What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Malware/Spyware: www.directrdr.com redirects in I8

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
At the top of the month I downloaded some game files that I shouldn't have and started to get redirects starting from www.directrdr.com. I tried some minor fixes and additional scanners (MalwareBytes, WindowsDefender and CounterSpy) to no avail. A few days ago I tried windows update and though I got to the site, it couldn't check my computer for updates. I had previously tried to clean out the start-up items through WindowsDefender, so that might have something to do with it, though I didn't touch anything that was recognized. In advance, thanks for the help. Here's my DDS log: DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 19:50:04.31 on Sun 06/27/2010 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.94 [GMT -5:00] AV: avast! Antivirus *On-access scanning enabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D} AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Common Files\Logitech\Bluetooth\LBTSERV.EXE C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup C:\WINDOWS\Explorer.EXE C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtKbd.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe svchost.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\McAfee\SiteAdvisor\McSACore.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe C:\Program Files\Microsoft SQL Server\MSSQL.2\OLAP\bin\msmdsrv.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Sunbelt Software\CounterSpy\SBAMSvc.exe C:\Program Files\Sunbelt Software\CounterSpy\SBPIMSvc.exe C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe svchost.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Sunbelt Software\CounterSpy\SBAMTray.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe c:\PROGRA~1\mcafee\msc\mcshell.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Lee\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.skysports.com/ uDefault_Page_URL = hxxp://www.msn.com uInternet Connection Wizard,ShellNext = hxxp://us.mcafee.com/root/learnmore/learnmore.asp?close=true&lcode=en-us BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1203.0\msneshellx.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1203.0\msneshellx.dll TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File uRun: [CTSyncU.exe] "c:\program files\creative\sync manager unicode\CTSyncU.exe" uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup uRun: [P2kAutostart] V510 uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe mRun: [ehTray] c:\windows\ehome\ehtray.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /installquiet mRun: [Apoint] c:\program files\apoint\Apoint.exe mRun: [IntelWireless] c:\program files\intel\wireless\bin\ifrmewrk.exe /tf Intel PROSet/Wireless mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey mRun: [NVHotkey] rundll32.exe nvHotkey.dll,Start mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [SBAMTray] "c:\program files\sunbelt software\counterspy\SBAMTray.exe" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\toshiba\bluetooth toshiba stack\TosBtMng.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL Trusted Zone: internet Trusted Zone: mcafee.com DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/3/9/8/398422c0-8d3e-40e1-a617-af65a72a0465/LegitCheckControl.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1207012707890 DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} - hxxp://zone.msn.com/bingame/luxr/default/mjolauncher.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab DPF: {C86FF4B0-AA1D-46D4-8612-025FB86583C7} - hxxp://zone.msn.com/bingame/jobo/default/AstoundLauncher.cab#version=1,0,0,10 DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: {219441F4-A8E1-4AC5-901C-9E62D5B69008} = 8.8.8.8,8.8.4.4 TCP: {C63513FD-6B64-463E-89F0-2B3A7307BAB3} = 8.8.8.8,8.8.4.4 Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll Notify: IntelWireless - c:\program files\intel\wireless\bin\LgNotify.dll Notify: LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll ============= SERVICES / DRIVERS =============== R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2008-2-1 214664] R1 sbaphd;sbaphd;c:\windows\system32\drivers\sbaphd.sys [2010-6-27 13400] R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2009-10-13 95024] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2008-10-5 206096] R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2008-2-1 359952] R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328] R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2008-2-1 144704] R2 MsDtsServer;SQL Server Integration Services;c:\program files\microsoft sql server\90\dts\binn\MsDtsSrvr.exe [2009-5-27 202584] R2 SBAMSvc;CounterSpy Antispyware;c:\program files\sunbelt software\counterspy\SBAMSvc.exe [2010-4-19 2726000] R2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [2010-6-27 69720] R2 SBPIMSvc;SB Recovery Service;c:\program files\sunbelt software\counterspy\SBPIMSvc.exe [2010-4-19 181584] R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2008-2-1 606736] R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2008-2-1 79816] R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2008-2-1 35272] R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2008-2-1 40552] S2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592] S3 AngelUsb;Angel USB MPEG Device;c:\windows\system32\drivers\AngelUsb.sys [2006-1-17 375424] S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2008-2-1 34248] S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2009-4-25 18688] S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2009-4-25 8320] S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2009-4-25 23680] S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe [2006-12-2 2805000] =============== Created Last 30 ================ 2010-06-27 08:44 69,720 a——- c:\windows\system32\drivers\sbapifs.sys 2010-06-27 08:44 13,400 a——- c:\windows\system32\drivers\sbaphd.sys 2010-06-27 08:39 –d—– c:\docume~1\lee\applic~1\Sunbelt 2010-06-27 08:39 –d—– c:\docume~1\alluse~1\applic~1\Sunbelt 2010-06-27 08:38 –d—– c:\program files\Sunbelt Software 2010-06-26 21:15 69,680 a——- c:\windows\system32\PxSecure.dll 2010-06-26 17:26 664 a——- c:\windows\system32\d3d9caps.dat 2010-06-26 17:03 763,832 a——- c:\windows\BDTSupport.dll.old 2010-06-26 17:03 1,652,664 a——- c:\windows\PCTBDCore.dll.old 2010-06-26 16:54 –d—– c:\program files\Spyware Doctor 2010-06-21 12:19 411,368 a——- c:\windows\system32\deployJava1.dll 2010-06-21 12:19 73,728 a——- c:\windows\system32\javacpl.cpl 2010-06-20 21:15 –d—– c:\docume~1\lee\applic~1\Malwarebytes 2010-06-20 21:14 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2010-06-20 21:14 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-06-20 21:14 20,952 a——- c:\windows\system32\drivers\mbam.sys 2010-06-20 21:14 –d—– c:\program files\Malwarebytes' Anti-Malware 2010-06-14 11:20 –d-h— c:\windows\PIF 2010-06-11 22:18 –d—– c:\docume~1\alluse~1\applic~1\Alwil Software 2010-06-11 12:57 –d—– c:\program files\Panda Security 2010-06-09 18:46 –d—– c:\windows\system32\wbem\Repository 2010-06-06 13:14 221,568 ——– c:\windows\system32\MpSigStub.exe ==================== Find3M ==================== 2010-06-27 09:57 35,021 a——- c:\windows\system32\nvModes.dat 2010-04-19 13:48 27,984 a——- c:\windows\system32\sbbd.exe 2008-02-01 18:28 61,480 a——- c:\documents and settings\lee\GoToAssistDownloadHelper.exe 2006-04-08 16:03 3,884,032 a–sh— c:\program files\ehthumbs.db 2006-05-26 18:10 56 —shr– c:\windows\system32\82CA6AB925.sys 2006-05-26 18:10 3,818 a–sh— c:\windows\system32\KGyGaAvL.sys 2009-10-14 18:36 245,760 a–sh— c:\windows\system32\config\systemprofile\ietldcache\index.dat 2008-09-05 18:40 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090520080906\index.dat ============= FINISH: 19:53:42.21 ===============
Post #2
Hello LBBS and welcome to the forums here at WTT.

:welcome:

Are you still being redirected? Can you post the log from MalwareBytes?

I also see you have 2 Antivirus programs installed and that can cause some of the issues you are describing. I realize you probably did so to try and clean this up but you should uninstall, or at least disable either Avast or McAfee.

Download This file. Note its name and save it to your root folder, such as C:\.

  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
  • Click on this link to see a list of programs that should be disabled.
  • Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
  • Allow the driver to load if asked.
  • You may be prompted to scan immediately if it detects rootkit activity.
  • If you are prompted to scan your system click "Yes" to begin the scan.
  • If not prompted, click the "Rootkit/Malware" tab.
  • On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
  • Select the drive that Windows is installed on, typically C:\, and uncheck the rest.
  • Click the Scan button to begin. (Please be patient as it can take some time to complete)
  • When the scan is finished, click Save to save the scan results to your Desktop.
  • Save the file as Results.txt and copy/paste the contents in your next reply. If the file is too large to copy and paste you can upload it.
  • Exit the program and re-enable all active protection when done.
Post #3
Thanks for the help IndiGenus. I'll run through the pieces that you suggested. In the mean time, here's the other info that I have: Explorer is still opening up additional windows and going through directrdr.com to various add pages. I also had a few google search result pages open to random other sites similar to what has been described on other posts, though that is not as constant a occurance as the pop-ups. I added Avast temporarily after getting infected in the hopes that it would detect what McAfee would not. I've since uninstalled that program and tried a few others with similar results. Currently I have McAfee active, with CounterSpy and MalwareBytes also installed. The log from the last MalwareBytes scan is below. Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4245 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 6/28/2010 2:45:46 PM mbam-log-2010-06-28 (14-45-46).txt Scan type: Quick scan Objects scanned: 153654 Time elapsed: 19 minute(s), 35 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #5
OK. I had a few issues with Gmer, so I actually am going to post three logs. The first is the one that popped up when I opened it. The second is the one that ran, but was interrupted. I tried it a few times, but always ended up getting hung up on '\device\0000003d'. The third one is from a scan done in safe mode.

On open:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-06-29 10:35:14
Windows 5.1.2600 Service Pack 3
Running: en5qbqf0.exe; Driver: C:\DOCUME~1\Lee\LOCALS~1\Temp\fxrdrkow.sys


—- System - GMER 1.0.15 —-

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xF3DE178A]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xF3DE1738]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xF3DE174C]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xF3DE1835]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xF3DE1861]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateKey [0xF3DE18CD]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateValueKey [0xF3DE18B7]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xF3DE17CA]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0xF3DE18F9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xF3DE180D]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xF3DE1710]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xF3DE1724]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xF3DE179E]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryKey [0xF3DE1935]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0xF3DE18A1]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryValueKey [0xF3DE188B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xF3DE184B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0xF3DE1921]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0xF3DE190D]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0xF3DE1776]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xF3DE1762]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xF3DE17F9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnloadKey [0xF3DE18E3]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xF3DE17E0]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xF3DE17B4]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

—- EOF - GMER 1.0.15 —-

Interrupted:
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-06-29 10:40:43
Windows 5.1.2600 Service Pack 3
Running: en5qbqf0.exe; Driver: C:\DOCUME~1\Lee\LOCALS~1\Temp\fxrdrkow.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\system32\drivers\sbaphd.sys (Sunbelt ActiveProtection hook driver/Sunbelt Software) ZwCreateKey [0xF7A3D4D0]
SSDT \SystemRoot\system32\drivers\sbaphd.sys (Sunbelt ActiveProtection hook driver/Sunbelt Software) ZwSetValueKey [0xF7A3D520]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xF3DE178A]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xF3DE1738]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xF3DE174C]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xF3DE1835]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xF3DE1861]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateKey [0xF3DE18CD]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateValueKey [0xF3DE18B7]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xF3DE17CA]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0xF3DE18F9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xF3DE180D]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xF3DE1710]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xF3DE1724]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xF3DE179E]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryKey [0xF3DE1935]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0xF3DE18A1]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryValueKey [0xF3DE188B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xF3DE184B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0xF3DE1921]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0xF3DE190D]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0xF3DE1776]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xF3DE1762]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xF3DE17F9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnloadKey [0xF3DE18E3]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xF3DE17E0]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xF3DE17B4]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess

—- Kernel code sections - GMER 1.0.15 —-

PAGE ntkrnlpa.exe!ZwReplaceKey + 3 8061C41B 2 Bytes [7C, 73] {JL 0x75}
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF6730380, 0x22091D, 0xE8000020]

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\system32\svchost.exe[188] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00900FE5
.text C:\WINDOWS\system32\svchost.exe[188] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00900F54
.text C:\WINDOWS\system32\svchost.exe[188] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00900049
.text C:\WINDOWS\system32\svchost.exe[188] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00900F6F
.text C:\WINDOWS\system32\svchost.exe[188] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 0090002C
.text C:\WINDOWS\system32\svchost.exe[188] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00900000
.text C:\WINDOWS\system32\svchost.exe[188] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00900F32
.text C:\WINDOWS\system32\svchost.exe[188] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00900F43
.text C:\WINDOWS\system32\svchost.exe[188] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00900F06
.text C:\WINDOWS\system32\svchost.exe[188] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00900095
.text C:\WINDOWS\system32\svchost.exe[188] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00900EF5
.text C:\WINDOWS\system32\svchost.exe[188] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00900011
.text C:\WINDOWS\system32\svchost.exe[188] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00900FCA
.text C:\WINDOWS\system32\svchost.exe[188] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00900064
.text C:\WINDOWS\system32\svchost.exe[188] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00900F94
.text C:\WINDOWS\system32\svchost.exe[188] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00900FB9
.text C:\WINDOWS\system32\svchost.exe[188] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00900F17
.text C:\WINDOWS\system32\svchost.exe[188] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 008F0025
.text C:\WINDOWS\system32\svchost.exe[188] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 008F0F9E
.text C:\WINDOWS\system32\svchost.exe[188] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 008F0FD4
.text C:\WINDOWS\system32\svchost.exe[188] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 008F0FE5
.text C:\WINDOWS\system32\svchost.exe[188] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 008F0FAF
.text C:\WINDOWS\system32\svchost.exe[188] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 008F0000
.text C:\WINDOWS\system32\svchost.exe[188] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 008F0047
.text C:\WINDOWS\system32\svchost.exe[188] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 008F0036
.text C:\WINDOWS\system32\svchost.exe[188] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 008E0F7A
.text C:\WINDOWS\system32\svchost.exe[188] msvcrt.dll!system 77C293C7 5 Bytes JMP 008E0F8B
.text C:\WINDOWS\system32\svchost.exe[188] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 008E0FB7
.text C:\WINDOWS\system32\svchost.exe[188] msvcrt.dll!_open 77C2F566 5 Bytes JMP 008E0FEF
.text C:\WINDOWS\system32\svchost.exe[188] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 008E0F9C
.text C:\WINDOWS\system32\svchost.exe[188] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 008E0FD2
.text C:\WINDOWS\system32\svchost.exe[188] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 001C0000
.text C:\WINDOWS\system32\svchost.exe[188] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 001C0FEF
.text C:\WINDOWS\system32\svchost.exe[188] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 001C0FD4
.text C:\WINDOWS\system32\svchost.exe[188] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 001C0025
.text C:\WINDOWS\Explorer.EXE[240] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00B7000A
.text C:\WINDOWS\Explorer.EXE[240] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00BD000A
.text C:\WINDOWS\Explorer.EXE[240] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00B6000C
.text C:\WINDOWS\Explorer.EXE[240] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 01810000
.text C:\WINDOWS\Explorer.EXE[240] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 01810067
.text C:\WINDOWS\Explorer.EXE[240] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 01810F68
.text C:\WINDOWS\Explorer.EXE[240] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 01810036
.text C:\WINDOWS\Explorer.EXE[240] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 01810F79
.text C:\WINDOWS\Explorer.EXE[240] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 01810F9B
.text C:\WINDOWS\Explorer.EXE[240] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 01810078
.text C:\WINDOWS\Explorer.EXE[240] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 01810F30
.text C:\WINDOWS\Explorer.EXE[240] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 01810EF3
.text C:\WINDOWS\Explorer.EXE[240] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 01810F0E
.text C:\WINDOWS\Explorer.EXE[240] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 01810EE2
.text C:\WINDOWS\Explorer.EXE[240] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 01810F8A
.text C:\WINDOWS\Explorer.EXE[240] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 01810FDB
.text C:\WINDOWS\Explorer.EXE[240] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 01810F57
.text C:\WINDOWS\Explorer.EXE[240] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 01810011
.text C:\WINDOWS\Explorer.EXE[240] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 01810FCA
.text C:\WINDOWS\Explorer.EXE[240] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 01810F1F
.text C:\WINDOWS\Explorer.EXE[240] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 0180001B
.text C:\WINDOWS\Explorer.EXE[240] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 01800F94
.text C:\WINDOWS\Explorer.EXE[240] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0180000A
.text C:\WINDOWS\Explorer.EXE[240] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 01800FDE
.text C:\WINDOWS\Explorer.EXE[240] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 01800047
.text C:\WINDOWS\Explorer.EXE[240] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 01800FEF
.text C:\WINDOWS\Explorer.EXE[240] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 01800FA5
.text C:\WINDOWS\Explorer.EXE[240] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [A0, 89]
.text C:\WINDOWS\Explorer.EXE[240] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 01800036
.text C:\WINDOWS\Explorer.EXE[240] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00E7005D
.text C:\WINDOWS\Explorer.EXE[240] msvcrt.dll!system 77C293C7 5 Bytes JMP 00E70FC8
.text C:\WINDOWS\Explorer.EXE[240] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00E70027
.text C:\WINDOWS\Explorer.EXE[240] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00E70FEF
.text C:\WINDOWS\Explorer.EXE[240] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00E70038
.text C:\WINDOWS\Explorer.EXE[240] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00E7000C
.text C:\WINDOWS\Explorer.EXE[240] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 00E5000A
.text C:\WINDOWS\Explorer.EXE[240] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 00E5001B
.text C:\WINDOWS\Explorer.EXE[240] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 00E5002C
.text C:\WINDOWS\Explorer.EXE[240] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 00E50FDB
.text C:\WINDOWS\Explorer.EXE[240] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00E60FEF
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[392] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0041C130 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[392] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 0041C1B0 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\WINDOWS\system32\svchost.exe[512] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 009F0FEF
.text C:\WINDOWS\system32\svchost.exe[512] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 009F0069
.text C:\WINDOWS\system32\svchost.exe[512] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 009F0058
.text C:\WINDOWS\system32\svchost.exe[512] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 009F0F8A
.text C:\WINDOWS\system32\svchost.exe[512] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 009F003D
.text C:\WINDOWS\system32\svchost.exe[512] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 009F0022
.text C:\WINDOWS\system32\svchost.exe[512] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 009F008E
.text C:\WINDOWS\system32\svchost.exe[512] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 009F0F3C
.text C:\WINDOWS\system32\svchost.exe[512] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 009F00A9
.text C:\WINDOWS\system32\svchost.exe[512] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 009F0F10
.text C:\WINDOWS\system32\svchost.exe[512] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 009F0EF5
.text C:\WINDOWS\system32\svchost.exe[512] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 009F0F9B
.text C:\WINDOWS\system32\svchost.exe[512] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 009F0000
.text C:\WINDOWS\system32\svchost.exe[512] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 009F0F59
.text C:\WINDOWS\system32\svchost.exe[512] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 009F0FC0
.text C:\WINDOWS\system32\svchost.exe[512] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 009F0011
.text C:\WINDOWS\system32\svchost.exe[512] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 009F0F21
.text C:\WINDOWS\system32\svchost.exe[512] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 009E0040
.text C:\WINDOWS\system32\svchost.exe[512] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 009E0091
.text C:\WINDOWS\system32\svchost.exe[512] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 009E0025
.text C:\WINDOWS\system32\svchost.exe[512] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 009E000A
.text C:\WINDOWS\system32\svchost.exe[512] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 009E0FCA
.text C:\WINDOWS\system32\svchost.exe[512] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 009E0FEF
.text C:\WINDOWS\system32\svchost.exe[512] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 009E006C
.text C:\WINDOWS\system32\svchost.exe[512] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 009E0051
.text C:\WINDOWS\system32\svchost.exe[512] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 009D005D
.text C:\WINDOWS\system32\svchost.exe[512] msvcrt.dll!system 77C293C7 5 Bytes JMP 009D0042
.text C:\WINDOWS\system32\svchost.exe[512] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 009D000C
.text C:\WINDOWS\system32\svchost.exe[512] msvcrt.dll!_open 77C2F566 5 Bytes JMP 009D0FE3
.text C:\WINDOWS\system32\svchost.exe[512] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 009D0027
.text C:\WINDOWS\system32\svchost.exe[512] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 009D0FD2
.text C:\WINDOWS\system32\svchost.exe[512] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 001B0FEF
.text C:\WINDOWS\system32\svchost.exe[512] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 001B000A
.text C:\WINDOWS\system32\svchost.exe[512] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 001B0FD4
.text C:\WINDOWS\system32\svchost.exe[512] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 001B0FC3
.text C:\WINDOWS\system32\svchost.exe[512] WS2_32.dll!socket 71AB4211 5 Bytes JMP 001C0FEF
.text C:\WINDOWS\system32\svchost.exe[648] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C40FEF
.text C:\WINDOWS\system32\svchost.exe[648] kernel32.dll!VirtualProtectEx 7C801A61 1 Byte [E9]
.text C:\WINDOWS\system32\svchost.exe[648] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C40065
.text C:\WINDOWS\system32\svchost.exe[648] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C4004A
.text C:\WINDOWS\system32\svchost.exe[648] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C40F7C
.text C:\WINDOWS\system32\svchost.exe[648] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C40F8D
.text C:\WINDOWS\system32\svchost.exe[648] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C40FA8
.text C:\WINDOWS\system32\svchost.exe[648] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C400AE
.text C:\WINDOWS\system32\svchost.exe[648] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C40091
.text C:\WINDOWS\system32\svchost.exe[648] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C400DA
.text C:\WINDOWS\system32\svchost.exe[648] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C40F4B
.text C:\WINDOWS\system32\svchost.exe[648] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00C40F30
.text C:\WINDOWS\system32\svchost.exe[648] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00C4002F
.text C:\WINDOWS\system32\svchost.exe[648] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C40FD4
.text C:\WINDOWS\system32\svchost.exe[648] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00C40080
.text C:\WINDOWS\system32\svchost.exe[648] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00C40FC3
.text C:\WINDOWS\system32\svchost.exe[648] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00C4000A
.text C:\WINDOWS\system32\svchost.exe[648] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00C400C9
.text C:\WINDOWS\system32\svchost.exe[648] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00C30011
.text C:\WINDOWS\system32\svchost.exe[648] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00C30F6F
.text C:\WINDOWS\system32\svchost.exe[648] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00C30FC0
.text C:\WINDOWS\system32\svchost.exe[648] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00C30000
.text C:\WINDOWS\system32\svchost.exe[648] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00C30F8A
.text C:\WINDOWS\system32\svchost.exe[648] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00C30FEF
.text C:\WINDOWS\system32\svchost.exe[648] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00C3002C
.text C:\WINDOWS\system32\svchost.exe[648] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00C30FA5
.text C:\WINDOWS\system32\svchost.exe[648] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00C20FA6
.text C:\WINDOWS\system32\svchost.exe[648] msvcrt.dll!system 77C293C7 5 Bytes JMP 00C20FB7
.text C:\WINDOWS\system32\svchost.exe[648] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00C20FD2
.text C:\WINDOWS\system32\svchost.exe[648] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00C20000
.text C:\WINDOWS\system32\svchost.exe[648] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00C20027
.text C:\WINDOWS\system32\svchost.exe[648] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00C20FE3
.text C:\WINDOWS\system32\svchost.exe[648] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 001B0000
.text C:\WINDOWS\system32\svchost.exe[648] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 001B0FEF
.text C:\WINDOWS\system32\svchost.exe[648] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 001B001B
.text C:\WINDOWS\system32\svchost.exe[648] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 001B0FCA
.text C:\WINDOWS\system32\svchost.exe[648] WS2_32.dll!socket 71AB4211 5 Bytes JMP 001C0FEF
.text C:\WINDOWS\system32\services.exe[1368] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 013E0000
.text C:\WINDOWS\system32\services.exe[1368] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 013E0087
.text C:\WINDOWS\system32\services.exe[1368] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 013E0076
.text C:\WINDOWS\system32\services.exe[1368] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 013E0F92
.text C:\WINDOWS\system32\services.exe[1368] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 013E0051
.text C:\WINDOWS\system32\services.exe[1368] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 013E0036
.text C:\WINDOWS\system32\services.exe[1368] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 013E00A2
.text C:\WINDOWS\system32\services.exe[1368] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 013E0F66
.text C:\WINDOWS\system32\services.exe[1368] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 013E00D8
.text C:\WINDOWS\system32\services.exe[1368] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 013E0F3F
.text C:\WINDOWS\system32\services.exe[1368] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 013E0F1A
.text C:\WINDOWS\system32\services.exe[1368] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 013E0FAF
.text C:\WINDOWS\system32\services.exe[1368] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 013E0FE5
.text C:\WINDOWS\system32\services.exe[1368] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 013E0F77
.text C:\WINDOWS\system32\services.exe[1368] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 013E0025
.text C:\WINDOWS\system32\services.exe[1368] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 013E0FD4
.text C:\WINDOWS\system32\services.exe[1368] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 013E00BD
.text C:\WINDOWS\system32\services.exe[1368] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 01350FCD
.text C:\WINDOWS\system32\services.exe[1368] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 01350F90
.text C:\WINDOWS\system32\services.exe[1368] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0135001E
.text C:\WINDOWS\system32\services.exe[1368] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 01350FDE
.text C:\WINDOWS\system32\services.exe[1368] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 01350FAB
.text C:\WINDOWS\system32\services.exe[1368] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 01350FEF
.text C:\WINDOWS\system32\services.exe[1368] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 01350FBC
.text C:\WINDOWS\system32\services.exe[1368] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [55, 89]
.text C:\WINDOWS\system32\services.exe[1368] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 01350039
.text C:\WINDOWS\system32\services.exe[1368] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 01340FBE
.text C:\WINDOWS\system32\services.exe[1368] msvcrt.dll!system 77C293C7 5 Bytes JMP 01340FCF
.text C:\WINDOWS\system32\services.exe[1368] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 01340038
.text C:\WINDOWS\system32\services.exe[1368] msvcrt.dll!_open 77C2F566 5 Bytes JMP 01340000
.text C:\WINDOWS\system32\services.exe[1368] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 01340049
.text C:\WINDOWS\system32\services.exe[1368] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0134001D
.text C:\WINDOWS\system32\services.exe[1368] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 01320FEF
.text C:\WINDOWS\system32\services.exe[1368] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 01320014
.text C:\WINDOWS\system32\services.exe[1368] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 01320FD4
.text C:\WINDOWS\system32\services.exe[1368] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 01320FC3
.text C:\WINDOWS\system32\services.exe[1368] WS2_32.dll!socket 71AB4211 5 Bytes JMP 01330FEF
.text C:\WINDOWS\system32\lsass.exe[1380] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00D30FEF
.text C:\WINDOWS\system32\lsass.exe[1380] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00D30F58
.text C:\WINDOWS\system32\lsass.exe[1380] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00D30F69
.text C:\WINDOWS\system32\lsass.exe[1380] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00D30F86
.text C:\WINDOWS\system32\lsass.exe[1380] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00D30043
.text C:\WINDOWS\system32\lsass.exe[1380] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00D30FA8
.text C:\WINDOWS\system32\lsass.exe[1380] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00D30083
.text C:\WINDOWS\system32\lsass.exe[1380] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00D30F47
.text C:\WINDOWS\system32\lsass.exe[1380] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00D30EFB
.text C:\WINDOWS\system32\lsass.exe[1380] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00D30094
.text C:\WINDOWS\system32\lsass.exe[1380] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00D300AF
.text C:\WINDOWS\system32\lsass.exe[1380] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00D30F97
.text C:\WINDOWS\system32\lsass.exe[1380] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00D30FD4
.text C:\WINDOWS\system32\lsass.exe[1380] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00D30068
.text C:\WINDOWS\system32\lsass.exe[1380] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00D30FC3
.text C:\WINDOWS\system32\lsass.exe[1380] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00D30014
.text C:\WINDOWS\system32\lsass.exe[1380] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00D30F20
.text C:\WINDOWS\system32\lsass.exe[1380] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00D20047
.text C:\WINDOWS\system32\lsass.exe[1380] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00D20080
.text C:\WINDOWS\system32\lsass.exe[1380] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00D20036
.text C:\WINDOWS\system32\lsass.exe[1380] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00D2001B
.text C:\WINDOWS\system32\lsass.exe[1380] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00D20FB9
.text C:\WINDOWS\system32\lsass.exe[1380] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00D2000A
.text C:\WINDOWS\system32\lsass.exe[1380] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00D20FCA
.text C:\WINDOWS\system32\lsass.exe[1380] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [F2, 88]
.text C:\WINDOWS\system32\lsass.exe[1380] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00D20FE5
.text C:\WINDOWS\system32\lsass.exe[1380] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00CD0031
.text C:\WINDOWS\system32\lsass.exe[1380] msvcrt.dll!system 77C293C7 5 Bytes JMP 00CD0FA6
.text C:\WINDOWS\system32\lsass.exe[1380] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00CD0FC8
.text C:\WINDOWS\system32\lsass.exe[1380] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00CD0FEF
.text C:\WINDOWS\system32\lsass.exe[1380] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00CD0FB7
.text C:\WINDOWS\system32\lsass.exe[1380] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00CD000C
.text C:\WINDOWS\system32\lsass.exe[1380] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00CC0FE5
.text C:\WINDOWS\system32\lsass.exe[1380] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 00CB0FEF
.text C:\WINDOWS\system32\lsass.exe[1380] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 00CB000A
.text C:\WINDOWS\system32\lsass.exe[1380] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 00CB001B
.text C:\WINDOWS\system32\lsass.exe[1380] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 00CB0FD4
.text C:\WINDOWS\system32\svchost.exe[1588] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00F80000
.text C:\WINDOWS\system32\svchost.exe[1588] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00F80F68
.text C:\WINDOWS\system32\svchost.exe[1588] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00F80F79
.text C:\WINDOWS\system32\svchost.exe[1588] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00F80F94
.text C:\WINDOWS\system32\svchost.exe[1588] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00F80FA5
.text C:\WINDOWS\system32\svchost.exe[1588] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00F80036
.text C:\WINDOWS\system32\svchost.exe[1588] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00F80F2B
.text C:\WINDOWS\system32\svchost.exe[1588] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00F80F46
.text C:\WINDOWS\system32\svchost.exe[1588] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00F800BD
.text C:\WINDOWS\system32\svchost.exe[1588] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00F80098
.text C:\WINDOWS\system32\svchost.exe[1588] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00F800CE
.text C:\WINDOWS\system32\svchost.exe[1588] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00F80047
.text C:\WINDOWS\system32\svchost.exe[1588] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00F80FDB
.text C:\WINDOWS\system32\svchost.exe[1588] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00F80F57
.text C:\WINDOWS\system32\svchost.exe[1588] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00F80FC0
.text C:\WINDOWS\system32\svchost.exe[1588] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00F80011
.text C:\WINDOWS\system32\svchost.exe[1588] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00F80F1A
.text C:\WINDOWS\system32\svchost.exe[1588] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00F70040
.text C:\WINDOWS\system32\svchost.exe[1588] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00F7007D
.text C:\WINDOWS\system32\svchost.exe[1588] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00F7001B
.text C:\WINDOWS\system32\svchost.exe[1588] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00F7000A
.text C:\WINDOWS\system32\svchost.exe[1588] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00F7006C
.text C:\WINDOWS\system32\svchost.exe[1588] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00F70FEF
.text C:\WINDOWS\system32\svchost.exe[1588] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00F70FD4
.text C:\WINDOWS\system32\svchost.exe[1588] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [17, 89]
.text C:\WINDOWS\system32\svchost.exe[1588] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00F70051
.text C:\WINDOWS\system32\svchost.exe[1588] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00F60042
.text C:\WINDOWS\system32\svchost.exe[1588] msvcrt.dll!system 77C293C7 5 Bytes JMP 00F60FB7
.text C:\WINDOWS\system32\svchost.exe[1588] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00F6000C
.text C:\WINDOWS\system32\svchost.exe[1588] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00F60FEF
.text C:\WINDOWS\system32\svchost.exe[1588] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00F60027
.text C:\WINDOWS\system32\svchost.exe[1588] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00F60FDE
.text C:\WINDOWS\system32\svchost.exe[1588] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 00EE0FEF
.text C:\WINDOWS\system32\svchost.exe[1588] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 00EE0FDE
.text C:\WINDOWS\system32\svchost.exe[1588] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 00EE0FCD
.text C:\WINDOWS\system32\svchost.exe[1588] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 00EE001E
.text C:\WINDOWS\system32\svchost.exe[1588] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00F50FEF
.text C:\WINDOWS\system32\svchost.exe[1640] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00FE0FEF
.text C:\WINDOWS\system32\svchost.exe[1640] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00FE008C
.text C:\WINDOWS\system32\svchost.exe[1640] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00FE0071
.text C:\WINDOWS\system32\svchost.exe[1640] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00FE0060
.text C:\WINDOWS\system32\svchost.exe[1640] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00FE0039
.text C:\WINDOWS\system32\svchost.exe[1640] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00FE0028
.text C:\WINDOWS\system32\svchost.exe[1640] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00FE0F61
.text C:\WINDOWS\system32\svchost.exe[1640] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00FE0F7C
.text C:\WINDOWS\system32\svchost.exe[1640] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00FE00E9
.text C:\WINDOWS\system32\svchost.exe[1640] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00FE0F50
.text C:\WINDOWS\system32\svchost.exe[1640] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00FE0F3F
.text C:\WINDOWS\system32\svchost.exe[1640] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00FE0FA1
.text C:\WINDOWS\system32\svchost.exe[1640] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00FE0FDE
.text C:\WINDOWS\system32\svchost.exe[1640] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00FE009D
.text C:\WINDOWS\system32\svchost.exe[1640] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00FE0FB2
.text C:\WINDOWS\system32\svchost.exe[1640] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00FE0FCD
.text C:\WINDOWS\system32\svchost.exe[1640] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00FE00C4
.text C:\WINDOWS\system32\svchost.exe[1640] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00F10FB2
.text C:\WINDOWS\system32\svchost.exe[1640] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00F1001E
.text C:\WINDOWS\system32\svchost.exe[1640] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00F10FC3
.text C:\WINDOWS\system32\svchost.exe[1640] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00F10FDE
.text C:\WINDOWS\system32\svchost.exe[1640] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00F10F61
.text C:\WINDOWS\system32\svchost.exe[1640] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00F10FEF
.text C:\WINDOWS\system32\svchost.exe[1640] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00F10F72
.text C:\WINDOWS\system32\svchost.exe[1640] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [11, 89]
.text C:\WINDOWS\system32\svchost.exe[1640] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00F10F8D
.text C:\WINDOWS\system32\svchost.exe[1640] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00F0005A
.text C:\WINDOWS\system32\svchost.exe[1640] msvcrt.dll!system 77C293C7 5 Bytes JMP 00F0003F
.text C:\WINDOWS\system32\svchost.exe[1640] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00F00FD9
.text C:\WINDOWS\system32\svchost.exe[1640] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00F00000
.text C:\WINDOWS\system32\svchost.exe[1640] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00F0002E
.text C:\WINDOWS\system32\svchost.exe[1640] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00F0001D
.text C:\WINDOWS\system32\svchost.exe[1640] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 00EE000A
.text C:\WINDOWS\system32\svchost.exe[1640] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 00EE0FEF
.text C:\WINDOWS\system32\svchost.exe[1640] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 00EE0FD4
.text C:\WINDOWS\system32\svchost.exe[1640] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 00EE0FB9
.text C:\WINDOWS\system32\svchost.exe[1640] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00EF0000
.text C:\WINDOWS\System32\svchost.exe[1724] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0092000A
.text C:\WINDOWS\System32\svchost.exe[1724] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 0093000A
.text C:\WINDOWS\System32\svchost.exe[1724] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 0091000C
.text C:\WINDOWS\System32\svchost.exe[1724] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 02500FEF
.text C:\WINDOWS\System32\svchost.exe[1724] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 02500F72
.text C:\WINDOWS\System32\svchost.exe[1724] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 02500F8D
.text C:\WINDOWS\System32\svchost.exe[1724] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 02500F9E
.text C:\WINDOWS\System32\svchost.exe[1724] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 0250005B
.text C:\WINDOWS\System32\svchost.exe[1724] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 02500040
.text C:\WINDOWS\System32\svchost.exe[1724] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 02500F3C
.text C:\WINDOWS\System32\svchost.exe[1724] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 02500082
.text C:\WINDOWS\System32\svchost.exe[1724] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 02500EF5
.text C:\WINDOWS\System32\svchost.exe[1724] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 02500F10
.text C:\WINDOWS\System32\svchost.exe[1724] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 02500EE4
.text C:\WINDOWS\System32\svchost.exe[1724] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 02500FAF
.text C:\WINDOWS\System32\svchost.exe[1724] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 0250000A
.text C:\WINDOWS\System32\svchost.exe[1724] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 02500F61
.text C:\WINDOWS\System32\svchost.exe[1724] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 02500FD4
.text C:\WINDOWS\System32\svchost.exe[1724] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 02500025
.text C:\WINDOWS\System32\svchost.exe[1724] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 02500F2B
.text C:\WINDOWS\System32\svchost.exe[1724] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 024F0036
.text C:\WINDOWS\System32\svchost.exe[1724] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 024F0F8A
.text C:\WINDOWS\System32\svchost.exe[1724] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 024F0025
.text C:\WINDOWS\System32\svchost.exe[1724] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 024F0014
.text C:\WINDOWS\System32\svchost.exe[1724] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 024F0047
.text C:\WINDOWS\System32\svchost.exe[1724] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 024F0FEF
.text C:\WINDOWS\System32\svchost.exe[1724] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 024F0FA5
.text C:\WINDOWS\System32\svchost.exe[1724] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [6F, 8A]
.text C:\WINDOWS\System32\svchost.exe[1724] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 024F0FC0
.text C:\WINDOWS\System32\svchost.exe[1724] USER32.dll!GetCursorPos 7E42974E 5 Bytes JMP 0175000A
.text C:\WINDOWS\System32\svchost.exe[1724] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 00D7000A
.text C:\WINDOWS\System32\svchost.exe[1724] msvcrt.dll!_wsystem 77C2931E 3 Bytes JMP 024E0042
.text C:\WINDOWS\System32\svchost.exe[1724] msvcrt.dll!_wsystem + 4 77C29322 1 Byte [8A]
.text C:\WINDOWS\System32\svchost.exe[1724] msvcrt.dll!system 77C293C7 3 Bytes JMP 024E0FB7
.text C:\WINDOWS\System32\svchost.exe[1724] msvcrt.dll!system + 4 77C293CB 1 Byte [8A]
.text C:\WINDOWS\System32\svchost.exe[1724] msvcrt.dll!_creat 77C2D40F 3 Bytes JMP 024E0FD2
.text C:\WINDOWS\System32\svchost.exe[1724] msvcrt.dll!_creat + 4 77C2D413 1 Byte [8A]
.text C:\WINDOWS\System32\svchost.exe[1724] msvcrt.dll!_open 77C2F566 5 Bytes JMP 024E0000
.text C:\WINDOWS\System32\svchost.exe[1724] msvcrt.dll!_wcreat 77C2FC9B 3 Bytes JMP 024E0027
.text C:\WINDOWS\System32\svchost.exe[1724] msvcrt.dll!_wcreat + 4 77C2FC9F 1 Byte [8A]
.text C:\WINDOWS\System32\svchost.exe[1724] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 024E0FE3
.text C:\WINDOWS\System32\svchost.exe[1724] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 02000FEF
.text C:\WINDOWS\System32\svchost.exe[1724] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 02000014
.text C:\WINDOWS\System32\svchost.exe[1724] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 02000025
.text C:\WINDOWS\System32\svchost.exe[1724] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 02000FCA
.text C:\WINDOWS\System32\svchost.exe[1724] WS2_32.dll!socket 71AB4211 5 Bytes JMP 024D0FEF
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00210000
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00210F77
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 0021006C
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00210F94
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00210FA5
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00210047
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00210F5C
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00210098
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00210F30
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 002100D3
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00210F1F
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00210FC0
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 0021001B
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00210087
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00210FDB
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 0021002C
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00210F4B
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00300FA1
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] msvcrt.dll!system 77C293C7 5 Bytes JMP 00300FB2
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00300018
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00300FEF
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00300FC3
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00300FDE
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 0031001B
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00310F83
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0031000A
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00310FDE
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00310036
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00310FEF
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00310F94
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [51, 88]
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00310FAF
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 0077000A
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 0077001B
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 00770036
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 0077005B
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2128] WS2_32.dll!socket 71AB4211 5 Bytes JMP 34100000
.text C:\WINDOWS\system32\svchost.exe[3416] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 001D000A
.text C:\WINDOWS\system32\svchost.exe[3416] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001D009D
.text C:\WINDOWS\system32\svchost.exe[3416] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 001D0FA8
.text C:\WINDOWS\system32\svchost.exe[3416] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 001D0076
.text C:\WINDOWS\system32\svchost.exe[3416] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 001D0FB9
.text C:\WINDOWS\system32\svchost.exe[3416] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 001D0040
.text C:\WINDOWS\system32\svchost.exe[3416] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 001D00C4
.text C:\WINDOWS\system32\svchost.exe[3416] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 001D0F7C
.text C:\WINDOWS\system32\svchost.exe[3416] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001D0F5A
.text C:\WINDOWS\system32\svchost.exe[3416] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 001D0F6B
.text C:\WINDOWS\system32\svchost.exe[3416] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 001D0118
.text C:\WINDOWS\system32\svchost.exe[3416] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 001D005B
.text C:\WINDOWS\system32\svchost.exe[3416] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 001D0FEF
.text C:\WINDOWS\system32\svchost.exe[3416] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 001D0F8D
.text C:\WINDOWS\system32\svchost.exe[3416] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 001D0FD4
.text C:\WINDOWS\system32\svchost.exe[3416] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 001D002F
.text C:\WINDOWS\system32\svchost.exe[3416] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 001D00E9
.text C:\WINDOWS\system32\svchost.exe[3416] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 002C001E
.text C:\WINDOWS\system32\svchost.exe[3416] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 002C0F8D
.text C:\WINDOWS\system32\svchost.exe[3416] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 002C0FC3
.text C:\WINDOWS\system32\svchost.exe[3416] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 002C0FD4
.text C:\WINDOWS\system32\svchost.exe[3416] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 002C0F9E
.text C:\WINDOWS\system32\svchost.exe[3416] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 002C0FE5
.text C:\WINDOWS\system32\svchost.exe[3416] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 002C004A
.text C:\WINDOWS\system32\svchost.exe[3416] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 002C002F
.text C:\WINDOWS\system32\svchost.exe[3416] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00410FB7
.text C:\WINDOWS\system32\svchost.exe[3416] msvcrt.dll!system 77C293C7 5 Bytes JMP 00410038
.text C:\WINDOWS\system32\svchost.exe[3416] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00410FC8
.text C:\WINDOWS\system32\svchost.exe[3416] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00410FEF
.text C:\WINDOWS\system32\svchost.exe[3416] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 0041001D
.text C:\WINDOWS\system32\svchost.exe[3416] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00410000
.text C:\WINDOWS\system32\svchost.exe[3416] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 00790000
.text C:\WINDOWS\system32\svchost.exe[3416] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 00790011
.text C:\WINDOWS\system32\svchost.exe[3416] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 00790036
.text C:\WINDOWS\system32\svchost.exe[3416] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 00790047
.text C:\WINDOWS\system32\svchost.exe[3416] WS2_32.dll!socket 71AB4211 5 Bytes JMP 001A0FEF
.text C:\WINDOWS\system32\svchost.exe[3512] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 001D0FEF
.text C:\WINDOWS\system32\svchost.exe[3512] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001D0067
.text C:\WINDOWS\system32\svchost.exe[3512] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 001D0056
.text C:\WINDOWS\system32\svchost.exe[3512] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 001D0F7C
.text C:\WINDOWS\system32\svchost.exe[3512] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 001D0039
.text C:\WINDOWS\system32\svchost.exe[3512] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 001D0FA1
.text C:\WINDOWS\system32\svchost.exe[3512] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 001D0098
.text C:\WINDOWS\system32\svchost.exe[3512] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 001D0F46
.text C:\WINDOWS\system32\svchost.exe[3512] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001D0EFF
.text C:\WINDOWS\system32\svchost.exe[3512] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 001D0F1A
.text C:\WINDOWS\system32\svchost.exe[3512] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 001D0EEE
.text C:\WINDOWS\system32\svchost.exe[3512] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 001D001E
.text C:\WINDOWS\system32\svchost.exe[3512] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 001D0FDE
.text C:\WINDOWS\system32\svchost.exe[3512] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 001D0F57
.text C:\WINDOWS\system32\svchost.exe[3512] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 001D0FB2
.text C:\WINDOWS\system32\svchost.exe[3512] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 001D0FCD
.text C:\WINDOWS\system32\svchost.exe[3512] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 001D0F2B
.text C:\WINDOWS\system32\svchost.exe[3512] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 002C000A
.text C:\WINDOWS\system32\svchost.exe[3512] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 002C005B
.text C:\WINDOWS\system32\svchost.exe[3512] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 002C0FC3
.text C:\WINDOWS\system32\svchost.exe[3512] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 002C0FDE
.text C:\WINDOWS\system32\svchost.exe[3512] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 002C0040
.text C:\WINDOWS\system32\svchost.exe[3512] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 002C0FEF
.text C:\WINDOWS\system32\svchost.exe[3512] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 002C0F9E
.text C:\WINDOWS\system32\svchost.exe[3512] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [4C, 88]
.text C:\WINDOWS\system32\svchost.exe[3512] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 002C0025
.text C:\WINDOWS\system32\svchost.exe[3512] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 0041000A
.text C:\WINDOWS\system32\svchost.exe[3512] msvcrt.dll!system 77C293C7 5 Bytes JMP 00410F7F
.text C:\WINDOWS\system32\svchost.exe[3512] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00410FAB
.text C:\WINDOWS\system32\svchost.exe[3512] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00410FE3
.text C:\WINDOWS\system32\svchost.exe[3512] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00410F9A
.text C:\WINDOWS\system32\svchost.exe[3512] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00410FD2
.text C:\WINDOWS\system32\svchost.exe[3512] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 0079000A
.text C:\WINDOWS\system32\svchost.exe[3512] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 00790025
.text C:\WINDOWS\system32\svchost.exe[3512] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 00790FEF
.text C:\WINDOWS\system32\svchost.exe[3512] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 00790040
.text C:\WINDOWS\system32\svchost.exe[3732] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00CA0FEF
.text C:\WINDOWS\system32\svchost.exe[3732] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00CA0F7C
.text C:\WINDOWS\system32\svchost.exe[3732] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00CA0071
.text C:\WINDOWS\system32\svchost.exe[3732] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00CA0F8D
.text C:\WINDOWS\system32\svchost.exe[3732] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00CA004A
.text C:\WINDOWS\system32\svchost.exe[3732] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00CA002F
.text C:\WINDOWS\system32\svchost.exe[3732] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00CA0F3F
.text C:\WINDOWS\system32\svchost.exe[3732] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00CA0F50
.text C:\WINDOWS\system32\svchost.exe[3732] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00CA00D1
.text C:\WINDOWS\system32\svchost.exe[3732] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00CA00B6
.text C:\WINDOWS\system32\svchost.exe[3732] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00CA0F13
.text C:\WINDOWS\system32\svchost.exe[3732] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00CA0FA8
.text C:\WINDOWS\system32\svchost.exe[3732] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00CA0FD4
.text C:\WINDOWS\system32\svchost.exe[3732] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00CA0F6B
.text C:\WINDOWS\system32\svchost.exe[3732] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00CA0FB9
.text C:\WINDOWS\system32\svchost.exe[3732] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00CA000A
.text C:\WINDOWS\system32\svchost.exe[3732] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00CA0F2E
.text C:\WINDOWS\system32\svchost.exe[3732] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00BD0FC0
.text C:\WINDOWS\system32\svchost.exe[3732] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00BD0F7C
.text C:\WINDOWS\system32\svchost.exe[3732] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00BD0011
.text C:\WINDOWS\system32\svchost.exe[3732] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00BD0000
.text C:\WINDOWS\system32\svchost.exe[3732] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00BD0F8D
.text C:\WINDOWS\system32\svchost.exe[3732] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00BD0FE5
.text C:\WINDOWS\system32\svchost.exe[3732] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00BD0F9E
.text C:\WINDOWS\system32\svchost.exe[3732] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [DD, 88]
.text C:\WINDOWS\system32\svchost.exe[3732] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00BD0FAF
.text C:\WINDOWS\system32\svchost.exe[3732] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00BC0070
.text C:\WINDOWS\system32\svchost.exe[3732] msvcrt.dll!system 77C293C7 5 Bytes JMP 00BC0055
.text C:\WINDOWS\system32\svchost.exe[3732] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00BC0029
.text C:\WINDOWS\system32\svchost.exe[3732] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00BC0FEF
.text C:\WINDOWS\system32\svchost.exe[3732] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00BC003A
.text C:\WINDOWS\system32\svchost.exe[3732] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00BC000C
.text C:\WINDOWS\system32\svchost.exe[3732] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 00BA0FEF
.text C:\WINDOWS\system32\svchost.exe[3732] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 00BA0FDE
.text C:\WINDOWS\system32\svchost.exe[3732] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 00BA000A
.text C:\WINDOWS\system32\svchost.exe[3732] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 00BA002F
.text C:\WINDOWS\system32\svchost.exe[3732] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BB0FEF
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00F20FEF
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00F20F83
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00F2006E
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00F20F94
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00F20FA5
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00F2002C
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00F20F4D
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00F20089
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00F200CB
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00F20F32
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00F200DC
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00F20047
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00F2000A
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00F20F68
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00F2001B
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00F20FCA
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00F200B0
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00F0005D
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] msvcrt.dll!system 77C293C7 5 Bytes JMP 00F00038
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00F0001D
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00F00FE3
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00F00FC8
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00F0000C
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00F10014
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00F10051
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00F10FC3
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00F10FD4
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00F10036
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00F10FEF
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00F10F94
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [11, 89]
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00F10025
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00EF0FEF
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 00EE0000
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 00EE0011
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 00EE002C
.text C:\WINDOWS\system32\inetsrv\inetinfo.exe[3828] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 00EE0047
.text C:\WINDOWS\system32\SearchIndexer.exe[4352] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
.text C:\WINDOWS\System32\svchost.exe[4716] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 001D0000
.text C:\WINDOWS\System32\svchost.exe[4716] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001D007F
.text C:\WINDOWS\System32\svchost.exe[4716] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 001D006E
.text C:\WINDOWS\System32\svchost.exe[4716] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 001D0F94
.text C:\WINDOWS\System32\svchost.exe[4716] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 001D0FAF
.text C:\WINDOWS\System32\svchost.exe[4716] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 001D0040
.text C:\WINDOWS\System32\svchost.exe[4716] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 001D0F41
.text C:\WINDOWS\System32\svchost.exe[4716] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 001D0F52
.text C:\WINDOWS\System32\svchost.exe[4716] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001D0F15
.text C:\WINDOWS\System32\svchost.exe[4716] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 001D0F26
.text C:\WINDOWS\System32\svchost.exe[4716] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 001D0F04
.text C:\WINDOWS\System32\svchost.exe[4716] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 001D0051
.text C:\WINDOWS\System32\svchost.exe[4716] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 001D0FE5
.text C:\WINDOWS\System32\svchost.exe[4716] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 001D0F6F
.text C:\WINDOWS\System32\svchost.exe[4716] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 001D0FD4
.text C:\WINDOWS\System32\svchost.exe[4716] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 001D0025
.text C:\WINDOWS\System32\svchost.exe[4716] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 001D00A4
.text C:\WINDOWS\System32\svchost.exe[4716] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 002C0FC3
.text C:\WINDOWS\System32\svchost.exe[4716] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 002C004D
.text C:\WINDOWS\System32\svchost.exe[4716] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 002C000A
.text C:\WINDOWS\System32\svchost.exe[4716] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 002C0FD4
.text C:\WINDOWS\System32\svchost.exe[4716] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 002C0F90
.text C:\WINDOWS\System32\svchost.exe[4716] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 002C0FEF
.text C:\WINDOWS\System32\svchost.exe[4716] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 002C0FA1
.text C:\WINDOWS\System32\svchost.exe[4716] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [4C, 88]
.text C:\WINDOWS\System32\svchost.exe[4716] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 002C0FB2
.text C:\WINDOWS\System32\svchost.exe[4716] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00410FAD
.text C:\WINDOWS\System32\svchost.exe[4716] msvcrt.dll!system 77C293C7 5 Bytes JMP 00410FBE
.text C:\WINDOWS\System32\svchost.exe[4716] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 0041002E
.text C:\WINDOWS\System32\svchost.exe[4716] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00410000
.text C:\WINDOWS\System32\svchost.exe[4716] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00410FD9
.text C:\WINDOWS\System32\svchost.exe[4716] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0041001D
.text C:\WINDOWS\System32\svchost.exe[4716] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 00790FEF
.text C:\WINDOWS\System32\svchost.exe[4716] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 00790000
.text C:\WINDOWS\System32\svchost.exe[4716] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 00790FC0
.text C:\WINDOWS\System32\svchost.exe[4716] WININET.dll!InternetOpenUrlW 3D9A6DDF 5 Bytes JMP 0079001B
.text C:\WINDOWS\System32\svchost.exe[4716] WS2_32.dll!socket 71AB4211 5 Bytes JMP 001A0000

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

Safe mode:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-06-29 14:18:06
Windows 5.1.2600 Service Pack 3
Running: en5qbqf0.exe; Driver: C:\DOCUME~1\Lee\LOCALS~1\Temp\fxrdrkow.sys


—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\system32\svchost.exe[640] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0092000A
.text C:\WINDOWS\system32\svchost.exe[640] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 0093000A
.text C:\WINDOWS\system32\svchost.exe[640] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 0091000C
.text C:\WINDOWS\system32\svchost.exe[640] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 0115000A
.text C:\WINDOWS\Explorer.EXE[1020] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00B7000A
.text C:\WINDOWS\Explorer.EXE[1020] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00BD000A
.text C:\WINDOWS\Explorer.EXE[1020] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00B6000C

—- EOF - GMER 1.0.15 —-
Post #6
Not sure if it's important, but I dug around a bit more and it looks like it's getting hung up on apphelp.dll in the windows\system32 folder.
Post #7
Okay let's go for the fix.

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

Please also run DDS again and post the logs.
Post #8
OK. Combofix ran without a hitch, though I did find that the uninstall of Avast didn't work - had to go back and run a cleaner to stop all the automated processes. I'll paste the combofix log first, then the dds, with the attach file attached.

Here's the combofix log:

ComboFix 10-06-29.02 - Lee 06/29/2010 18:45:07.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.424 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Lee\GoToAssistDownloadHelper.exe
c:\windows\system32\Cache
c:\windows\xpsp1hfm.log
E:\Autorun.inf

Infected copy of c:\windows\system32\drivers\mouclass.sys was found and disinfected
Restored copy from - Kitty had a snack :P
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_FAD


((((((((((((((((((((((((( Files Created from 2010-05-28 to 2010-06-30 )))))))))))))))))))))))))))))))
.

2010-06-27 13:44 . 2010-01-04 11:29 69720 —-a-w- c:\windows\system32\drivers\sbapifs.sys
2010-06-27 13:44 . 2010-01-04 11:29 13400 —-a-w- c:\windows\system32\drivers\sbaphd.sys
2010-06-27 13:39 . 2010-06-27 13:39 ——– d—–w- c:\documents and settings\Lee\Application Data\Sunbelt
2010-06-27 13:39 . 2010-06-27 13:39 ——– d—–w- c:\documents and settings\All Users\Application Data\Sunbelt
2010-06-27 13:38 . 2010-06-27 13:38 ——– d—–w- c:\program files\Sunbelt Software
2010-06-27 02:15 . 2010-06-27 02:15 69680 —-a-w- c:\windows\system32\PxSecure.dll
2010-06-26 22:28 . 2010-06-26 22:28 ——– d—–w- c:\documents and settings\Lee\Local Settings\Application Data\Threat Expert
2010-06-26 22:26 . 2010-06-28 00:33 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-06-26 21:54 . 2010-06-27 13:22 ——– d—–w- c:\program files\Spyware Doctor
2010-06-21 17:20 . 2010-06-21 17:20 503808 —-a-w- c:\documents and settings\Lee\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5f99b5a8-n\msvcp71.dll
2010-06-21 17:20 . 2010-06-21 17:20 499712 —-a-w- c:\documents and settings\Lee\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5f99b5a8-n\jmc.dll
2010-06-21 17:20 . 2010-06-21 17:20 348160 —-a-w- c:\documents and settings\Lee\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-5f99b5a8-n\msvcr71.dll
2010-06-21 17:20 . 2010-06-21 17:20 61440 —-a-w- c:\documents and settings\Lee\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-55dabcd5-n\decora-sse.dll
2010-06-21 17:20 . 2010-06-21 17:20 12800 —-a-w- c:\documents and settings\Lee\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-55dabcd5-n\decora-d3d.dll
2010-06-21 17:19 . 2010-06-21 17:18 411368 —-a-w- c:\windows\system32\deployJava1.dll
2010-06-21 17:18 . 2010-06-21 17:18 ——– d—–w- c:\program files\Common Files\Java
2010-06-21 02:15 . 2010-06-21 02:15 ——– d—–w- c:\documents and settings\Lee\Application Data\Malwarebytes
2010-06-21 02:14 . 2010-04-29 20:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-21 02:14 . 2010-06-21 02:14 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-06-21 02:14 . 2010-04-29 20:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-06-21 02:14 . 2010-06-21 02:15 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-06-14 16:20 . 2010-06-14 16:20 ——– d–h–w- c:\windows\PIF
2010-06-12 03:18 . 2010-06-12 03:18 ——– d—–w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-06-11 17:57 . 2010-06-12 02:55 ——– d—–w- c:\program files\Panda Security
2010-06-09 23:46 . 2010-06-09 23:46 ——– d—–w- c:\windows\system32\wbem\Repository
2010-06-09 17:48 . 2010-06-09 17:48 300384 —-a-w- c:\documents and settings\All Users\Application Data\McAfee\Supportability\Content\MVT\XMLFiles\detect.dll
2010-06-06 18:14 . 2010-05-21 19:14 221568 ——w- c:\windows\system32\MpSigStub.exe
2010-06-06 18:00 . 2010-06-09 23:45 ——– d—–w- c:\program files\Windows Defender

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-27 14:57 . 2006-01-17 07:22 35021 —-a-w- c:\windows\system32\nvModes.dat
2010-06-27 13:19 . 2008-02-18 18:22 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-06-26 12:05 . 2008-10-06 20:24 ——– d—–w- c:\documents and settings\LocalService\Application Data\SACore
2010-06-21 17:18 . 2006-01-17 07:30 ——– d—–w- c:\program files\Java
2010-06-16 02:15 . 2008-02-01 23:52 ——– d—–w- c:\program files\McAfee
2010-06-09 23:30 . 2006-01-17 07:49 ——– d—–w- c:\program files\QuickTime
2010-06-09 17:48 . 2008-02-01 23:09 300384 —-a-w- c:\documents and settings\Lee\Application Data\McAfee\Supportability\MVTLogs\Results\detect.dll
2010-06-09 16:56 . 2006-01-17 07:34 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-06-07 16:34 . 2006-01-17 07:49 ——– d—–w- c:\documents and settings\All Users\Application Data\QuickTime
2010-05-25 00:00 . 2010-05-25 00:00 ——– d—–w- c:\program files\7-Zip
2010-05-24 23:07 . 2010-05-24 23:07 ——– d—–w- c:\program files\NifTools
2010-05-24 22:14 . 2010-05-24 22:14 ——– d—–w- c:\program files\Smith Micro
2010-04-19 18:48 . 2010-04-19 18:48 27984 —-a-w- c:\windows\system32\sbbd.exe
2006-04-08 21:03 . 2006-04-08 21:03 3884032 –sha-w- c:\program files\ehthumbs.db
2006-05-26 23:10 . 2006-01-26 03:48 56 –sh–r- c:\windows\system32\82CA6AB925.sys
2006-05-26 23:10 . 2006-01-26 03:48 3818 –sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"P2kAutostart"="V510" [X]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-09-05 700416]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-03-23 7561216]
"nwiz"="nwiz.exe" [2006-03-23 1519616]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-03-28 94208]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]
"NVHotkey"="nvHotkey.dll" [2006-03-23 73728]
"NvMediaCenter"="NvMCTray.dll" [2006-03-23 86016]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"SBAMTray"="c:\program files\Sunbelt Software\CounterSpy\SBAMTray.exe" [2010-04-19 1291600]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-11-18 1724416]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-1-17 24576]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-8-28 805392]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-09-07 22:08 110592 —-a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 08:42 72208 —-a-w- c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBPIMSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Civilization4.exe"=
"c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Warlords\\Civ4Warlords.exe"=
"c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization 4 Complete\\Beyond the Sword\\Civ4BeyondSword.exe"=
"c:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization IV Colonization\\Colonization.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 sbaphd;sbaphd;c:\windows\system32\drivers\sbaphd.sys [6/27/2010 8:44 AM 13400]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [10/13/2009 9:02 AM 95024]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [10/5/2008 5:58 PM 206096]
R2 SBAMSvc;CounterSpy Antispyware;c:\program files\Sunbelt Software\CounterSpy\SBAMSvc.exe [4/19/2010 1:48 PM 2726000]
R2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [6/27/2010 8:44 AM 69720]
R2 SBPIMSvc;SB Recovery Service;c:\program files\Sunbelt Software\CounterSpy\SBPIMSvc.exe [4/19/2010 1:47 PM 181584]
S2 MsDtsServer;SQL Server Integration Services;c:\program files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe [5/27/2009 4:26 AM 202584]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S3 AngelUsb;Angel USB MPEG Device;c:\windows\system32\drivers\AngelUsb.sys [1/17/2006 2:11 AM 375424]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [4/25/2009 9:19 AM 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [4/25/2009 9:19 AM 8320]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [4/25/2009 9:19 AM 23680]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [12/2/2006 7:17 AM 2805000]
.
Contents of the 'Scheduled Tasks' folder

2008-02-01 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-02-01 18:22]

2008-02-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-02-01 18:22]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.skysports.com/
uInternet Connection Wizard,ShellNext = hxxp://us.mcafee.com/root/learnmore/learnmore.asp?close=true&lcode;=en-us
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: internet
Trusted Zone: mcafee.com
TCP: {219441F4-A8E1-4AC5-901C-9E62D5B69008} = 8.8.8.8,8.8.4.4
TCP: {C63513FD-6B64-463E-89F0-2B3A7307BAB3} = 8.8.8.8,8.8.4.4
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
HKCU-Run-DellSupport - c:\program files\DellSupport\DSAgnt.exe
HKLM-Run-QuickTime Task - c:\program files\QuickTime\qttask.exe
AddRemove-KB955706_DTS9 - c:\windows\DTS9_KB955706_ENU\Hotfix.exe
AddRemove-KB955706_NS9 - c:\windows\NS9_KB955706_ENU\Hotfix.exe
AddRemove-KB955706_OLAP9 - c:\windows\OLAP9_KB955706_ENU\Hotfix.exe
AddRemove-KB955706_SQL9 - c:\windows\SQL9_KB955706_ENU\Hotfix.exe
AddRemove-KB955706_SQLTools9 - c:\windows\SQLTools9_KB955706_ENU\Hotfix.exe
AddRemove-WebCyberCoach_wtrb - c:\program files\WebCyberCoach\b_Dell\WCC_Wipe.exe WebCyberCoach ext\wtrb



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-29 19:06
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\msftesql]
"ImagePath"="\"c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe\" -s:MSSQL.1 -f:MSSQLSERVER"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1312)
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll

- - - - - - - > 'explorer.exe'(3624)
c:\windows\system32\WININET.dll
c:\program files\Logitech\SetPoint\IMHook.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\nview.dll
c:\program files\McAfee\SiteAdvisor\saHook.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\system32\nvwddi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Microsoft Office\OFFICE11\msohev.dll
.
———————— Other Running Processes ————————
.
c:\program files\Ahead\InCD\InCDsrv.exe
c:\program files\Common Files\Logitech\Bluetooth\LBTSERV.EXE
c:\program files\Intel\Wireless\Bin\ZcfgSvc.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKeeper.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\McAfee\MPF\MPFSrv.exe
c:\progra~1\mcafee.com\agent\mcagent.exe
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe
c:\windows\system32\rundll32.exe
c:\program files\McAfee\MSK\MskSrver.exe
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\windows\system32\rundll32.exe
c:\program files\Apoint\Apntex.exe
c:\program files\Microsoft SQL Server\MSSQL.2\OLAP\bin\msmdsrv.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtKbd.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\SearchIndexer.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
c:\program files\Windows Media Player\WMPNetwk.exe
c:\progra~1\McAfee\VIRUSS~1\mcshield.exe
.
**************************************************************************
.
Completion time: 2010-06-29 19:16:00 - machine was rebooted
ComboFix-quarantined-files.txt 2010-06-30 00:15

Pre-Run: 29,423,943,680 bytes free
Post-Run: 29,646,667,776 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

- - End Of File - - AF18DC69C380745462F10AF42407F05A


Here's the DDS file:

DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 19:34:45.62 on Tue 06/29/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.378 [GMT -5:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Logitech\Bluetooth\LBTSERV.EXE
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Microsoft SQL Server\MSSQL.2\OLAP\bin\msmdsrv.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtKbd.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Sunbelt Software\CounterSpy\SBAMSvc.exe
C:\Program Files\Sunbelt Software\CounterSpy\SBPIMSvc.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
C:\Program Files\Sunbelt Software\CounterSpy\SBAMTray.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Documents and Settings\Lee\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.skysports.com/
uInternet Connection Wizard,ShellNext = hxxp://us.mcafee.com/root/learnmore/learnmore.asp?close=true&lcode;=en-us
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1203.0\msneshellx.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1203.0\msneshellx.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
uRun: [CTSyncU.exe] "c:\program files\creative\sync manager unicode\CTSyncU.exe"
uRun: [P2kAutostart] V510
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /installquiet
mRun: [Apoint] c:\program files\apoint\Apoint.exe
mRun: [IntelWireless] c:\program files\intel\wireless\bin\ifrmewrk.exe /tf Intel PROSet/Wireless
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [NVHotkey] rundll32.exe nvHotkey.dll,Start
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [SBAMTray] "c:\program files\sunbelt software\counterspy\SBAMTray.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\toshiba\bluetooth toshiba stack\TosBtMng.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/3/9/8/398422c0-8d3e-40e1-a617-af65a72a0465/LegitCheckControl.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1207012707890
DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} - hxxp://zone.msn.com/bingame/luxr/default/mjolauncher.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
DPF: {C86FF4B0-AA1D-46D4-8612-025FB86583C7} - hxxp://zone.msn.com/bingame/jobo/default/AstoundLauncher.cab#version=1,0,0,10
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: {219441F4-A8E1-4AC5-901C-9E62D5B69008} = 8.8.8.8,8.8.4.4
TCP: {C63513FD-6B64-463E-89F0-2B3A7307BAB3} = 8.8.8.8,8.8.4.4
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: IntelWireless - c:\program files\intel\wireless\bin\LgNotify.dll
Notify: LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

============= SERVICES / DRIVERS ===============

R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2008-2-1 214664]
R1 sbaphd;sbaphd;c:\windows\system32\drivers\sbaphd.sys [2010-6-27 13400]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2009-10-13 95024]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2008-10-5 206096]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2008-2-1 359952]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2008-2-1 144704]
R2 SBAMSvc;CounterSpy Antispyware;c:\program files\sunbelt software\counterspy\SBAMSvc.exe [2010-4-19 2726000]
R2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [2010-6-27 69720]
R2 SBPIMSvc;SB Recovery Service;c:\program files\sunbelt software\counterspy\SBPIMSvc.exe [2010-4-19 181584]
R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2008-2-1 606736]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2008-2-1 79816]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2008-2-1 35272]
R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2008-2-1 40552]
S2 MsDtsServer;SQL Server Integration Services;c:\program files\microsoft sql server\90\dts\binn\MsDtsSrvr.exe [2009-5-27 202584]
S2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
S3 AngelUsb;Angel USB MPEG Device;c:\windows\system32\drivers\AngelUsb.sys [2006-1-17 375424]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2008-2-1 34248]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2009-4-25 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2009-4-25 8320]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2009-4-25 23680]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe [2006-12-2 2805000]

=============== Created Last 30 ================

2010-06-29 18:34 a-dshr– C:\cmdcons
2010-06-29 18:26 256,512 a——- c:\windows\PEV.exe
2010-06-29 18:26 161,792 a——- c:\windows\SWREG.exe
2010-06-29 18:26 98,816 a——- c:\windows\sed.exe
2010-06-29 18:26 77,312 a——- c:\windows\MBR.exe
2010-06-28 08:46 –d—– c:\windows\pss
2010-06-27 08:44 69,720 a——- c:\windows\system32\drivers\sbapifs.sys
2010-06-27 08:44 13,400 a——- c:\windows\system32\drivers\sbaphd.sys
2010-06-27 08:39 –d—– c:\docume~1\lee\applic~1\Sunbelt
2010-06-27 08:39 –d—– c:\docume~1\alluse~1\applic~1\Sunbelt
2010-06-27 08:38 –d—– c:\program files\Sunbelt Software
2010-06-26 21:15 69,680 a——- c:\windows\system32\PxSecure.dll
2010-06-26 17:26 664 a——- c:\windows\system32\d3d9caps.dat
2010-06-26 17:03 763,832 a——- c:\windows\BDTSupport.dll.old
2010-06-26 17:03 1,652,664 a——- c:\windows\PCTBDCore.dll.old
2010-06-26 16:54 –d—– c:\program files\Spyware Doctor
2010-06-21 12:19 411,368 a——- c:\windows\system32\deployJava1.dll
2010-06-21 12:19 73,728 a——- c:\windows\system32\javacpl.cpl
2010-06-20 21:15 –d—– c:\docume~1\lee\applic~1\Malwarebytes
2010-06-20 21:14 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-20 21:14 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-06-20 21:14 20,952 a——- c:\windows\system32\drivers\mbam.sys
2010-06-20 21:14 –d—– c:\program files\Malwarebytes' Anti-Malware
2010-06-14 11:20 –d-h— c:\windows\PIF
2010-06-11 22:18 –d—– c:\docume~1\alluse~1\applic~1\Alwil Software
2010-06-11 12:57 –d—– c:\program files\Panda Security
2010-06-09 18:46 –d—– c:\windows\system32\wbem\Repository
2010-06-06 13:14 221,568 ——– c:\windows\system32\MpSigStub.exe

==================== Find3M ====================

2010-06-27 09:57 35,021 a——- c:\windows\system32\nvModes.dat
2010-04-19 13:48 27,984 a——- c:\windows\system32\sbbd.exe
2006-04-08 16:03 3,884,032 a–sh— c:\program files\ehthumbs.db
2006-05-26 18:10 56 —shr– c:\windows\system32\82CA6AB925.sys
2006-05-26 18:10 3,818 a–sh— c:\windows\system32\KGyGaAvL.sys
2009-10-14 18:36 245,760 a–sh— c:\windows\system32\config\systemprofile\ietldcache\index.dat
2008-09-05 18:40 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090520080906\index.dat

============= FINISH: 19:37:21.37 ===============


Thanks again for all the help, IndiGenus - it's greatly appreciated.

Attachments:

Post #9
Looking better, and hopefully running better too.

I see you have MalwareBytes' installed. Run a quick scan, making sure to update it first. Post the log if anything is found.

Please go to Kaspersky website and perform an online antivirus scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.

***********************

Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Let me know how it's running too please.
Post #10
No problems so far, and windows is downloading updates, so that appears to be back in order as well. I'm going to let that finish and then I'll get the scans done.
Post #12
The scans have finished. MalwareBytes came up clean (log at the end), but Kaspersky found 1 infected item:

KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, June 30, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Tuesday, June 29, 2010 23:52:57
Records in database: 4266468


Scan settings
scan using the following database extended
Scan archives yes
Scan e-mail databases yes

Scan area My Computer
C:\
D:\
E:\
F:\

Scan statistics
Objects scanned 160424
Threats found 1
Infected objects found 1
Suspicious objects found 0
Scan duration 04:32:50

File name Threat Threats count
C:\Documents and Settings\Lee\Application Data\Sun\Java\Deployment\cache\6.0\11\51bd4ccb-7a21562d Infected: Trojan-Downloader.Java.Agent.cf 1

Selected area has been scanned.


MalwareBytes log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4259

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

6/29/2010 9:49:48 PM
mbam-log-2010-06-29 (21-49-48).txt

Scan type: Quick scan
Objects scanned: 149239
Time elapsed: 20 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
Post #13
And finally here's the securitycheck results:

Results of screen317's Security Check version 0.99.4
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
McAfee Uninstaller
McAfee SecurityCenter
McAfee Virtual Technician
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Java™ 6 Update 20
Adobe Flash Player
Adobe Reader 7.1.0
Out of date Adobe Reader installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
McAfee VIRUSS~1 mcshield.exe
McAfee VIRUSS~1 mcsysmon.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````
Post #14
Looking pretty good. Just need to clear out your Java cache to remove the item Kaspersky found.

http://www.java.com/en/download/help/plugin_cache.xml

Adobe Reader needs updating:

http://www.adobe.com/support/downloads/detail.jsp?ftpID=4607

Uninstall Combofix
  • Click START then RUN
  • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the /U, it needs to be there.
The above procedure will:
  • Delete the following: ComboFix and its associated files and folders.
  • Reset the clock settings.
  • Hide file extensions, if required.
  • Hide System/Hidden files, if required.
  • Reset System Restore.

You can also delete DDS and GMER.

*****************************

In addition to updating and using what you currently have you may want to consider the following:

Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware

Install Winpatrol -
Use Winpatrol to take control of your PC and provide another layer of security.
Help file and tutorial can be found Here

Block unwanted parasites with a custom hosts file -
http://www.mvps.org/winhelp2002/hosts.htm

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly or set your computer to receive automatic updates. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Update all of your Anti-Malware programs regularly - Make sure you update all the programs I have listed and the ones you are currently running regularly. Without regular updates you Will Not be protected when new malicious programs are released.

Keep your applications up to date -
Use Secunia Personal Software Inspector to help stay on top of application updates that could leave your PC vulnerable to attack.

I'll leave the thread open a few days in case you have questions or issues.

Regards,
Dave

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI