot
21:04:03:421 0168 ================================================================================
21:04:03:656 0168 Initialize success
21:04:03:656 0168
21:04:03:656 0168 Scanning Services …
21:04:04:140 0168 Raw services enum returned 341 services
21:04:04:171 0168
21:04:04:171 0168 Scanning Drivers …
21:04:04:859 0168 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
21:04:04:906 0168 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
21:04:04:937 0168 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
21:04:04:984 0168 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
21:04:05:031 0168 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
21:04:05:062 0168 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
21:04:05:078 0168 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
21:04:05:140 0168 ati2mtag (a7dd7088e2c987dbcb3f4d6d56f723bd) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
21:04:05:187 0168 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
21:04:05:203 0168 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
21:04:05:250 0168 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
21:04:05:281 0168 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
21:04:05:328 0168 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
21:04:05:343 0168 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
21:04:05:375 0168 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
21:04:05:421 0168 cercsr6 (84853b3fd012251690570e9e7e43343f) C:\WINDOWS\system32\drivers\cercsr6.sys
21:04:05:468 0168 ctac32k (1e41b8a10b9d78240c8bfacc269db155) C:\WINDOWS\system32\drivers\ctac32k.sys
21:04:05:500 0168 ctaud2k (9bf1aa0eac9c7d33ce4d8a152e151f60) C:\WINDOWS\system32\drivers\ctaud2k.sys
21:04:05:531 0168 ctdvda2k (29f78d59b053cb8778f8426e4e24099c) C:\WINDOWS\system32\drivers\ctdvda2k.sys
21:04:05:546 0168 ctprxy2k (a6f4c70da545230d001915d8eb08d881) C:\WINDOWS\system32\drivers\ctprxy2k.sys
21:04:05:546 0168 ctsfm2k (b39e55c1c5e28e016ee3848f2e34c205) C:\WINDOWS\system32\drivers\ctsfm2k.sys
21:04:05:578 0168 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
21:04:05:625 0168 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
21:04:05:640 0168 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
21:04:05:656 0168 dmload (368a7ec3ce7f3bc70ed0dcbccbb3e6ed) C:\WINDOWS\system32\drivers\dmload.sys
21:04:05:656 0168 Suspicious file (Forged): C:\WINDOWS\system32\drivers\dmload.sys. Real md5: 368a7ec3ce7f3bc70ed0dcbccbb3e6ed, Fake md5: e9317282a63ca4d188c0df5e09c6ac5f
21:04:05:656 0168 File "C:\WINDOWS\system32\drivers\dmload.sys" infected by TDSS rootkit … 21:04:06:765 0168 Backup copy found, using it..
21:04:06:781 0168 will be cured on next reboot
21:04:06:875 0168 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
21:04:06:921 0168 DNINDIS5 (d2ee54cdbced01d48f2b18642be79a98) C:\WINDOWS\system32\DNINDIS5.SYS
21:04:06:953 0168 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
21:04:06:984 0168 E100B (95974e66d3de4951d29e28e8bc0b644c) C:\WINDOWS\system32\DRIVERS\e100b325.sys
21:04:07:031 0168 emupia (5d70013d7e6602ec0a482f2985558c2d) C:\WINDOWS\system32\drivers\emupia2k.sys
21:04:07:046 0168 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
21:04:07:093 0168 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
21:04:07:109 0168 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
21:04:07:109 0168 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
21:04:07:156 0168 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
21:04:07:187 0168 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
21:04:07:187 0168 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
21:04:07:234 0168 gameenum (065639773d8b03f33577f6cdaea21063) C:\WINDOWS\system32\DRIVERS\gameenum.sys
21:04:07:250 0168 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
21:04:07:281 0168 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
21:04:07:343 0168 ha10kx2k (7ec50a84b89dae3458cb0308739b80de) C:\WINDOWS\system32\drivers\ha10kx2k.sys
21:04:07:390 0168 hap16v2k (02a6bad64177c56d8b86b198b38db361) C:\WINDOWS\system32\drivers\hap16v2k.sys
21:04:07:453 0168 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
21:04:07:468 0168 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
21:04:07:515 0168 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
21:04:07:546 0168 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\drivers\i8042prt.sys
21:04:07:562 0168 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
21:04:07:625 0168 IntelC51 (fcab28ffd3a8964581e16455efaf81c8) C:\WINDOWS\system32\DRIVERS\IntelC51.sys
21:04:07:671 0168 IntelC52 (a288e7e3a6255255b9066686d860fbc5) C:\WINDOWS\system32\DRIVERS\IntelC52.sys
21:04:07:687 0168 IntelC53 (d5e5a1abf6bdba7ca49941a044f04598) C:\WINDOWS\system32\DRIVERS\IntelC53.sys
21:04:07:734 0168 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
21:04:07:750 0168 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
21:04:07:781 0168 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
21:04:07:812 0168 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
21:04:07:828 0168 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
21:04:07:875 0168 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
21:04:07:906 0168 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
21:04:07:937 0168 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
21:04:07:968 0168 JSWSCIMD (ad67795900aa8c05cc4570f5349e0639) C:\WINDOWS\system32\DRIVERS\jswscimd.sys
21:04:07:984 0168 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
21:04:07:984 0168 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
21:04:08:031 0168 klmd23 (67e1faa88fb397b3d56909d7e04f4dd3) C:\WINDOWS\system32\drivers\klmd.sys
21:04:08:062 0168 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
21:04:08:109 0168 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
21:04:08:140 0168 mfeavfk (bafdd5e28baea99d7f4772af2f5ec7ee) C:\WINDOWS\system32\drivers\mfeavfk.sys
21:04:08:171 0168 mfebopk (1d003e3056a43d881597d6763e83b943) C:\WINDOWS\system32\drivers\mfebopk.sys
21:04:08:187 0168 mfehidk (3f138a1c8a0659f329f242d1e389b2cf) C:\WINDOWS\system32\drivers\mfehidk.sys
21:04:08:234 0168 mferkdk (41fe2f288e05a6c8ab85dd56770ffbad) C:\WINDOWS\system32\drivers\mferkdk.sys
21:04:08:265 0168 mfesmfk (096b52ea918aa909ba5903d79e129005) C:\WINDOWS\system32\drivers\mfesmfk.sys
21:04:08:281 0168 MHNDRV (7f2f1d2815a6449d346fcccbc569fbd6) C:\WINDOWS\system32\DRIVERS\mhndrv.sys
21:04:08:312 0168 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
21:04:08:359 0168 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
21:04:08:390 0168 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
21:04:08:437 0168 mohfilt (c6a08c4f34b3048a73bbb2951150f98d) C:\WINDOWS\system32\DRIVERS\mohfilt.sys
21:04:08:437 0168 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
21:04:08:484 0168 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
21:04:08:500 0168 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
21:04:08:546 0168 MPFP (136157e79849b9e5316ba4008d6075a8) C:\WINDOWS\system32\Drivers\Mpfp.sys
21:04:08:546 0168 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
21:04:08:593 0168 MRxSmb (421f7b922cec5a5f340e7574a98f7b7c) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
21:04:08:640 0168 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
21:04:08:671 0168 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
21:04:08:703 0168 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
21:04:08:703 0168 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
21:04:08:734 0168 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
21:04:08:750 0168 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
21:04:08:750 0168 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
21:04:08:781 0168 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
21:04:08:796 0168 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
21:04:08:812 0168 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
21:04:08:812 0168 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
21:04:08:828 0168 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
21:04:08:859 0168 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
21:04:08:875 0168 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
21:04:08:875 0168 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
21:04:08:921 0168 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
21:04:08:984 0168 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
21:04:09:015 0168 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
21:04:09:015 0168 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
21:04:09:031 0168 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
21:04:09:062 0168 ossrv (c52548b920482db03af8b49babd9fc48) C:\WINDOWS\system32\drivers\ctoss2k.sys
21:04:09:078 0168 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
21:04:09:093 0168 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
21:04:09:109 0168 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
21:04:09:156 0168 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
21:04:09:187 0168 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
21:04:09:203 0168 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
21:04:09:265 0168 PfModNT (fefc8ebc170615068c3305dbee2667dd) C:\WINDOWS\system32\drivers\PfModNT.sys
21:04:09:281 0168 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
21:04:09:281 0168 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
21:04:09:312 0168 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
21:04:09:328 0168 PxHelp20 (617accada2e0a0f43ec6030bbac49513) C:\WINDOWS\system32\Drivers\PxHelp20.sys
21:04:09:375 0168 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
21:04:09:390 0168 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
21:04:09:390 0168 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
21:04:09:390 0168 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
21:04:09:406 0168 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
21:04:09:421 0168 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
21:04:09:437 0168 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
21:04:09:453 0168 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
21:04:09:484 0168 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
21:04:09:500 0168 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
21:04:09:531 0168 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
21:04:09:546 0168 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
21:04:09:562 0168 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
21:04:09:578 0168 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
21:04:09:609 0168 Srv (89220b427890aa1dffd1a02648ae51c3) C:\WINDOWS\system32\DRIVERS\srv.sys
21:04:09:656 0168 STHDA (2a2dc39623adef8ab3703ab9fac4b440) C:\WINDOWS\system32\drivers\sthda.sys
21:04:09:671 0168 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
21:04:09:687 0168 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
21:04:09:750 0168 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
21:04:09:796 0168 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
21:04:09:828 0168 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
21:04:09:843 0168 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
21:04:09:859 0168 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
21:04:09:875 0168 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
21:04:09:890 0168 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
21:04:09:921 0168 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
21:04:09:937 0168 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
21:04:09:953 0168 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
21:04:10:000 0168 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
21:04:10:015 0168 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
21:04:10:031 0168 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
21:04:10:046 0168 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
21:04:10:046 0168 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
21:04:10:078 0168 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
21:04:10:125 0168 WN111v2 (93ea7d94959bef66d0e4adbc8ce4e073) C:\WINDOWS\system32\DRIVERS\WN111v2.sys
21:04:10:171 0168 WSIMD (43f767d59bfc25d8f4fc2eb42043ec1e) C:\WINDOWS\system32\DRIVERS\wsimd.sys
21:04:10:171 0168 Reboot required for cure complete..
21:04:10:531 0168 Cure on reboot scheduled successfully
21:04:10:531 0168
21:04:10:531 0168 Completed
21:04:10:531 0168
21:04:10:531 0168 Results:
21:04:10:531 0168 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
21:04:10:531 0168 File objects infected / cured / cured on reboot: 1 / 0 / 1
21:04:10:531 0168
21:04:10:531 0168 KLMD(ARK) unloaded successfully

OTL logfile created on: 6/7/2010 9:33:33 PM - Run 1
OTL by OldTimer - Version 3.2.5.3 Folder = C:\Documents and Settings\Chris\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 657.00 Mb Available Physical Memory | 64.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.82 Gb Total Space | 168.32 Gb Free Space | 72.30% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 6.67 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive G: | 7.47 Gb Total Space | 3.27 Gb Free Space | 43.77% Space Free | Partition Type: FAT32
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME-6C42F4DA9A
Current User Name: Chris
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Chris\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MSK\msksrver.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - C:\Program Files\NETGEAR\WN111v2\WN111V2.exe (NETGEAR)
PRC - C:\WINDOWS\system32\acs.exe (Atheros)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\WINDOWS\system32\CTHELPER.EXE (Creative Technology Ltd)
PRC - C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
PRC - C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.exe (Creative Technology Ltd)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Chris\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\system32\CTAGENT.DLL (Creative Technology Ltd)

========== Win32 Services (SafeList) ==========

SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV - (McSysmon) – C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (MpfService) – C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (MSK80Service) – C:\Program Files\McAfee\MSK\MskSrver.exe (McAfee, Inc.)
SRV - (McProxy) – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (McNASvc) – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (ACS) – C:\WINDOWS\system32\acs.exe (Atheros)
SRV - (jswpsapi) – C:\Program Files\NETGEAR\WN111v2\jswpsapi.exe (Atheros Communications, Inc.)

========== Driver Services (SafeList) ==========

DRV - (mfehidk) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfesmfk) – C:\WINDOWS\system32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\WINDOWS\system32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (MPFP) – C:\WINDOWS\system32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (JSWSCIMD) – C:\WINDOWS\system32\drivers\jswscimd.sys (Atheros Communications, Inc.)
DRV - (WN111v2) – C:\WINDOWS\system32\drivers\WN111v2.sys (Atheros Communications, Inc.)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (WSIMD) – C:\WINDOWS\system32\drivers\wsimd.sys (Atheros Communications, Inc.)
DRV - (IntelC52) – C:\WINDOWS\system32\drivers\IntelC52.sys (Intel Corporation)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (IntelC51) – C:\WINDOWS\system32\drivers\IntelC51.sys (Intel Corporation)
DRV - (IntelC53) – C:\WINDOWS\system32\drivers\IntelC53.sys (Intel Corporation)
DRV - (mohfilt) – C:\WINDOWS\system32\drivers\mohfilt.sys (Intel Corporation)
DRV - (ha10kx2k) – C:\WINDOWS\system32\drivers\ha10kx2k.sys (Creative Technology Ltd)
DRV - (PfModNT) – C:\WINDOWS\system32\drivers\pfmodnt.sys (Creative Technology Ltd.)
DRV - (ctaud2k) Creative Audio Driver (WDM) – C:\WINDOWS\system32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (hap16v2k) – C:\WINDOWS\system32\drivers\haP16v2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:\WINDOWS\system32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\WINDOWS\system32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctac32k) – C:\WINDOWS\system32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (ctdvda2k) – C:\WINDOWS\system32\drivers\ctdvda2k.sys (Creative Technology Ltd)
DRV - (DNINDIS5) – C:\WINDOWS\system32\DNINDIS5.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MODEMCSA) – C:\WINDOWS\system32\drivers\MODEMCSA.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 44 A6 5D 13 3E D1 CA 01 [binary data]
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/04/21 22:22:21 | 000,000,000 | —D | M]

O1 HOSTS File: ([2004/08/10 06:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O4 - HKLM..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE (Creative Technology Ltd)
O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\System32\CTHELPER.EXE (Creative Technology Ltd)
O4 - HKLM..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [jswtrayutil] C:\Program Files\NETGEAR\WN111v2\jswtrayutil.exe File not found
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WN111v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WN111v2\WN111V2.exe (NETGEAR)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} http://peakbjj.viewnetcam.com:50000/bl_camera.cab (Bl_camera Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Chris\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Chris\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/01/24 22:32:33 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2008/05/06 07:26:23 | 000,000,309 | R— | M] () - F:\autorun.inf – [ CDFS ]
O32 - AutoRun File - [2010/06/07 20:38:04 | 000,000,000 | RHSD | M] - G:\autorun.inf – [ FAT32 ]
O33 - MountPoints2\{99c515f4-24e6-11df-961b-00223f92d85e}\Shell - "" = AutoRun
O33 - MountPoints2\{99c515f4-24e6-11df-961b-00223f92d85e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{99c515f4-24e6-11df-961b-00223f92d85e}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – [2007/10/23 02:45:39 | 001,336,632 | R— | M] ()
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe – [2007/10/23 02:45:39 | 001,336,632 | R— | M] ()
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2010/01/24 22:32:01 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: wave - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
Drivers32: wave2 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 90 Days ==========

[2010/06/07 21:15:54 | 000,571,904 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Chris\Desktop\OTL.exe
[2010/06/07 21:07:31 | 000,000,000 | —D | C] – C:\WINDOWS\LastGood
[2010/06/07 21:01:44 | 000,000,000 | —D | C] – C:\Documents and Settings\Chris\Application Data\U3
[2010/05/31 10:41:12 | 000,998,736 | —- | C] (Kaspersky Lab) – C:\Documents and Settings\Chris\Desktop\TDSSKiller.exe
[2010/05/30 02:09:56 | 000,000,000 | —D | C] – C:\Config.Msi
[2010/05/28 22:58:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Chris\Desktop\Repair
[2010/05/26 20:50:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
[2010/05/26 20:49:55 | 000,000,000 | —D | C] – C:\Program Files\Lavasoft
[2010/05/26 20:49:55 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Lavasoft
[2010/05/25 18:25:13 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/05/25 18:24:13 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/05/14 17:34:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Chris\Application Data\Verizon
[2010/05/14 11:34:45 | 000,000,000 | -HSD | C] – C:\Documents and Settings\All Users\Documents\MCE Logs
[2010/05/12 15:26:36 | 000,000,000 | —D | C] – C:\Documents and Settings\Chris\Local Settings\Application Data\SupportSoft
[2010/05/12 15:26:00 | 000,000,000 | —D | C] – C:\WINDOWS\FIOS
[2010/05/12 15:23:00 | 000,000,000 | —D | C] – C:\Program Files\Verizon
[2010/05/12 15:16:12 | 000,000,000 | —D | C] – C:\Documents and Settings\Chris\Application Data\TechWizard
[2010/04/03 11:41:25 | 000,000,000 | —D | C] – C:\Program Files\MSECache
[2010/03/17 19:56:01 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2010/01/24 23:17:05 | 000,065,536 | —- | C] ( ) – C:\WINDOWS\System32\a3d.dll
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/06/07 21:06:19 | 000,014,005 | —- | M] () – C:\WINDOWS\System32\Config.MPF
[2010/06/07 21:05:43 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/06/07 21:05:42 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/06/07 21:05:12 | 000,030,528 | —- | M] () – C:\WINDOWS\System32\BMXCtrlState-{00000003-00000000-00000003-00001102-00000004-20061102}.rfx
[2010/06/07 21:05:12 | 000,030,528 | —- | M] () – C:\WINDOWS\System32\BMXBkpCtrlState-{00000003-00000000-00000003-00001102-00000004-20061102}.rfx
[2010/06/07 21:05:12 | 000,001,080 | —- | M] () – C:\WINDOWS\System32\settingsbkup.sfm
[2010/06/07 21:05:12 | 000,001,080 | —- | M] () – C:\WINDOWS\System32\settings.sfm
[2010/06/07 21:05:12 | 000,000,384 | —- | M] () – C:\WINDOWS\System32\DVCStateBkp-{00000003-00000000-00000003-00001102-00000004-20061102}.dat
[2010/06/07 21:05:12 | 000,000,384 | —- | M] () – C:\WINDOWS\System32\DVCState-{00000003-00000000-00000003-00001102-00000004-20061102}.dat
[2010/06/07 21:05:11 | 000,031,056 | —- | M] () – C:\WINDOWS\System32\BMXStateBkp-{00000003-00000000-00000003-00001102-00000004-20061102}.rfx
[2010/06/07 21:05:11 | 000,031,056 | —- | M] () – C:\WINDOWS\System32\BMXState-{00000003-00000000-00000003-00001102-00000004-20061102}.rfx
[2010/06/07 21:05:06 | 002,088,960 | —- | M] () – C:\Documents and Settings\Chris\ntuser.dat
[2010/06/07 21:05:06 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Chris\ntuser.ini
[2010/06/07 21:05:04 | 004,932,819 | —- | M] () – C:\WINDOWS\{00000003-00000000-00000003-00001102-00000004-20061102}.CDF
[2010/06/07 21:05:03 | 004,290,106 | -H– | M] () – C:\Documents and Settings\Chris\Local Settings\Application Data\IconCache.db
[2010/06/07 20:58:08 | 000,571,904 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Chris\Desktop\OTL.exe
[2010/06/07 20:57:56 | 000,966,213 | —- | M] () – C:\Documents and Settings\Chris\Desktop\tdsskiller.zip
[2010/06/07 20:02:57 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/05/31 10:41:12 | 000,998,736 | —- | M] (Kaspersky Lab) – C:\Documents and Settings\Chris\Desktop\TDSSKiller.exe
[2010/05/30 02:10:55 | 000,241,536 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/05/30 01:36:32 | 000,097,280 | —- | M] () – C:\Documents and Settings\Chris\Desktop\I could not get on the internet today.doc
[2010/05/29 20:51:02 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/05/29 03:39:00 | 000,043,520 | —- | M] () – C:\Documents and Settings\Chris\Desktop\Linda's Budget_2010.xls
[2010/05/26 20:29:38 | 000,000,036 | —- | M] () – C:\Documents and Settings\Chris\Local Settings\Application Data\housecall.guid.cache
[2010/05/20 23:37:56 | 000,053,664 | -H– | M] () – C:\WINDOWS\System32\mlfcache.dat
[2010/05/15 01:20:34 | 000,000,340 | —- | M] () – C:\WINDOWS\tasks\McDefragTask.job
[2010/05/12 19:56:03 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/05/12 02:21:33 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/05/01 01:00:11 | 000,000,318 | —- | M] () – C:\WINDOWS\tasks\McQcTask.job
[2010/04/20 17:29:28 | 000,203,264 | —- | M] () – C:\Documents and Settings\Chris\Desktop\Capital One.doc
[2010/04/14 13:11:54 | 000,005,472 | —- | M] () – C:\WINDOWS\System32\CTHELPER.RPT
[2010/04/14 13:11:19 | 000,068,176 | —- | M] () – C:\Documents and Settings\Chris\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/04/01 23:29:44 | 000,013,114 | —- | M] () – C:\Documents and Settings\Chris\Desktop\House Paint Info.xlsx
[2010/03/25 22:31:37 | 000,063,260 | —- | M] () – C:\Documents and Settings\Chris\Desktop\TaxReturn2.pdf
[2010/03/25 22:29:35 | 000,060,527 | —- | M] () – C:\Documents and Settings\Chris\Desktop\TaxReturn.pdf
[2010/03/14 22:20:03 | 000,439,552 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/03/14 22:20:03 | 000,380,350 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/03/14 22:20:03 | 000,052,764 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/07 21:15:52 | 000,966,213 | —- | C] () – C:\Documents and Settings\Chris\Desktop\tdsskiller.zip
[2010/05/30 00:59:40 | 000,097,280 | —- | C] () – C:\Documents and Settings\Chris\Desktop\I could not get on the internet today.doc
[2010/05/26 20:55:40 | 000,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/05/26 20:29:38 | 000,000,036 | —- | C] () – C:\Documents and Settings\Chris\Local Settings\Application Data\housecall.guid.cache
[2010/05/20 23:37:56 | 000,053,664 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2010/05/14 17:29:27 | 000,559,210 | —- | C] () – C:\Documents and Settings\Chris\MMLog.log
[2010/04/02 10:50:13 | 002,088,960 | —- | C] () – C:\Documents and Settings\Chris\ntuser.dat
[2010/04/01 23:29:44 | 000,013,114 | —- | C] () – C:\Documents and Settings\Chris\Desktop\House Paint Info.xlsx
[2010/03/25 22:31:37 | 000,063,260 | —- | C] () – C:\Documents and Settings\Chris\Desktop\TaxReturn2.pdf
[2010/03/25 22:29:34 | 000,060,527 | —- | C] () – C:\Documents and Settings\Chris\Desktop\TaxReturn.pdf
[2010/03/19 22:53:31 | 000,203,264 | —- | C] () – C:\Documents and Settings\Chris\Desktop\Capital One.doc
[2010/01/30 22:32:25 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2010/01/24 23:18:05 | 000,000,231 | —- | C] () – C:\WINDOWS\AC3API.INI
[2010/01/24 23:17:17 | 000,014,424 | —- | C] () – C:\WINDOWS\System32\Aud2_Del.ini
[2010/01/24 23:17:17 | 000,000,030 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2010/01/24 23:17:10 | 000,000,194 | —- | C] () – C:\WINDOWS\System32\KILL.INI
[2010/01/24 23:15:47 | 000,000,136 | —- | C] () – C:\WINDOWS\SBWIN.INI
[2008/06/27 17:18:04 | 000,262,216 | —- | C] () – C:\WINDOWS\System32\IPTests.dll
[2005/08/05 15:01:54 | 000,239,104 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/04/18 17:43:46 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\ssleay32.dll
[2004/04/18 17:43:44 | 000,651,264 | —- | C] () – C:\WINDOWS\System32\libeay32.dll
[2003/01/07 16:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2010/01/24 22:59:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Citrix
[2010/01/24 22:40:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DIGStream
[2010/01/24 22:52:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NETGEAR
[2010/06/02 00:02:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
[2010/01/29 23:57:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2010/06/02 00:02:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Chris\Application Data\TechWizard
[2010/05/29 20:51:02 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2010/05/15 01:20:34 | 000,000,340 | —- | M] () – C:\WINDOWS\Tasks\McDefragTask.job
[2010/05/01 01:00:11 | 000,000,318 | —- | M] () – C:\WINDOWS\Tasks\McQcTask.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/05/29 16:41:07 | 000,002,460 | —- | M] () – C:\aaw7boot.log
[2010/01/24 22:32:33 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010/01/24 22:25:58 | 000,000,209 | -HS- | M] () – C:\boot.ini
[2010/01/24 22:32:33 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/01/24 22:32:33 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/01/24 22:32:33 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/10 06:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/01/27 23:54:47 | 000,250,048 | RHS- | M] () – C:\ntldr
[2010/06/07 21:05:35 | 1610,612,736 | -HS- | M] () – C:\pagefile.sys
[2010/06/07 21:04:10 | 000,035,798 | —- | M] () – C:\TDSSKiller.2.3.2.0_07.06.2010_21.04.03_log.txt

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/04/13 19:11:51 | 001,267,200 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\comsvcs.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2010/01/24 16:17:18 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2010/01/24 16:17:18 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2010/01/24 16:17:18 | 000,905,216 | —- | M] () – C:\WINDOWS\system32\config\system.sav
< End of report >

OTL Extras logfile created on: 6/7/2010 9:33:33 PM - Run 1
OTL by OldTimer - Version 3.2.5.3 Folder = C:\Documents and Settings\Chris\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 657.00 Mb Available Physical Memory | 64.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.82 Gb Total Space | 168.32 Gb Free Space | 72.30% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 6.67 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive G: | 7.47 Gb Total Space | 3.27 Gb Free Space | 43.77% Space Free | Partition Type: FAT32
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME-6C42F4DA9A
Current User Name: Chris
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe" = C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent – (McAfee, Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{1C0E9C6B-D4D5-4D3C-8A10-F10A3E7BEEA5}" = WN111v2
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java™ 6 Update 18
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{6421F085-1FAA-DE13-D02A-CFB412C522A4}" = Acrobat.com
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{81063354-9060-42B2-A000-1EBE96778AA9}" = iTunes
"{91CA0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Small Business Edition 2003
"{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders
"{9E2514D9-DC24-4634-B348-61F3EF0F1628}" = Sound Blaster Audigy 2 ZS
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{FCD9CD52-7222-4672-94A0-A722BA702FD0}" = Dell Resource CD
"12133444-BF36-4d4e-B7FB-A3424C645DE4" = GemMaster Mystic
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"B3EE3001-DC24-4cd1-8743-5692C716659F" = Otto
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"ESPNMotion" = ESPNMotion
"GoToAssist" = GoToAssist 8.0.0.514
"ie8" = Windows Internet Explorer 8
"InstallShield_{1C0E9C6B-D4D5-4D3C-8A10-F10A3E7BEEA5}" = RangeMax Wireless-N USB Adapter WN111v2
"Intel® 537EP V9x DF PCI Modem" = Intel® 537EP V9x DF PCI Modem
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"MSC" = McAfee SecurityCenter
"PROSet" = Intel® PRO Network Connections Drivers
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows XP Service Pack" = Windows XP Service Pack 3

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/2/2010 12:40:51 AM | Computer Name = HOME-6C42F4DA9A | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 5/2/2010 12:40:52 AM | Computer Name = HOME-6C42F4DA9A | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 5/2/2010 12:40:52 AM | Computer Name = HOME-6C42F4DA9A | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 5/7/2010 11:55:36 PM | Computer Name = HOME-6C42F4DA9A | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 5/7/2010 11:55:39 PM | Computer Name = HOME-6C42F4DA9A | Source = Application Hang | ID = 1001
Description = Fault bucket 1180947459.

Error - 5/12/2010 4:10:06 PM | Computer Name = HOME-6C42F4DA9A | Source = Application Hang | ID = 1002
Description = Hanging application explorer.exe, version 6.0.2900.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 5/12/2010 4:24:32 PM | Computer Name = HOME-6C42F4DA9A | Source = MsiInstaller | ID = 11722
Description = Product: Vz In Home Agent – Error 1722. There is a problem with this
Windows Installer package. A program run as part of the setup did not finish as
expected. Contact your support personnel or package vendor. Action Run_iHAStarter2,
location: C:\Program Files\Verizon\FiOS\ihs\iHAStarter.exe, command: RunFromInstall
RUN_CW=NO CW_INSTALLER=TECHWIZARD INFO=VZID:V722659;MON:0S5772703

Error - 5/20/2010 11:59:50 PM | Computer Name = HOME-6C42F4DA9A | Source = SecurityCenter | ID = 1802
Description = The Windows Security Center Service was unable to establish event
queries with WMI to monitor third party AntiVirus and Firewall.

Error - 5/26/2010 9:50:50 PM | Computer Name = HOME-6C42F4DA9A | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 5/29/2010 12:07:56 AM | Computer Name = HOME-6C42F4DA9A | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 6/7/2010 9:05:13 PM | Computer Name = HOME-6C42F4DA9A | Source = Service Control Manager | ID = 7000
Description = The DHCP Client service failed to start due to the following error:
%%1053

Error - 6/7/2010 9:05:13 PM | Computer Name = HOME-6C42F4DA9A | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Wireless Zero Configuration
service to connect.

Error - 6/7/2010 9:05:13 PM | Computer Name = HOME-6C42F4DA9A | Source = Service Control Manager | ID = 7000
Description = The Wireless Zero Configuration service failed to start due to the
following error: %%1053

Error - 6/7/2010 9:05:13 PM | Computer Name = HOME-6C42F4DA9A | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Shell Hardware Detection
service to connect.

Error - 6/7/2010 9:05:13 PM | Computer Name = HOME-6C42F4DA9A | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Task Scheduler service
to connect.

Error - 6/7/2010 9:05:13 PM | Computer Name = HOME-6C42F4DA9A | Source = Service Control Manager | ID = 7000
Description = The Task Scheduler service failed to start due to the following error:
%%1053

Error - 6/7/2010 9:05:13 PM | Computer Name = HOME-6C42F4DA9A | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Windows Audio service
to connect.

Error - 6/7/2010 9:05:13 PM | Computer Name = HOME-6C42F4DA9A | Source = Service Control Manager | ID = 7000
Description = The Windows Audio service failed to start due to the following error:
%%1053

Error - 6/7/2010 9:06:05 PM | Computer Name = HOME-6C42F4DA9A | Source = Windows Update Agent | ID = 16
Description = Unable to Connect: Windows is unable to connect to the automatic updates
service and therefore cannot download and install updates according to the set
schedule. Windows will continue to try to establish a connection.

Error - 6/7/2010 10:05:56 PM | Computer Name = HOME-6C42F4DA9A | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC0000001'
while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring
the volume.

< End of report >

thanks

74C

Post #10June 8, 2010, 3:14 AM UTC

Forgot to mention: I can get on the internet now with my infected machine. I was able to install windows updates and mcafee updates

RPMcMurphy

Post #11June 8, 2010, 5:13 AM UTC

74C,

Excellent! Please run these for me now:

🖼Click to load external image (Posted Image) Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please post the results.

🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.

Once the update is complete, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, adware, dialers, and other riskware
- Archives
- E-mail databases
Click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View report… at the bottom.
Click the Save report… button.

[external image: Posted Image]
Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

Please include the following in your next post:

MBAM log

Kaspersky log

74C

Post #12June 10, 2010, 2:49 AM UTC

Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4182 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 6/8/2010 10:26:00 PM mbam-log-2010-06-08 (22-26-00).txt Scan type: Full scan (C:\|D:\|) Objects scanned: 186888 Time elapsed: 40 minute(s), 18 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 2 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Wednesday, June 9, 2010 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Wednesday, June 09, 2010 08:51:37 Records in database: 4228261 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Objects scanned: 70371 Threats found: 1 Infected objects found: 3 Suspicious objects found: 0 Scan duration: 01:18:56 File name / Threat / Threats count C:\Documents and Settings\Chris\Local Settings\Temp\jar_cache1012173550612707341.tmp Infected: Exploit.Java.CVE-2009-3867.d 1 C:\Documents and Settings\Chris\Local Settings\Temp\jar_cache3273499497389457868.tmp Infected: Exploit.Java.CVE-2009-3867.d 1 C:\Documents and Settings\Chris\Local Settings\Temp\jar_cache7375315771866828666.tmp Infected: Exploit.Java.CVE-2009-3867.d 1 Selected area has been scanned.

RPMcMurphy

Post #13June 10, 2010, 5:22 AM UTC

Hello 74C,

🖼Click to load external image (Posted Image) Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Files
C:\Documents and Settings\Chris\Local Settings\Temp\jar_cache1012173550612707341.tmp
C:\Documents and Settings\Chris\Local Settings\Temp\jar_cache3273499497389457868.tmp
C:\Documents and Settings\Chris\Local Settings\Temp\jar_cache7375315771866828666.tmp

:Commands
[EmptyFlash]
[EmptyTemp]

Then click the Run Fix button at the top
Let the program run unhindered, it will reboot when it is done and produce a log

🖼Click to load external image (Posted Image) Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 20. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
Click the "Download" button to the right.
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u20-windows-i586-p.exe to install the newest version.
After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH Checked
  Applications and AppletsTrace and Log Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

Please include the following in your next post:

OTL Fix log

74C

Post #14June 11, 2010, 3:14 AM UTC

Hi RPMcMurphy Here's the OTL log: All processes killed ========== FILES ========== C:\Documents and Settings\Chris\Local Settings\Temp\jar_cache1012173550612707341.tmp moved successfully. C:\Documents and Settings\Chris\Local Settings\Temp\jar_cache3273499497389457868.tmp moved successfully. C:\Documents and Settings\Chris\Local Settings\Temp\jar_cache7375315771866828666.tmp moved successfully. ========== COMMANDS ========== [EMPTYFLASH] User: All Users User: Chris ->Flash cache emptied: 98385 bytes User: Default User ->Flash cache emptied: 41620 bytes User: LocalService User: NetworkService ->Flash cache emptied: 15677 bytes Total Flash Files Cleaned = 0.00 mb [EMPTYTEMP] User: All Users User: Chris ->Temp folder emptied: 202212164 bytes ->Temporary Internet Files folder emptied: 236260783 bytes ->Java cache emptied: 1499313 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 120729087 bytes ->Flash cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 1225527 bytes %systemroot%\System32 .tmp files removed: 2577 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 39657803 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 34318 bytes RecycleBin emptied: 71655547 bytes Total Files Cleaned = 642.00 mb OTL by OldTimer - Version 3.2.5.3 log created on 06102010_202922 Files\Folders moved on Reboot… C:\Documents and Settings\Chris\Local Settings\Temporary Internet Files\Content.IE5\RC6JA4W5\view_topic_subscriptions[1].html moved successfully. C:\Documents and Settings\Chris\Local Settings\Temporary Internet Files\Content.IE5\L478FGE0\iframe[1].htm moved successfully. C:\Documents and Settings\Chris\Local Settings\Temporary Internet Files\Content.IE5\63JAHUVV\being_redirected_t112277[1].html moved successfully. File\Folder C:\WINDOWS\temp\mcafee_AcqrY1gfgEE832K not found! File\Folder C:\WINDOWS\temp\mcmsc_3ZaJqSI2AY9I3uB not found! File\Folder C:\WINDOWS\temp\mcmsc_6z2TLTNrLwe72Xz not found! Registry entries deleted on Reboot…

RPMcMurphy

Post #15June 11, 2010, 12:41 PM UTC

74C,

Everything looks good. Now I have some important cleanup for you to take care of:

🖼Click to load external image (Posted Image) Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
```
:Commands
[ClearAllRestorePoints]
```
Then click the Run Fix button at the top
Let the program run unhindered, it will reboot when it is done and produce a log - I don't need to see it unless you have a problem or question

🖼Click to load external image (Posted Image) Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.
Manually delete any remaining logs or tools.

🖼Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:

Restart any anti-malware programs that we disabled while we were cleaning your machine.
Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
Consider running in a limited user account. See this post for more information.
Please carefully review the information in our Security - Best Practices and Prevention forum located HERE

Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!

✨ Ask AI

Ask AI