This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

PC Running Slow And Freezing

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

I have cleaned up lots of items and have taken all unecessary programs off of the startup list. I ran ATF cleaner and Disk Cleanup. The machine is still slow and still freezes on occasion. Possible Malware?? I have posted a HJT log below for your review.


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:49:23 PM, on 11/17/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18943)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\PLFSetI.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Users\Lisa\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Lisa\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…p;m=aspire_5516
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a…p;m=aspire_5516
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a…p;m=aspire_5516
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - C:\Program Files\AOL Toolbar\aoltb.dll
R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
R3 - URLSearchHook: (no name) - {FF365CDC-88FE-4ffa-A3F3-357855231DFA} - C:\Program Files\puredefmusic\toolbar\2.bin\p3SrcAs.dll
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: ShoppingReport2 - {258C9770-1713-4021-8D7E-1F184A2BD754} - C:\Program Files\ShoppingReport2\Bin\2.7.12\ShoppingReport.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
O2 - BHO: AOL Toolbar Loader - {3ef64538-8b54-4573-b48f-4d34b0238ab2} - C:\Program Files\AOL Toolbar\aoltb.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20100518173336.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: HelloWorldBHO - {ABD3B5E1-B268-407B-A150-2641DAB8D898} - C:\Program Files\Common Files\Homepage Protection\HomepageProtection.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Security Helper {B3312915-9368-4FE4-8D4E-B60E5B36D0FF} - {B3312915-9368-4FE4-8D4E-B60E5B36D0FF} - C:\Program Files\magentictb\auxi\magenticAu.dll (file missing)
O2 - BHO: GamesBarBHO Class - {CB0D163C-E9F4-4236-9496-0597E24B23A5} - C:\Program Files\GamesBar\2.0.1.53\oberontb.dll
O2 - BHO: (no name) - {D5D33A26-F043-4808-B335-6B10630E04F8} - (no file)
O2 - BHO: Toolbar BHO - {E30A55B1-F1B7-43a4-B3F6-EC90CDC4FE60} - C:\Program Files\puredefmusic\toolbar\2.bin\p3bar.dll
O2 - BHO: Search Assistant BHO - {FF365CDB-88FE-4ffa-A3F3-357855231DFA} - C:\Program Files\puredefmusic\toolbar\2.bin\p3SrcAs.dll
O3 - Toolbar: GamesBar - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\2.0.1.53\oberontb.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: PureDef Music Toolbar - {E30A55B9-F1B7-43a4-B3F6-EC90CDC4FE60} - C:\Program Files\puredefmusic\toolbar\2.bin\p3bar.dll
O3 - Toolbar: AOL Toolbar - {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - C:\Program Files\AOL Toolbar\aoltb.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [BackupManagerTray] "C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -k
O4 - HKLM\..\Run: [EgisTecLiveUpdate] "C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe"
O4 - HKLM\..\Run: [mwlDaemon] C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
O4 - HKLM\..\Run: [Acer Product Registration] "C:\Program Files\Acer\Acer Registration\ACE1.exe" /startup
O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/menusearch.jh…mp;n=2010070913
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\2.0.1.53\oberontb.dll
O9 - Extra 'Tools' menuitem: GamesBar - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\2.0.1.53\oberontb.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ShopperReports - Compare product prices - {DB38E21A-0133-419d-92AD-ECDFD5244D6D} - C:\Program Files\ShoppingReport2\Bin\2.7.12\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {EB620C54-E229-4942-87CE-E717109FC8C6} - C:\Program Files\ShoppingReport2\Bin\2.7.12\ShoppingReport.dll
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: BarDiscover Service - Unknown owner - C:\ProgramData\BarDiscover\bardiscover149.exe
O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Personal Firewall Service (McMPFSvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McShield - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: MyWinLocker Service (MWLService) - Egis Technology Inc. - C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe
O23 - Service: NTI IScheduleSvc - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

–
End of file - 10425 bytes
:welcome:

You do have a bit of malware on this computer, Hijackthis is not used much anymore as its outdated, run this program as it will show more of whats going on on your system

  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Under the Standard Registry box change it to All.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
I have pasted the OTL logs that you requested below.

************************************OTL.TXT LOG********************************************


OTL logfile created on: 11/21/2010 8:15:52 AM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\Lisa\Desktop
Windows Vista Home Basic Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18975)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 51.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 73.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222.88 Gb Total Space | 150.95 Gb Free Space | 67.73% Space Free | Partition Type: NTFS

Computer Name: LISA-PC | User Name: Lisa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Lisa\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Lisa\AppData\Local\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\ProgramData\BarDiscover\bardiscover151.exe ()
PRC - C:\Program Files\BarDiscover\bardiscover.exe ()
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe (Egis Technology Inc.)
PRC - C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
PRC - C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
PRC - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
PRC - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated)
PRC - C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (Acer Incorporated)
PRC - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
PRC - C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.)
PRC - C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
PRC - C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (NewTech Infosystems, Inc.)
PRC - C:\Windows\PLFSetI.exe ()
PRC - C:\Program Files\Common Files\aol\acs\AOLacsd.exe (AOL LLC)


========== Modules (SafeList) ==========

MOD - C:\Users\Lisa\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll (Microsoft Corporation)
MOD - c:\Program Files\McAfee\SiteAdvisor\sahook.dll (McAfee, Inc.)
MOD - C:\Program Files\Acer\Acer ePower Management\SysHook.dll (Acer Incorporated)


========== Win32 Services (SafeList) ==========

SRV - (BarDiscover Service) – C:\ProgramData\BarDiscover\bardiscover151.exe ()
SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
SRV - (mfevtp) – C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (WPFFontCache_v0400) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (MSK80Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McProxy) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (MWLService) – C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe ()
SRV - (ePowerSvc) – C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated)
SRV - (CLHNService) – C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
SRV - (NTI IScheduleSvc) – C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.)
SRV - (NTISchedulerSvc) – C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (NewTech Infosystems, Inc.)
SRV - (NTIBackupSvc) – C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)


========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…p;m=aspire_5516
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…p;m=aspire_5516
IE - HKLM\..\URLSearchHook: {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - C:\Program Files\AOL Toolbar\aoltb.dll (AOL Inc.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…p;m=aspire_5516
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://global.acer.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.aol.com/?ncid=toolbar
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
IE - HKCU\..\URLSearchHook: {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - C:\Program Files\AOL Toolbar\aoltb.dll (AOL Inc.)
IE - HKCU\..\URLSearchHook: {FF365CDC-88FE-4ffa-A3F3-357855231DFA} - C:\Program Files\puredefmusic\toolbar\2.bin\p3SrcAs.dll (PureDef Music)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/09/08 11:02:54 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/11/12 22:01:24 | 000,000,000 | —D | M]


O1 HOSTS File: ([2006/09/18 13:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (ShoppingReport2) - {258C9770-1713-4021-8D7E-1F184A2BD754} - C:\Program Files\ShoppingReport2\Bin\2.7.12\ShoppingReport.dll (SmartShopper Networks)
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (AOL Toolbar Loader) - {3ef64538-8b54-4573-b48f-4d34b0238ab2} - C:\Program Files\AOL Toolbar\aoltb.dll (AOL Inc.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20100518173336.dll (McAfee, Inc.)
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (hpBHO Class) - {ABD3B5E1-B268-407B-A150-2641DAB8D898} - C:\Program Files\Common Files\Homepage Protection\HomepageProtection.dll (AOL Products)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Security Helper {B3312915-9368-4FE4-8D4E-B60E5B36D0FF}) - {B3312915-9368-4FE4-8D4E-B60E5B36D0FF} - C:\Program Files\magentictb\auxi\magenticAu.dll File not found
O2 - BHO: (GamesBarBHO Class) - {CB0D163C-E9F4-4236-9496-0597E24B23A5} - C:\Program Files\GamesBar\2.0.1.53\oberontb.dll (Oberon Media Ltd.)
O2 - BHO: (no name) - {D5D33A26-F043-4808-B335-6B10630E04F8} - No CLSID value found.
O2 - BHO: (Toolbar BHO) - {E30A55B1-F1B7-43a4-B3F6-EC90CDC4FE60} - C:\Program Files\puredefmusic\toolbar\2.bin\p3bar.dll (PureDef Music)
O2 - BHO: (Search Assistant BHO) - {FF365CDB-88FE-4ffa-A3F3-357855231DFA} - C:\Program Files\puredefmusic\toolbar\2.bin\p3SrcAs.dll (PureDef Music)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (GamesBar) - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\2.0.1.53\oberontb.dll (Oberon Media Ltd.)
O3 - HKLM\..\Toolbar: (AOL Toolbar) - {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - C:\Program Files\AOL Toolbar\aoltb.dll (AOL Inc.)
O3 - HKLM\..\Toolbar: (PureDef Music Toolbar) - {E30A55B9-F1B7-43a4-B3F6-EC90CDC4FE60} - C:\Program Files\puredefmusic\toolbar\2.bin\p3bar.dll (PureDef Music)
O3 - HKCU\..\Toolbar\WebBrowser: (PureDef Music Toolbar) - {E30A55B9-F1B7-43A4-B3F6-EC90CDC4FE60} - C:\Program Files\puredefmusic\toolbar\2.bin\p3bar.dll (PureDef Music)
O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe ()
O4 - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4 - HKLM..\Run: [Acer Product Registration] C:\Program Files\Acer\Acer Registration\ACE1.exe (Leader Technologies)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [EgisTecLiveUpdate] C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [mwlDaemon] C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : GamesBar - {1A93C934-025B-4c3a-B38E-9654A7003239} - Reg Error: Value error. File not found
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog; This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: ShopperReports - Compare product prices - {DB38E21A-0133-419d-92AD-ECDFD5244D6D} - C:\Program Files\ShoppingReport2\Bin\2.7.12\ShoppingReport.dll (SmartShopper Networks)
O9 - Extra Button: ShopperReports - Compare travel rates - {EB620C54-E229-4942-87CE-E717109FC8C6} - C:\Program Files\ShoppingReport2\Bin\2.7.12\ShoppingReport.dll (SmartShopper Networks)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\nlaapi.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\Windows\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\Windows\System32\sysdm.cpl (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\Windows\System32\browseui.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 13:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{06ea5558-6b3b-11de-a850-00235a9645df}\Shell - "" = AutoRun
O33 - MountPoints2\{06ea5558-6b3b-11de-a850-00235a9645df}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O33 - MountPoints2\{f236c008-9259-11de-b57e-00038a000015}\Shell\AutoRun\command - "" = E:\PortableVault.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/11/21 08:14:32 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Users\Lisa\Desktop\OTL.exe
[2010/11/17 23:47:02 | 002,037,248 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2010/11/17 23:46:36 | 000,954,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc40.dll
[2010/11/17 23:46:36 | 000,954,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc40u.dll
[2010/11/17 23:46:24 | 004,240,384 | —- | C] (Microsoft) – C:\Windows\System32\GameUXLegacyGDFs.dll
[2010/11/17 23:46:24 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Apphlpdm.dll
[2010/11/17 23:45:45 | 008,147,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmploc.DLL
[2010/11/17 23:45:16 | 000,866,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmpmde.dll
[2010/11/17 23:44:42 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netevent.dll
[2010/11/17 23:44:01 | 000,157,184 | —- | C] (Microsoft Corporation) – C:\Windows\System32\t2embed.dll
[2010/11/17 23:43:29 | 000,602,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2010/11/17 23:43:29 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2010/11/17 23:43:29 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2010/11/17 23:43:27 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2010/11/17 23:43:27 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2010/11/17 23:43:26 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2010/11/17 23:43:26 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2010/11/17 23:43:25 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2010/11/17 23:43:25 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2010/11/17 23:43:25 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2010/11/17 23:43:25 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2010/11/17 23:43:25 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2010/11/17 23:43:25 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2010/11/17 23:43:25 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2010/11/17 23:43:25 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2010/11/17 23:43:25 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2010/11/17 23:43:25 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2010/11/17 23:18:18 | 000,000,000 | —D | C] – C:\Users\Lisa\AppData\Local\Acer ePower Management V4
[2010/11/17 23:06:52 | 000,000,000 | —D | C] – C:\Windows\pss
[2010/11/13 03:41:17 | 000,000,000 | —D | C] – C:\Windows\TEMP
[2010/11/13 03:11:48 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msshsq.dll
[2010/11/12 22:26:22 | 000,050,688 | —- | C] (Atribune.org) – C:\Users\Lisa\Desktop\ATF-Cleaner.exe
[2010/11/12 22:21:48 | 000,000,000 | —D | C] – C:\Users\Lisa\AppData\Local\Magentic
[2010/11/12 22:13:54 | 000,000,000 | —D | C] – C:\Users\Lisa\AppData\Roaming\CyberScrub
[2010/11/12 22:07:33 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2010/11/12 22:07:33 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/11/12 22:01:02 | 000,000,000 | —D | C] – C:\Users\Lisa\Desktop\Lisa's Files
[2010/11/12 21:56:29 | 000,000,000 | —D | C] – C:\Users\Lisa\Desktop\miscellaneous icons
[2009/04/18 17:56:57 | 000,049,152 | —- | C] ( ) – C:\Windows\Interop.IWshRuntimeLibrary.dll

========== Files - Modified Within 30 Days ==========

[2010/11/21 08:14:39 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\Lisa\Desktop\OTL.exe
[2010/11/21 08:12:22 | 000,001,699 | —- | M] () – C:\Users\Public\Desktop\McAfee Total Protection.lnk
[2010/11/21 08:11:52 | 000,000,420 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{06853505-F382-4027-835D-D681C0BBD8FE}.job
[2010/11/21 08:07:13 | 000,003,216 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/11/21 08:07:12 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/11/21 08:07:11 | 000,003,216 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/11/18 03:30:58 | 000,604,502 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/11/18 03:30:58 | 000,104,170 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/11/18 03:26:05 | 000,065,536 | —- | M] () – C:\Windows\System32\Ikeext.etl
[2010/11/18 03:25:47 | 000,295,912 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/11/15 01:00:00 | 000,000,340 | —- | M] () – C:\Windows\tasks\McDefragTask.job
[2010/11/13 04:06:41 | 000,000,680 | —- | M] () – C:\Users\Lisa\AppData\Local\d3d9caps.dat
[2010/11/13 03:02:00 | 2143,719,424 | —- | M] () – C:\D08F2468.wip
[2010/11/13 03:01:41 | 618,000,384 | —- | M] () – C:\CA599795.wip
[2010/11/13 03:01:18 | 2002,616,320 | —- | M] () – C:\D67C4998.wip
[2010/11/12 22:38:12 | 1507,266,560 | —- | M] () – C:\F272DAEA.wip
[2010/11/12 22:37:26 | 1875,525,632 | —- | M] () – C:\EDAAA6E1.wip
[2010/11/12 22:36:51 | 1650,712,576 | —- | M] () – C:\DA3A986A.wip
[2010/11/12 22:36:27 | 1529,163,776 | —- | M] () – C:\EDEAF559.wip
[2010/11/12 22:36:10 | 1696,481,280 | —- | M] () – C:\ECBD4B1A.wip
[2010/11/12 22:35:51 | 880,717,824 | —- | M] () – C:\F1DA2B9A.wip
[2010/11/12 22:35:36 | 1167,613,952 | —- | M] () – C:\DEAF50B2.wip
[2010/11/12 22:13:53 | 000,012,288 | —- | M] () – C:\Users\Lisa\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/11/12 22:07:45 | 000,001,019 | —- | M] () – C:\Users\Lisa\Desktop\Spybot - Search & Destroy.lnk

========== Files Created - No Company Name ==========

[2010/11/13 03:01:51 | 2143,719,424 | —- | C] () – C:\D08F2468.wip
[2010/11/13 03:01:38 | 618,000,384 | —- | C] () – C:\CA599795.wip
[2010/11/13 03:00:13 | 2002,616,320 | —- | C] () – C:\D67C4998.wip
[2010/11/12 22:37:41 | 1507,266,560 | —- | C] () – C:\F272DAEA.wip
[2010/11/12 22:36:58 | 1875,525,632 | —- | C] () – C:\EDAAA6E1.wip
[2010/11/12 22:36:39 | 1650,712,576 | —- | C] () – C:\DA3A986A.wip
[2010/11/12 22:36:19 | 1529,163,776 | —- | C] () – C:\EDEAF559.wip
[2010/11/12 22:35:57 | 1696,481,280 | —- | C] () – C:\ECBD4B1A.wip
[2010/11/12 22:35:44 | 880,717,824 | —- | C] () – C:\F1DA2B9A.wip
[2010/11/12 22:35:33 | 1167,613,952 | —- | C] () – C:\DEAF50B2.wip
[2010/11/12 22:07:45 | 000,001,019 | —- | C] () – C:\Users\Lisa\Desktop\Spybot - Search & Destroy.lnk
[2010/11/12 22:06:08 | 000,000,084 | —- | C] () – C:\Windows\csact.ini
[2010/04/01 11:24:01 | 000,000,680 | —- | C] () – C:\Users\Lisa\AppData\Local\d3d9caps.dat
[2009/08/16 16:35:31 | 000,006,078 | —- | C] () – C:\Users\Lisa\AppData\Local\MyWinLockerInstaller.txt-20090816.log
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/07/21 14:40:50 | 000,000,000 | —- | C] () – C:\Users\Lisa\AppData\Roaming\wklnhst.dat
[2009/07/10 11:18:09 | 000,012,288 | —- | C] () – C:\Users\Lisa\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/05/05 22:29:41 | 000,007,057 | —- | C] () – C:\ProgramData\ArcadeDeluxe2.log
[2009/05/05 22:24:09 | 000,626,688 | —- | C] () – C:\Windows\Image.dll
[2009/05/05 22:24:09 | 000,000,036 | —- | C] () – C:\Windows\PidList.ini
[2009/04/18 17:54:36 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/01 23:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini

========== LOP Check ==========

[2009/09/30 12:06:16 | 000,000,000 | -HSD | M] – C:\Users\Lisa\AppData\Roaming\.#
[2009/07/07 13:15:01 | 000,000,000 | —D | M] – C:\Users\Lisa\AppData\Roaming\Acer
[2009/05/05 22:25:33 | 000,000,000 | —D | M] – C:\Users\Lisa\AppData\Roaming\Acer GameZone Console
[2010/11/15 01:31:11 | 000,000,000 | —D | M] – C:\Users\Lisa\AppData\Roaming\CyberScrub
[2009/07/10 10:57:20 | 000,000,000 | —D | M] – C:\Users\Lisa\AppData\Roaming\EA
[2009/08/09 10:15:43 | 000,000,000 | —D | M] – C:\Users\Lisa\AppData\Roaming\eSobi
[2009/07/03 18:52:37 | 000,000,000 | —D | M] – C:\Users\Lisa\AppData\Roaming\Leadertech
[2010/10/15 15:46:20 | 000,000,000 | —D | M] – C:\Users\Lisa\AppData\Roaming\Oberon Media
[2009/07/22 18:35:07 | 000,000,000 | —D | M] – C:\Users\Lisa\AppData\Roaming\PowerCinema
[2009/07/10 16:27:57 | 000,000,000 | —D | M] – C:\Users\Lisa\AppData\Roaming\SoftDMA
[2010/11/15 01:00:00 | 000,000,340 | —- | M] () – C:\Windows\Tasks\McDefragTask.job
[2010/09/01 00:00:00 | 000,000,348 | —- | M] () – C:\Windows\Tasks\McQcTask.job
[2010/11/18 03:22:27 | 000,032,562 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/11/21 08:11:52 | 000,000,420 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{06853505-F382-4027-835D-D681C0BBD8FE}.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 833 bytes -> C:\Users\Lisa\Documents\fraud.eml:OECustomProperty
@Alternate Data Stream - 744 bytes -> C:\Users\Lisa\Documents\Father's Day For Dennis.eml:OECustomProperty
@Alternate Data Stream - 661 bytes -> C:\Users\Lisa\Documents\Nice pics.eml:OECustomProperty
@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:DD160B0D
@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:FCB70953
@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:DCAF903C
@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:390B30B4
@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:9E22BBE8
@Alternate Data Stream - 116 bytes -> C:\ProgramData\Temp:4F636E25
@Alternate Data Stream - 115 bytes -> C:\ProgramData\Temp:B4AF47A7
@Alternate Data Stream - 103 bytes -> C:\ProgramData\Temp:8750DCE4

< End of report >



********************************EXTRAS.TXT LOG******************************************


OTL Extras logfile created on: 11/21/2010 8:15:52 AM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\Lisa\Desktop
Windows Vista Home Basic Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18975)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 51.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 73.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222.88 Gb Total Space | 150.95 Gb Free Space | 67.73% Space Free | Partition Type: NTFS

Computer Name: LISA-PC | User Name: Lisa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = aolfile_HTM] – C:\Program Files\AOL 9.1\aol.exe (AOL, LLC.)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] – c:\progra~1\aol9~1.1\aol.exe (AOL, LLC.)
https [open] – C:\PROGRA~1\AOL9~1.1\aol.exe -z"%1" (AOL, LLC.)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{902A7B59-3F4C-4972-9F51-9F89EA1439D5}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{98EE752E-5BC1-42DD-9D73-619B07850BF4}" = lport=2869 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0E0E5948-6208-410D-89B1-AE4D0920E283}" = protocol=6 | dir=in | app=c:\program files\aol 9.1\waol.exe |
"{25C9E548-1F0B-4CCE-942F-AA588477A967}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{2ACDDBD4-96DF-4CA7-B9E9-6F562F572DFE}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{332194F2-E756-49B5-AC01-1D1F29C20228}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{33676B02-7E54-4CD0-8155-FE6DF60368F2}" = protocol=6 | dir=in | app=c:\program files\common files\aol\1247949791\ee\aolsoftware.exe |
"{3430C894-FCF0-4802-A20E-E1A5D4523CB1}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{378FDFC9-5348-4C81-936A-D0E4E4DE755A}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{3FCA709E-84DE-4DD1-8319-5F374F09BC33}" = dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{4294AB06-6101-4096-A932-EB4418A95F80}" = protocol=17 | dir=in | app=c:\program files\common files\aol\1247949791\ee\aolsoftware.exe |
"{4E51F316-81C8-4FC8-B973-BE6C3DE2EC2A}" = protocol=17 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{505A9F1A-2B84-4F09-B996-C84B9C19A3BC}" = dir=in | app=c:\program files\acer arcade deluxe\acer arcade deluxe\acer arcade deluxe.exe |
"{506E4612-3ED8-4DA2-9842-90633853A812}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{5CAAF9CE-33F5-4DC6-A67B-FEEF8DDA7D5C}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{65DEC087-AC4C-4774-BA90-94BF5711586F}" = dir=in | app=c:\program files\acer arcade deluxe\homemedia\homemedia.exe |
"{75F61178-CDD0-4073-AE53-604ADFCB724E}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{7DC1CDAA-E630-467C-BB6C-3F7680B2EFFD}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{8BB7DBB4-4537-4E29-8302-F9DEDA65A6FC}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\pmvservice.exe |
"{8E1C8E90-74B7-470B-96AA-0BFD66339D97}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe |
"{A7FF7C8B-1848-476B-91A4-A3D64DA4B4A3}" = protocol=6 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{A95BE070-48E9-4723-9E03-C34912348236}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe |
"{BAA793E4-4949-4DD2-886B-BB6150B728A1}" = protocol=17 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{BB4A6039-569A-457D-B582-968A64D36EE9}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{CCE2E51C-167E-4622-92D9-8C5112CB24E7}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\playmovie.exe |
"{CEC1AD5F-CA3E-474C-9518-CA67D3E58C92}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{D4714E2C-D684-4312-891D-9E4D86F8855C}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{D6B9C7AE-1CBB-4C1A-AE50-8EA25F38DDE4}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{DA60BA39-6C27-4EDF-B81F-6877CBC65954}" = protocol=6 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{E773BC6F-4FE0-4F4F-A7EE-96794357A372}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{F9F2BA63-DD15-41CE-93AE-841A4DEE8903}" = protocol=17 | dir=in | app=c:\program files\aol 9.1\waol.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{020D8396-D6D9-4B53-A9A1-83C47E2E27AA}" = Windows Live Call
"{06A8FE5C-D836-FF51-0523-A2A625AAF6F8}" = ccc-core-static
"{08C30E6C-9E7C-19F8-923F-29881AC96968}" = Catalyst Control Center Graphics Light
"{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger
"{0E24362B-2091-79D5-1BF5-B2D6ABF7FB5D}" = CCC Help English
"{1192E4DD-2A20-73BC-64B8-55A0DEB7F7DF}" = Catalyst Control Center Localization Greek
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{1601F21D-245A-6CF1-E463-D531FA5E8DE3}" = Catalyst Control Center Localization Chinese Standard
"{173FF673-515B-F94A-1ED0-9710512095D5}" = Catalyst Control Center Localization Turkish
"{18DB3375-0649-4EA3-959A-44F1ACD278BA}" = IncrediMail
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{2244A1E7-C525-5D5C-064A-18BDF00E9E7D}" = Catalyst Control Center Localization Dutch
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"{26C85DDE-38FA-8D58-5110-19B00F46FABB}" = Catalyst Control Center Localization Thai
"{295C8DC2-953E-3C4C-BA8E-E0B12CB70587}" = ATI Catalyst Install Manager
"{2B463FAA-B1F6-B8DD-74FC-789F1855B26A}" = Catalyst Control Center Localization Chinese Traditional
"{2D87E961-577B-492B-AD54-1368680FB9A7}" = Bing Maps 3D
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver
"{3246B736-3993-EAC8-4349-0B89E278B94F}" = CCC Help French
"{374A2986-A483-94E9-281A-BB6262CF51B6}" = Catalyst Control Center Localization French
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management
"{3E7D43D6-8596-8F83-8A23-BDD2D347DC53}" = Catalyst Control Center Localization Korean
"{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2
"{477461BB-6439-E292-1A63-D2E75A0C988A}" = Catalyst Control Center Localization Danish
"{480C2AF6-928F-8D8F-890B-60F423B24958}" = Catalyst Control Center Graphics Full New
"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update
"{4BB7B60B-5BFE-E9BD-23A5-A59BEAC9CC9A}" = Catalyst Control Center Localization Norwegian
"{5285AB31-5B13-11B0-30AA-8989371C3187}" = CCC Help Czech
"{5B63A470-9334-44D1-AF61-6CE2DB565AE9}" = Orion
"{616185CB-4F3F-B469-E820-F39C18812134}" = Catalyst Control Center Localization German
"{63C1109E-D977-49ED-BCE3-D00D0BF187D6}" = Windows Live Mail
"{67E03279-F703-408F-B4BF-46B5FC8D70CD}" = Microsoft Works
"{68301905-2DEA-41CE-A4D4-E8B443B099BA}" = MyWinLocker
"{6A92E5C5-0578-443D-91F3-92ECE5F2CAE2}" = Windows Live Writer
"{6B958F51-EFCD-B548-A387-D70C91FDD743}" = Catalyst Control Center Localization Finnish
"{6C6C16FB-C009-85C4-1DE0-16A5259E82B2}" = ccc-utility
"{6D5ACB46-C2D4-A72A-9576-D890EB6601F8}" = Catalyst Control Center Localization Hungarian
"{6E434AAA-24B3-8550-5EAB-4D7BF4AC5563}" = Catalyst Control Center InstallProxy
"{6FD64B29-3743-4B9B-2A8E-09058D6D4084}" = CCC Help Swedish
"{71C2828F-2678-4675-BDEC-895424861262}_is1" = C:\Program Files\Acer GameZone\GameConsole
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{72FBCECF-1D9B-80EE-BDA9-6A1AE7BA1B67}" = Catalyst Control Center Localization Russian
"{75AE8014-1184-4BC0-B279-C879540719EE}" = PhotoMail Maker
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{797EE0CA-8165-405C-B5CE-F11EC20F1BB0}" = Microsoft VC9 runtime libraries
"{7EC5E32C-AC18-E228-BBA2-D326D462129D}" = CCC Help Korean
"{7F6DCE52-E736-259E-66EE-993B037A2110}" = CCC Help Hungarian
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110111700}" = Zuma Deluxe
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110184263}" = Puzzle Express
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11037623}" = Tradewinds 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111125700}" = Rainbow Web
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111177437}" = Mahjong Match
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111205743}" = Tri-Peaks Solitaire To Go
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111232687}" = Ocean Express
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111252743}" = Mahjong Escape Ancient China
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}" = Galapago
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11170417}" = Luxor 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111771833}" = Jewel Quest Solitaire
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11219217}" = Cradle of Rome
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112935120}" = Cribbage Quest
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113009953}" = Turbo Pizza
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113056167}" = Dream Day Honeymoon
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113297350}" = Cake Mania 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113494430}" = Wedding Dash
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11505173}" = Airport Mania First Flight
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}" = Dairy Dash
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115443300}" = Cooking Dash
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11551977}" = Parking Dash
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117962123}" = Text Twist 2
"{83C5B0BD-FD82-BC9F-1AB1-97861D0FC285}" = CCC Help German
"{88731AD7-51B3-F878-F485-0D8FCBC55C23}" = Catalyst Control Center Localization Italian
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C63F89D-8F38-26FB-9B38-BCC35EBCDEB6}" = CCC Help Greek
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{955B0760-04FF-90B6-FB9C-689A2DAB5E0F}" = Catalyst Control Center Localization Polish
"{9FB7069F-53BB-CC75-ED87-2D0FC706BE3C}" = Catalyst Control Center Localization Japanese
"{A2351C4F-AB5C-7CE7-B902-A17AE3ABCD75}" = CCC Help Danish
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}" = Acer Crystal Eye Webcam
"{A77B00B0-3D6B-85AB-D0F3-BD54C7327A22}" = CCC Help Japanese
"{AA66BC5E-2D8F-0281-848F-50BBBB9AC0EE}" = CCC Help Finnish
"{AAC6B463-EFFB-1C27-7191-BE816018D61E}" = Skins
"{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9
"{AD3735F6-99ED-07CE-369D-C8CFA60E1B69}" = Catalyst Control Center Localization Spanish
"{AE9A833A-4AFD-28A8-0D34-73CC4A49F7BA}" = Catalyst Control Center Localization Czech
"{B0B7B105-66E1-4C64-770D-6DAE8D7EBCDC}" = Catalyst Control Center Graphics Previews Vista
"{B11F6E12-2EBE-666A-1A46-B844B01E1C17}" = CCC Help Chinese Standard
"{B1E58B81-B607-65B5-6F95-7839E996C7EA}" = Catalyst Control Center Graphics Full Existing
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B547E931-7B8D-A6FA-153D-07BAA8A2362F}" = CCC Help Chinese Traditional
"{BE6BAF22-649B-F0B6-A293-95FD4BBC2AD8}" = CCC Help Spanish
"{BF1E7FE0-CBF1-95DD-7D1B-78B95E7169E5}" = CCC Help Thai
"{C0A1B7C2-8BA5-DF18-04BE-FBC7D51DA52E}" = Catalyst Control Center Localization Swedish
"{C3EB6CE4-02C1-3D6C-35BF-E680A6A2F699}" = CCC Help Dutch
"{CA4EE5B1-5158-87F5-FBD8-2FAB51DBC731}" = CCC Help Italian
"{CCFB344A-638B-4EA6-3561-642F50E21384}" = CCC Help Portuguese
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D9D754A1-EAC5-406C-A28B-C49B1E846711}" = Windows Live Essentials
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{E0248296-8F9F-B422-2E81-88E9A8C5235C}" = CCC Help Russian
"{E1CE24C9-FC4F-D497-A222-A40EA93F4FDA}" = CCC Help Turkish
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E601DDC5-7374-4BAC-5ECA-625459D910C0}" = Catalyst Control Center Core Implementation
"{EC154C5D-3295-F336-4E11-BA91705B1E8A}" = CCC Help Norwegian
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F174496B-5C47-92F1-C074-8369443D2433}" = CCC Help Polish
"{F226C1DA-66D7-4ABC-86B5-3F978A660EBF}" = AOL Mail and AIM Gadget
"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform
"{F73A5B18-EB75-4B2C-B32D-9457576E2417}" = Windows Live Photo Gallery
"{FDD810CA-D5E3-40E9-AB7B-36440B0D41EF}" = Windows Live Sync
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{FF960B70-DEF5-E739-A8FB-65E60509851B}" = Catalyst Control Center Localization Portuguese
"21st Century Cribbage" = 21st Century Cribbage
"Acer Assist" = Acer Assist
"Acer Registration" = Acer Registration
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"AOL Emergency Connect Utility 1.0" = Uninstall AOL Emergency Connect Utility 1.0
"AOL Uninstaller" = AOL Uninstaller (Choose which Products to Remove)
"BarDiscover" = BarDiscover 1.0 build 151
"Carbonite Setup Lite" = Carbonite Online Backup Setup
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"GamesBar" = GamesBar [removed]
"GridVista" = Acer GridVista
"Homepage Protection" = Homepage Protection
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"IncrediMail" = IncrediMail 2.0
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Acer Backup Manager
"LManager" = Launch Manager
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"MSC" = McAfee Total Protection
"PhotoMail" = PhotoMail Maker
"puredefmusictoolbar Uninstall" = PureDef Music Toolbar
"ShoppingReport2" = ShopperReports
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"ViewpointMediaPlayer" = Viewpoint Media Player
"WinLiveSuite_Wave3" = Windows Live Essentials

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11/18/2010 7:04:35 AM | Computer Name = Lisa-PC | Source = Windows Search Service | ID = 3006
Description =

Error - 11/18/2010 7:04:35 AM | Computer Name = Lisa-PC | Source = Windows Search Service | ID = 3007
Description =

Error - 11/18/2010 7:26:18 AM | Computer Name = Lisa-PC | Source = WinMgmt | ID = 10
Description =

Error - 11/18/2010 7:27:48 AM | Computer Name = Lisa-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksCal.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 11/18/2010 7:27:48 AM | Computer Name = Lisa-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksdb.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 11/18/2010 7:27:48 AM | Computer Name = Lisa-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksdb.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 11/18/2010 7:27:49 AM | Computer Name = Lisa-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksss.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 11/18/2010 7:27:49 AM | Computer Name = Lisa-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksss.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 11/18/2010 7:27:49 AM | Computer Name = Lisa-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 11/18/2010 7:27:49 AM | Computer Name = Lisa-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe".
Dependent
Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

[ OSession Events ]
Error - 10/5/2009 12:12:09 PM | Computer Name = Lisa-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 13, Application Name: Microsoft Office OneNote, Application Version:
12.0.6211.1000, Microsoft Office Version: 12.0.6215.1000. This session lasted 4
seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 2/12/2010 5:43:59 PM | Computer Name = Lisa-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 2/14/2010 12:05:22 PM | Computer Name = Lisa-PC | Source = Service Control Manager | ID = 7011
Description =

Error - 2/20/2010 6:29:48 PM | Computer Name = Lisa-PC | Source = Service Control Manager | ID = 7011
Description =

Error - 2/25/2010 5:32:26 PM | Computer Name = Lisa-PC | Source = W32Time | ID = 39452706
Description = The time service has detected that the system time needs to be changed
by -96782 seconds. The time service will not change the system time by more than
-54000 seconds. Verify that your time and time zone are correct, and that the time
source time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->207.46.197.32:123) is working
properly.

Error - 2/25/2010 5:32:40 PM | Computer Name = Lisa-PC | Source = Service Control Manager | ID = 7011
Description =

Error - 2/26/2010 3:23:53 AM | Computer Name = Lisa-PC | Source = Service Control Manager | ID = 7043
Description =

Error - 2/26/2010 3:24:00 AM | Computer Name = Lisa-PC | Source = Service Control Manager | ID = 7011
Description =

Error - 2/26/2010 3:24:02 AM | Computer Name = Lisa-PC | Source = DCOM | ID = 10010
Description =

Error - 2/26/2010 3:27:28 AM | Computer Name = Lisa-PC | Source = HTTP | ID = 15016
Description =

Error - 2/26/2010 3:28:26 AM | Computer Name = Lisa-PC | Source = Service Control Manager | ID = 7000
Description =


< End of report >
Hi,

While I am looking over your OTL log, do this.


Please download Malwarebytes from Here or Here

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the report please




Then run OTL again, this time no need for the extras log and post a new log please so we can see whats left to remove after running Malwarebytes
I did the scan as you instructed. The New logs are pasted below

***********************************************OTL LOG**************************************************************


OTL logfile created on: 11/22/2010 6:39:43 PM - Run 2
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\Lisa\Desktop\OTL
Windows Vista Home Basic Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18975)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 59.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222.88 Gb Total Space | 150.33 Gb Free Space | 67.45% Space Free | Partition Type: NTFS

Computer Name: LISA-PC | User Name: Lisa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Lisa\Desktop\OTL\OTL.exe (OldTimer Tools)
PRC - C:\Users\Lisa\AppData\Local\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe (Egis Technology Inc.)
PRC - C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
PRC - C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
PRC - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
PRC - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated)
PRC - C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (Acer Incorporated)
PRC - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
PRC - C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.)
PRC - C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
PRC - C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (NewTech Infosystems, Inc.)
PRC - C:\Windows\PLFSetI.exe ()
PRC - C:\Program Files\Common Files\aol\acs\AOLacsd.exe (AOL LLC)


========== Modules (SafeList) ==========

MOD - C:\Users\Lisa\Desktop\OTL\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll (Microsoft Corporation)
MOD - c:\Program Files\McAfee\SiteAdvisor\sahook.dll (McAfee, Inc.)
MOD - C:\Program Files\Acer\Acer ePower Management\SysHook.dll (Acer Incorporated)


========== Win32 Services (SafeList) ==========

SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (mfevtp) – C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (WPFFontCache_v0400) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (MSK80Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McProxy) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (MWLService) – C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe ()
SRV - (ePowerSvc) – C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated)
SRV - (CLHNService) – C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
SRV - (NTI IScheduleSvc) – C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.)
SRV - (NTISchedulerSvc) – C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (NewTech Infosystems, Inc.)
SRV - (NTIBackupSvc) – C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)


========== Driver Services (SafeList) ==========

DRV - (NwlnkFwd) – C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) – C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (mfehidk) – C:\Windows\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfefirek) – C:\Windows\System32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfewfpk) – C:\Windows\System32\drivers\mfewfpk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\Windows\System32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\Windows\System32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfenlfk) – C:\Windows\System32\drivers\mfenlfk.sys (McAfee, Inc.)
DRV - (cfwids) – C:\Windows\System32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (MPFP) – C:\Windows\System32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (DKbFltr) – C:\Windows\System32\drivers\DKbFltr.sys (Dritek System Inc.)
DRV - (L1C) – C:\Windows\System32\drivers\L1C60x86.sys (Atheros Communications, Inc.)
DRV - (SynTP) – C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (AtiPcie) ATI PCI Express (3GIO) – C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (ahcix86s) – C:\Windows\system32\DRIVERS\ahcix86s.sys (Advanced Micro Devices, Inc)
DRV - (athr) – C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (mwlPSDVDisk) – C:\Windows\System32\drivers\mwlPSDVDisk.sys (Egis Incorporated.)
DRV - (mwlPSDFilter) – C:\Windows\System32\drivers\mwlPSDFilter.sys (Egis Incorporated.)
DRV - (mwlPSDNServ) – C:\Windows\System32\drivers\mwlPSDNserv.sys (Egis Incorporated.)
DRV - (NTIDrvr) – C:\Windows\System32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (UBHelper) – C:\Windows\System32\drivers\UBHelper.sys (NewTech Infosystems Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (MegaSR) – C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (wanatw) WAN Miniport (ATW) – C:\Windows\System32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (DritekPortIO) – C:\Program Files\Launch Manager\DPortIO.sys (Dritek System Inc.)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)


========== Files/Folders - Created Within 30 Days ==========

[2010/11/22 18:36:31 | 000,000,000 | —D | C] – C:\Users\Lisa\Desktop\Malwarebytes
[2010/11/22 17:44:47 | 000,000,000 | —D | C] – C:\Users\Lisa\AppData\Roaming\Malwarebytes
[2010/11/22 17:44:34 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/11/22 17:44:33 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/11/22 17:44:33 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/11/22 17:44:32 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/11/21 08:41:36 | 000,000,000 | —D | C] – C:\Users\Lisa\Desktop\OTL
[2010/11/17 23:47:02 | 002,037,248 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2010/11/17 23:46:36 | 000,954,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc40.dll
[2010/11/17 23:46:36 | 000,954,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc40u.dll
[2010/11/17 23:46:24 | 004,240,384 | —- | C] (Microsoft) – C:\Windows\System32\GameUXLegacyGDFs.dll
[2010/11/17 23:46:24 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Apphlpdm.dll
[2010/11/17 23:45:45 | 008,147,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmploc.DLL
[2010/11/17 23:45:16 | 000,866,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmpmde.dll
[2010/11/17 23:44:42 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netevent.dll
[2010/11/17 23:44:01 | 000,157,184 | —- | C] (Microsoft Corporation) – C:\Windows\System32\t2embed.dll
[2010/11/17 23:43:29 | 000,602,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2010/11/17 23:43:29 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2010/11/17 23:43:29 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2010/11/17 23:43:27 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2010/11/17 23:43:27 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2010/11/17 23:43:26 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2010/11/17 23:43:26 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2010/11/17 23:43:25 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2010/11/17 23:43:25 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2010/11/17 23:43:25 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2010/11/17 23:43:25 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2010/11/17 23:43:25 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2010/11/17 23:43:25 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2010/11/17 23:43:25 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2010/11/17 23:43:25 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2010/11/17 23:43:25 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2010/11/17 23:43:25 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2010/11/17 23:18:18 | 000,000,000 | —D | C] – C:\Users\Lisa\AppData\Local\Acer ePower Management V4
[2010/11/17 23:06:52 | 000,000,000 | —D | C] – C:\Windows\pss
[2010/11/13 03:41:17 | 000,000,000 | —D | C] – C:\Windows\TEMP
[2010/11/13 03:11:48 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msshsq.dll
[2010/11/12 22:26:22 | 000,050,688 | —- | C] (Atribune.org) – C:\Users\Lisa\Desktop\ATF-Cleaner.exe
[2010/11/12 22:21:48 | 000,000,000 | —D | C] – C:\Users\Lisa\AppData\Local\Magentic
[2010/11/12 22:13:54 | 000,000,000 | —D | C] – C:\Users\Lisa\AppData\Roaming\CyberScrub
[2010/11/12 22:07:33 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2010/11/12 22:07:33 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/11/12 22:01:02 | 000,000,000 | —D | C] – C:\Users\Lisa\Desktop\Lisa's Files
[2010/11/12 21:56:29 | 000,000,000 | —D | C] – C:\Users\Lisa\Desktop\miscellaneous icons
[2009/04/18 17:56:57 | 000,049,152 | —- | C] ( ) – C:\Windows\Interop.IWshRuntimeLibrary.dll

========== Files - Modified Within 30 Days ==========

[2010/11/22 18:37:46 | 000,604,502 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/11/22 18:37:46 | 000,104,170 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/11/22 18:31:52 | 000,001,699 | —- | M] () – C:\Users\Public\Desktop\McAfee Total Protection.lnk
[2010/11/22 18:31:45 | 000,065,536 | —- | M] () – C:\Windows\System32\Ikeext.etl
[2010/11/22 18:31:36 | 000,003,216 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/11/22 18:31:36 | 000,003,216 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/11/22 18:31:23 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/11/22 17:42:35 | 000,000,420 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{06853505-F382-4027-835D-D681C0BBD8FE}.job
[2010/11/18 03:25:47 | 000,295,912 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/11/15 01:00:00 | 000,000,340 | —- | M] () – C:\Windows\tasks\McDefragTask.job
[2010/11/13 04:06:41 | 000,000,680 | —- | M] () – C:\Users\Lisa\AppData\Local\d3d9caps.dat
[2010/11/13 03:02:00 | 2143,719,424 | —- | M] () – C:\D08F2468.wip
[2010/11/13 03:01:41 | 618,000,384 | —- | M] () – C:\CA599795.wip
[2010/11/13 03:01:18 | 2002,616,320 | —- | M] () – C:\D67C4998.wip
[2010/11/12 22:38:12 | 1507,266,560 | —- | M] () – C:\F272DAEA.wip
[2010/11/12 22:37:26 | 1875,525,632 | —- | M] () – C:\EDAAA6E1.wip
[2010/11/12 22:36:51 | 1650,712,576 | —- | M] () – C:\DA3A986A.wip
[2010/11/12 22:36:27 | 1529,163,776 | —- | M] () – C:\EDEAF559.wip
[2010/11/12 22:36:10 | 1696,481,280 | —- | M] () – C:\ECBD4B1A.wip
[2010/11/12 22:35:51 | 880,717,824 | —- | M] () – C:\F1DA2B9A.wip
[2010/11/12 22:35:36 | 1167,613,952 | —- | M] () – C:\DEAF50B2.wip
[2010/11/12 22:13:53 | 000,012,288 | —- | M] () – C:\Users\Lisa\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/11/12 22:07:45 | 000,001,019 | —- | M] () – C:\Users\Lisa\Desktop\Spybot - Search & Destroy.lnk

========== Files Created - No Company Name ==========

[2010/11/13 03:01:51 | 2143,719,424 | —- | C] () – C:\D08F2468.wip
[2010/11/13 03:01:38 | 618,000,384 | —- | C] () – C:\CA599795.wip
[2010/11/13 03:00:13 | 2002,616,320 | —- | C] () – C:\D67C4998.wip
[2010/11/12 22:37:41 | 1507,266,560 | —- | C] () – C:\F272DAEA.wip
[2010/11/12 22:36:58 | 1875,525,632 | —- | C] () – C:\EDAAA6E1.wip
[2010/11/12 22:36:39 | 1650,712,576 | —- | C] () – C:\DA3A986A.wip
[2010/11/12 22:36:19 | 1529,163,776 | —- | C] () – C:\EDEAF559.wip
[2010/11/12 22:35:57 | 1696,481,280 | —- | C] () – C:\ECBD4B1A.wip
[2010/11/12 22:35:44 | 880,717,824 | —- | C] () – C:\F1DA2B9A.wip
[2010/11/12 22:35:33 | 1167,613,952 | —- | C] () – C:\DEAF50B2.wip
[2010/11/12 22:07:45 | 000,001,019 | —- | C] () – C:\Users\Lisa\Desktop\Spybot - Search & Destroy.lnk
[2010/11/12 22:06:08 | 000,000,084 | —- | C] () – C:\Windows\csact.ini
[2010/04/01 11:24:01 | 000,000,680 | —- | C] () – C:\Users\Lisa\AppData\Local\d3d9caps.dat
[2009/08/16 16:35:31 | 000,006,078 | —- | C] () – C:\Users\Lisa\AppData\Local\MyWinLockerInstaller.txt-20090816.log
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/07/21 14:40:50 | 000,000,000 | —- | C] () – C:\Users\Lisa\AppData\Roaming\wklnhst.dat
[2009/07/10 11:18:09 | 000,012,288 | —- | C] () – C:\Users\Lisa\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/05/05 22:29:41 | 000,007,057 | —- | C] () – C:\ProgramData\ArcadeDeluxe2.log
[2009/05/05 22:24:09 | 000,626,688 | —- | C] () – C:\Windows\Image.dll
[2009/05/05 22:24:09 | 000,000,036 | —- | C] () – C:\Windows\PidList.ini
[2009/04/18 17:54:36 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/01 23:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini

========== LOP Check ==========

[2009/09/30 12:06:16 | 000,000,000 | -HSD | M] – C:\Users\Lisa\AppData\Roaming\.#
[2009/07/07 13:15:01 | 000,000,000 | —D | M] – C:\Users\Lisa\AppData\Roaming\Acer
[2009/05/05 22:25:33 | 000,000,000 | —D | M] – C:\Users\Lisa\AppData\Roaming\Acer GameZone Console
[2010/11/15 01:31:11 | 000,000,000 | —D | M] – C:\Users\Lisa\AppData\Roaming\CyberScrub
[2009/07/10 10:57:20 | 000,000,000 | —D | M] – C:\Users\Lisa\AppData\Roaming\EA
[2009/08/09 10:15:43 | 000,000,000 | —D | M] – C:\Users\Lisa\AppData\Roaming\eSobi
[2009/07/03 18:52:37 | 000,000,000 | —D | M] – C:\Users\Lisa\AppData\Roaming\Leadertech
[2010/10/15 15:46:20 | 000,000,000 | —D | M] – C:\Users\Lisa\AppData\Roaming\Oberon Media
[2009/07/22 18:35:07 | 000,000,000 | —D | M] – C:\Users\Lisa\AppData\Roaming\PowerCinema
[2009/07/10 16:27:57 | 000,000,000 | —D | M] – C:\Users\Lisa\AppData\Roaming\SoftDMA
[2010/11/15 01:00:00 | 000,000,340 | —- | M] () – C:\Windows\Tasks\McDefragTask.job
[2010/09/01 00:00:00 | 000,000,348 | —- | M] () – C:\Windows\Tasks\McQcTask.job
[2010/11/22 18:28:49 | 000,032,562 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/11/22 17:42:35 | 000,000,420 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{06853505-F382-4027-835D-D681C0BBD8FE}.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 833 bytes -> C:\Users\Lisa\Documents\fraud.eml:OECustomProperty
@Alternate Data Stream - 744 bytes -> C:\Users\Lisa\Documents\Father's Day For Dennis.eml:OECustomProperty
@Alternate Data Stream - 661 bytes -> C:\Users\Lisa\Documents\Nice pics.eml:OECustomProperty
@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:DD160B0D
@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:FCB70953
@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:DCAF903C
@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:390B30B4
@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:9E22BBE8
@Alternate Data Stream - 116 bytes -> C:\ProgramData\Temp:4F636E25
@Alternate Data Stream - 115 bytes -> C:\ProgramData\Temp:B4AF47A7
@Alternate Data Stream - 103 bytes -> C:\ProgramData\Temp:8750DCE4

< End of report >


************************************************* MBAM LOG *************************************************



Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5166

Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18975

11/22/2010 6:25:10 PM
mbam-log-2010-11-22 (18-25-10).txt

Scan type: Quick scan
Objects scanned: 139005
Time elapsed: 19 minute(s), 14 second(s)

Memory Processes Infected: 2
Memory Modules Infected: 1
Registry Keys Infected: 36
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 6
Files Infected: 8

Memory Processes Infected:
C:\ProgramData\BarDiscover\bardiscover151.exe (Adware.BarDiscover) -> Unloaded process successfully.
C:\Program Files\BarDiscover\bardiscover.exe (Adware.BarDiscover) -> Unloaded process successfully.

Memory Modules Infected:
C:\Program Files\BarDiscover\bardiscover.dll (Adware.Agent.Gen) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\shoppingreport2.hbax (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{f244a744-534d-4a46-855f-c0c7e9f27daa} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{030c9927-10fc-4169-97a2-55becd5d88d8} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{258c9770-1713-4021-8d7e-1f184a2bd754} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{258c9770-1713-4021-8d7e-1f184a2bd754} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{258c9770-1713-4021-8d7e-1f184a2bd754} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{258c9770-1713-4021-8d7e-1f184a2bd754} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3e2dfd6a-4e20-4d4c-aa8b-e1f9dbef3c80} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{714e0876-fcee-49ce-a429-b9ad8aefcb56} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bdea95cf-f0e6-41e0-bd3d-b00f39a4e939} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{bdea95cf-f0e6-41e0-bd3d-b00f39a4e939} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{bdea95cf-f0e6-41e0-bd3d-b00f39a4e939} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{dd15bcc0-5fe9-4690-a957-99fa60ed9d26} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport2.hbax.1 (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport2.hbinfoband (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport2.hbinfoband.1 (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport2.iebutton (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport2.iebutton.1 (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport2.iebuttona (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport2.iebuttona.1 (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport2.rprtctrl (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport2.rprtctrl.1 (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{0eb3f101-224a-4b2b-9e5b-df720857529c} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{a1f1ecd3-4806-44c6-a869-f0dadf11c57c} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{b035ba6b-57cd-4f72-b545-65be465fcaf6} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d44fd6f0-9746-484e-b5c4-c66688393872} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{db38e21a-0133-419d-92ad-ecdfd5244d6d} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{eb620c54-e229-4942-87ce-e717109fc8c6} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{db38e21a-0133-419d-92ad-ecdfd5244d6d} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{eb620c54-e229-4942-87ce-e717109fc8c6} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bardiscover (Adware.BarDiscover) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\ShoppingReport2 (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\BarDiscover (Adware.BarDiscover) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport2 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport2 (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BarDiscover Service (Adware.BarDiscover) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\(default) (Adware.Hotbar) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\ProgramData\BarDiscover (Adware.BarDiscover) -> Quarantined and deleted successfully.
C:\Program Files\BarDiscover (Adware.BarDiscover) -> Delete on reboot.
C:\Program Files\BarDiscover\BarDiscover_deleted_ (Adware.BarDiscover) -> Delete on reboot.
C:\Program Files\ShoppingReport2 (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport2\Bin (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport2\Bin\2.7.12 (Adware.ShoppingReport2) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\BarDiscover\bardiscover.dll (Adware.Agent.Gen) -> Delete on reboot.
C:\Program Files\ShoppingReport2\Bin\2.7.12\ShoppingReport.dll (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
C:\Windows\TEMP\BAR548B.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully.
C:\ProgramData\BarDiscover\bardiscover151.exe (Adware.BarDiscover) -> Quarantined and deleted successfully.
C:\Program Files\BarDiscover\bardiscover.exe (Adware.BarDiscover) -> Quarantined and deleted successfully.
C:\Program Files\BarDiscover\uninstall.exe (Adware.BarDiscover) -> Quarantined and deleted successfully.
C:\Program Files\BarDiscover\BarDiscover_deleted_\bardiscover.dll (Adware.BarDiscover) -> Delete on reboot.
C:\Program Files\BarDiscover\BarDiscover_deleted_\bardiscover.exe (Adware.BarDiscover) -> Quarantined and deleted successfully.
OTL log looks ok and Malwarebytes removed a ton of bad stuff. Let me ask you, are you using some sort of disk wiping program ?



Please run this free online virus scanner from ESET
  • Note: You will need to use Internet explorer for this scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is ticked, and the option Scan unwanted applications is checked
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic


Post the log and let me know how things are running now ?
I use cyberscub. It does a great job of cleaning out the junk that builds up. I pasted the ESET log below. The computer is better but still very slow. C:\Program Files\Acer GameZone\Jewel Quest Solitaire\aJewelQuestSolitaire.exe probably a variant of Win32/Agent.FINBOCH trojan cleaned by deleting - quarantined C:\Program Files\puredefmusic\toolbar\2.bin\p3Plugin.dll a variant of Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined C:\Users\Lisa\Desktop\miscellaneous icons\LimewireSetup.exe Win32/Adware.HotBar application cleaned by deleting - quarantined
Hi,

Lets check for a rootkit

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
  • Double click GMER.exe.
    [external image: Posted Image]
  • If it gives you a warning about rootkit activity and asks if you want to run a full scan…click on NO, then use the following settings for a more complete scan..
  • In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
      [external image: Posted Image]
      Click the image to enlarge it
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
  • Save the log where you can easily find it, such as your desktop.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Please copy and paste the report into your Post.
Here is the GMER Log that you requested.



GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-11-27 05:51:26
Windows 6.0.6001 Service Pack 1 Harddisk0\DR0 -> \Device\00000067 TOSHIBA_ rev.FG00
Running: gmer.exe; Driver: C:\Users\Lisa\AppData\Local\Temp\kgtdapow.sys


—- System - GMER 1.0.15 —-

Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwMapViewOfSection [0x807CB0B8]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwTerminateProcess [0x807CB0E2]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0x807CB0CE]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwYieldExecution [0x807CB0A4]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtMapViewOfSection

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwYieldExecution 8206E1C0 5 Bytes JMP 807CB0A8 \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwTerminateProcess 82229FBC 5 Bytes JMP 807CB0E6 \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtMapViewOfSection 8226B80E 7 Bytes JMP 807CB0BC \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwUnmapViewOfSection 8226BE65 5 Bytes JMP 807CB0D2 \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
? System32\drivers\rhavlldp.sys The system cannot find the path specified. !
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x8B208000, 0x23100A, 0xE8000020]

—- User code sections - GMER 1.0.15 —-

.text C:\Windows\Explorer.EXE[372] ntdll.dll!NtCreateFile 77DA8008 3 Bytes JMP 02DB0000
.text C:\Windows\Explorer.EXE[372] ntdll.dll!NtCreateFile + 4 77DA800C 1 Byte [8B]
.text C:\Windows\Explorer.EXE[372] ntdll.dll!NtCreateProcess 77DA80C8 3 Bytes JMP 02DB0FE5
.text C:\Windows\Explorer.EXE[372] ntdll.dll!NtCreateProcess + 4 77DA80CC 1 Byte [8B]
.text C:\Windows\Explorer.EXE[372] ntdll.dll!NtProtectVirtualMemory 77DA8968 3 Bytes JMP 02DB001B
.text C:\Windows\Explorer.EXE[372] ntdll.dll!NtProtectVirtualMemory + 4 77DA896C 1 Byte [8B]
.text C:\Windows\Explorer.EXE[372] kernel32.dll!GetStartupInfoW 765B1929 5 Bytes JMP 01D70F8D
.text C:\Windows\Explorer.EXE[372] kernel32.dll!GetStartupInfoA 765B19C9 5 Bytes JMP 01D700C9
.text C:\Windows\Explorer.EXE[372] kernel32.dll!CreateProcessW 765B1C01 5 Bytes JMP 01D700F8
.text C:\Windows\Explorer.EXE[372] kernel32.dll!CreateProcessA 765B1C36 5 Bytes JMP 01D70F61
.text C:\Windows\Explorer.EXE[372] kernel32.dll!VirtualProtect 765B1DD1 5 Bytes JMP 01D70078
.text C:\Windows\Explorer.EXE[372] kernel32.dll!CreateNamedPipeW 765B5C44 5 Bytes JMP 01D70FD4
.text C:\Windows\Explorer.EXE[372] kernel32.dll!LoadLibraryExW 765D30C3 5 Bytes JMP 01D70F9E
.text C:\Windows\Explorer.EXE[372] kernel32.dll!LoadLibraryW 765D361F 5 Bytes JMP 01D70FB9
.text C:\Windows\Explorer.EXE[372] kernel32.dll!VirtualProtectEx 765D8D7E 5 Bytes JMP 01D7009D
.text C:\Windows\Explorer.EXE[372] kernel32.dll!LoadLibraryExA 765D9469 5 Bytes JMP 01D7005B
.text C:\Windows\Explorer.EXE[372] kernel32.dll!LoadLibraryA 765D9491 5 Bytes JMP 01D7004A
.text C:\Windows\Explorer.EXE[372] kernel32.dll!CreatePipe 765E0284 5 Bytes JMP 01D700B8
.text C:\Windows\Explorer.EXE[372] kernel32.dll!GetProcAddress 765FB8B6 5 Bytes JMP 01D70F46
.text C:\Windows\Explorer.EXE[372] kernel32.dll!CreateFileW 765FCC4E 5 Bytes JMP 01D7000A
.text C:\Windows\Explorer.EXE[372] kernel32.dll!CreateFileA 765FCF71 5 Bytes JMP 01D70FE5
.text C:\Windows\Explorer.EXE[372] kernel32.dll!CreateNamedPipeA 7664430E 5 Bytes JMP 01D70025
.text C:\Windows\Explorer.EXE[372] kernel32.dll!WinExec 766454FF 5 Bytes JMP 01D70F72
.text C:\Windows\Explorer.EXE[372] ADVAPI32.dll!RegCreateKeyExA 776AB5E7 5 Bytes JMP 03800FC3
.text C:\Windows\Explorer.EXE[372] ADVAPI32.dll!RegCreateKeyA 776AB8AE 5 Bytes JMP 03800040
.text C:\Windows\Explorer.EXE[372] ADVAPI32.dll!RegOpenKeyA 776B0BF5 5 Bytes JMP 03800000
.text C:\Windows\Explorer.EXE[372] ADVAPI32.dll!RegCreateKeyW 776BB83D 5 Bytes JMP 0380005B
.text C:\Windows\Explorer.EXE[372] ADVAPI32.dll!RegCreateKeyExW 776BBCE1 5 Bytes JMP 03800FB2
.text C:\Windows\Explorer.EXE[372] ADVAPI32.dll!RegOpenKeyExA 776BD4E8 5 Bytes JMP 03800FDE
.text C:\Windows\Explorer.EXE[372] ADVAPI32.dll!RegOpenKeyW 776C3CB0 5 Bytes JMP 03800FEF
.text C:\Windows\Explorer.EXE[372] ADVAPI32.dll!RegOpenKeyExW 776CF09D 5 Bytes JMP 03800025
.text C:\Windows\Explorer.EXE[372] msvcrt.dll!_wsystem 77638A47 5 Bytes JMP 037F0FA6
.text C:\Windows\Explorer.EXE[372] msvcrt.dll!system 77638B63 5 Bytes JMP 037F0FC1
.text C:\Windows\Explorer.EXE[372] msvcrt.dll!_creat 7763C6F1 5 Bytes JMP 037F0FD2
.text C:\Windows\Explorer.EXE[372] msvcrt.dll!_open 7763DA7E 5 Bytes JMP 037F000C
.text C:\Windows\Explorer.EXE[372] msvcrt.dll!_wcreat 7763DC9E 5 Bytes JMP 037F0031
.text C:\Windows\Explorer.EXE[372] msvcrt.dll!_wopen 7763DE79 5 Bytes JMP 037F0FE3
.text C:\Windows\Explorer.EXE[372] SHELL32.dll!InitNetworkAddressControl + 2939 76960064 4 Bytes [20, 28, 00, 10] {AND [EAX], CH; ADD [EAX], DL}
.text C:\Windows\Explorer.EXE[372] WS2_32.dll!socket 777F36D1 5 Bytes JMP 03810FEF
.text C:\Windows\Explorer.EXE[372] WININET.dll!InternetOpenA 77EED690 5 Bytes JMP 03830FEF
.text C:\Windows\Explorer.EXE[372] WININET.dll!InternetOpenW 77EEDB09 5 Bytes JMP 03830000
.text C:\Windows\Explorer.EXE[372] WININET.dll!InternetOpenUrlA 77EEF3A4 5 Bytes JMP 03830FCA
.text C:\Windows\Explorer.EXE[372] WININET.dll!InternetOpenUrlW 77F36D5F 5 Bytes JMP 03830FAF
.text C:\Windows\system32\services.exe[744] ntdll.dll!NtCreateFile 77DA8008 5 Bytes JMP 00030000
.text C:\Windows\system32\services.exe[744] ntdll.dll!NtCreateProcess 77DA80C8 5 Bytes JMP 0003001B
.text C:\Windows\system32\services.exe[744] ntdll.dll!NtProtectVirtualMemory 77DA8968 5 Bytes JMP 00030FE5
.text C:\Windows\system32\services.exe[744] kernel32.dll!GetStartupInfoW 765B1929 5 Bytes JMP 00040F48
.text C:\Windows\system32\services.exe[744] kernel32.dll!GetStartupInfoA 765B19C9 5 Bytes JMP 0004008E
.text C:\Windows\system32\services.exe[744] kernel32.dll!CreateProcessW 765B1C01 5 Bytes JMP 000400B3
.text C:\Windows\system32\services.exe[744] kernel32.dll!CreateProcessA 765B1C36 5 Bytes JMP 00040F26
.text C:\Windows\system32\services.exe[744] kernel32.dll!VirtualProtect 765B1DD1 5 Bytes JMP 00040F6D
.text C:\Windows\system32\services.exe[744] kernel32.dll!CreateNamedPipeW 765B5C44 5 Bytes JMP 00040FAF
.text C:\Windows\system32\services.exe[744] kernel32.dll!LoadLibraryExW 765D30C3 5 Bytes JMP 00040047
.text C:\Windows\system32\services.exe[744] kernel32.dll!LoadLibraryW 765D361F 5 Bytes JMP 00040F94
.text C:\Windows\system32\services.exe[744] kernel32.dll!VirtualProtectEx 765D8D7E 5 Bytes JMP 00040062
.text C:\Windows\system32\services.exe[744] kernel32.dll!LoadLibraryExA 765D9469 5 Bytes JMP 00040036
.text C:\Windows\system32\services.exe[744] kernel32.dll!LoadLibraryA 765D9491 5 Bytes JMP 0004001B
.text C:\Windows\system32\services.exe[744] kernel32.dll!CreatePipe 765E0284 5 Bytes JMP 0004007D
.text C:\Windows\system32\services.exe[744] kernel32.dll!GetProcAddress 765FB8B6 5 Bytes JMP 000400CE
.text C:\Windows\system32\services.exe[744] kernel32.dll!CreateFileW 765FCC4E 5 Bytes JMP 00040FD4
.text C:\Windows\system32\services.exe[744] kernel32.dll!CreateFileA 765FCF71 5 Bytes JMP 00040FE5
.text C:\Windows\system32\services.exe[744] kernel32.dll!CreateNamedPipeA 7664430E 5 Bytes JMP 00040000
.text C:\Windows\system32\services.exe[744] kernel32.dll!WinExec 766454FF 5 Bytes JMP 00040F37
.text C:\Windows\system32\services.exe[744] ADVAPI32.dll!RegCreateKeyExA 776AB5E7 5 Bytes JMP 00060040
.text C:\Windows\system32\services.exe[744] ADVAPI32.dll!RegCreateKeyA 776AB8AE 5 Bytes JMP 00060F9E
.text C:\Windows\system32\services.exe[744] ADVAPI32.dll!RegOpenKeyA 776B0BF5 5 Bytes JMP 00060FEF
.text C:\Windows\system32\services.exe[744] ADVAPI32.dll!RegCreateKeyW 776BB83D 5 Bytes JMP 0006002F
.text C:\Windows\system32\services.exe[744] ADVAPI32.dll!RegCreateKeyExW 776BBCE1 5 Bytes JMP 00060051
.text C:\Windows\system32\services.exe[744] ADVAPI32.dll!RegOpenKeyExA 776BD4E8 5 Bytes JMP 00060FCA
.text C:\Windows\system32\services.exe[744] ADVAPI32.dll!RegOpenKeyW 776C3CB0 5 Bytes JMP 00060000
.text C:\Windows\system32\services.exe[744] ADVAPI32.dll!RegOpenKeyExW 776CF09D 5 Bytes JMP 00060FB9
.text C:\Windows\system32\services.exe[744] msvcrt.dll!_wsystem 77638A47 5 Bytes JMP 00050055
.text C:\Windows\system32\services.exe[744] msvcrt.dll!system 77638B63 5 Bytes JMP 00050044
.text C:\Windows\system32\services.exe[744] msvcrt.dll!_creat 7763C6F1 5 Bytes JMP 00050033
.text C:\Windows\system32\services.exe[744] msvcrt.dll!_open 7763DA7E 5 Bytes JMP 00050000
.text C:\Windows\system32\services.exe[744] msvcrt.dll!_wcreat 7763DC9E 5 Bytes JMP 00050FD4
.text C:\Windows\system32\services.exe[744] msvcrt.dll!_wopen 7763DE79 5 Bytes JMP 00050FEF
.text C:\Windows\system32\services.exe[744] WS2_32.dll!socket 777F36D1 5 Bytes JMP 007D0000
.text C:\Windows\system32\lsass.exe[760] ntdll.dll!NtCreateFile 77DA8008 5 Bytes JMP 001C0FEF
.text C:\Windows\system32\lsass.exe[760] ntdll.dll!NtCreateProcess 77DA80C8 5 Bytes JMP 001C0014
.text C:\Windows\system32\lsass.exe[760] ntdll.dll!NtProtectVirtualMemory 77DA8968 5 Bytes JMP 001C0FDE
.text C:\Windows\system32\lsass.exe[760] kernel32.dll!GetStartupInfoW 765B1929 5 Bytes JMP 001D0091
.text C:\Windows\system32\lsass.exe[760] kernel32.dll!GetStartupInfoA 765B19C9 5 Bytes JMP 001D0F55
.text C:\Windows\system32\lsass.exe[760] kernel32.dll!CreateProcessW 765B1C01 5 Bytes JMP 001D00D8
.text C:\Windows\system32\lsass.exe[760] kernel32.dll!CreateProcessA 765B1C36 5 Bytes JMP 001D00BD
.text C:\Windows\system32\lsass.exe[760] kernel32.dll!VirtualProtect 765B1DD1 5 Bytes JMP 001D0F8B
.text C:\Windows\system32\lsass.exe[760] kernel32.dll!CreateNamedPipeW 765B5C44 5 Bytes JMP 001D0FB9
.text C:\Windows\system32\lsass.exe[760] kernel32.dll!LoadLibraryExW 765D30C3 5 Bytes JMP 001D0065
.text C:\Windows\system32\lsass.exe[760] kernel32.dll!LoadLibraryW 765D361F 5 Bytes JMP 001D002F
.text C:\Windows\system32\lsass.exe[760] kernel32.dll!VirtualProtectEx 765D8D7E 5 Bytes JMP 001D0076
.text C:\Windows\system32\lsass.exe[760] kernel32.dll!LoadLibraryExA 765D9469 5 Bytes JMP 001D0054
.text C:\Windows\system32\lsass.exe[760] kernel32.dll!LoadLibraryA 765D9491 5 Bytes JMP 001D0FA8
.text C:\Windows\system32\lsass.exe[760] kernel32.dll!CreatePipe 765E0284 5 Bytes JMP 001D0F66
.text C:\Windows\system32\lsass.exe[760] kernel32.dll!GetProcAddress 765FB8B6 5 Bytes JMP 001D0F30
.text C:\Windows\system32\lsass.exe[760] kernel32.dll!CreateFileW 765FCC4E 5 Bytes JMP 001D0FD4
.text C:\Windows\system32\lsass.exe[760] kernel32.dll!CreateFileA 765FCF71 5 Bytes JMP 001D0FE5
.text C:\Windows\system32\lsass.exe[760] kernel32.dll!CreateNamedPipeA 7664430E 5 Bytes JMP 001D000A
.text C:\Windows\system32\lsass.exe[760] kernel32.dll!WinExec 766454FF 5 Bytes JMP 001D00A2
.text C:\Windows\system32\lsass.exe[760] ADVAPI32.dll!RegCreateKeyExA 776AB5E7 5 Bytes JMP 008B0F9B
.text C:\Windows\system32\lsass.exe[760] ADVAPI32.dll!RegCreateKeyA 776AB8AE 5 Bytes JMP 008B002C
.text C:\Windows\system32\lsass.exe[760] ADVAPI32.dll!RegOpenKeyA 776B0BF5 5 Bytes JMP 008B0FEF
.text C:\Windows\system32\lsass.exe[760] ADVAPI32.dll!RegCreateKeyW 776BB83D 5 Bytes JMP 008B0047
.text C:\Windows\system32\lsass.exe[760] ADVAPI32.dll!RegCreateKeyExW 776BBCE1 5 Bytes JMP 008B0062
.text C:\Windows\system32\lsass.exe[760] ADVAPI32.dll!RegOpenKeyExA 776BD4E8 5 Bytes JMP 008B0FD4
.text C:\Windows\system32\lsass.exe[760] ADVAPI32.dll!RegOpenKeyW 776C3CB0 5 Bytes JMP 008B000A
.text C:\Windows\system32\lsass.exe[760] ADVAPI32.dll!RegOpenKeyExW 776CF09D 5 Bytes JMP 008B001B
.text C:\Windows\system32\lsass.exe[760] msvcrt.dll!_wsystem 77638A47 5 Bytes JMP 001E002C
.text C:\Windows\system32\lsass.exe[760] msvcrt.dll!system 77638B63 5 Bytes JMP 001E001B
.text C:\Windows\system32\lsass.exe[760] msvcrt.dll!_creat 7763C6F1 5 Bytes JMP 001E0FBC
.text C:\Windows\system32\lsass.exe[760] msvcrt.dll!_open 7763DA7E 5 Bytes JMP 001E0FE3
.text C:\Windows\system32\lsass.exe[760] msvcrt.dll!_wcreat 7763DC9E 5 Bytes JMP 001E0FAB
.text C:\Windows\system32\lsass.exe[760] msvcrt.dll!_wopen 7763DE79 5 Bytes JMP 001E0000
.text C:\Windows\system32\lsass.exe[760] WS2_32.dll!socket 777F36D1 5 Bytes JMP 008C000A
.text C:\Windows\system32\svchost.exe[940] ntdll.dll!NtCreateFile 77DA8008 5 Bytes JMP 000F0FEF
.text C:\Windows\system32\svchost.exe[940] ntdll.dll!NtCreateProcess 77DA80C8 5 Bytes JMP 000F0FD4
.text C:\Windows\system32\svchost.exe[940] ntdll.dll!NtProtectVirtualMemory 77DA8968 5 Bytes JMP 000F000A
.text C:\Windows\system32\svchost.exe[940] kernel32.dll!GetStartupInfoW 765B1929 5 Bytes JMP 00100F5E
.text C:\Windows\system32\svchost.exe[940] kernel32.dll!GetStartupInfoA 765B19C9 5 Bytes JMP 00100F6F
.text C:\Windows\system32\svchost.exe[940] kernel32.dll!CreateProcessW 765B1C01 5 Bytes JMP 001000D0
.text C:\Windows\system32\svchost.exe[940] kernel32.dll!CreateProcessA 765B1C36 5 Bytes JMP 001000BF
.text C:\Windows\system32\svchost.exe[940] kernel32.dll!VirtualProtect 765B1DD1 5 Bytes JMP 00100FA8
.text C:\Windows\system32\svchost.exe[940] kernel32.dll!CreateNamedPipeW 765B5C44 5 Bytes JMP 00100FCA
.text C:\Windows\system32\svchost.exe[940] kernel32.dll!LoadLibraryExW 765D30C3 5 Bytes JMP 00100FB9
.text C:\Windows\system32\svchost.exe[940] kernel32.dll!LoadLibraryW 765D361F 5 Bytes JMP 0010005B
.text C:\Windows\system32\svchost.exe[940] kernel32.dll!VirtualProtectEx 765D8D7E 5 Bytes JMP 00100093
.text C:\Windows\system32\svchost.exe[940] kernel32.dll!LoadLibraryExA 765D9469 5 Bytes JMP 00100076
.text C:\Windows\system32\svchost.exe[940] kernel32.dll!LoadLibraryA 765D9491 5 Bytes JMP 00100036
.text C:\Windows\system32\svchost.exe[940] kernel32.dll!CreatePipe 765E0284 5 Bytes JMP 001000A4
.text C:\Windows\system32\svchost.exe[940] kernel32.dll!GetProcAddress 765FB8B6 5 Bytes JMP 00100F14
.text C:\Windows\system32\svchost.exe[940] kernel32.dll!CreateFileW 765FCC4E 5 Bytes JMP 00100FDB
.text C:\Windows\system32\svchost.exe[940] kernel32.dll!CreateFileA 765FCF71 5 Bytes JMP 00100000
.text C:\Windows\system32\svchost.exe[940] kernel32.dll!CreateNamedPipeA 7664430E 5 Bytes JMP 0010001B
.text C:\Windows\system32\svchost.exe[940] kernel32.dll!WinExec 766454FF 5 Bytes JMP 00100F43
.text C:\Windows\system32\svchost.exe[940] msvcrt.dll!_wsystem 77638A47 5 Bytes JMP 00110049
.text C:\Windows\system32\svchost.exe[940] msvcrt.dll!system 77638B63 5 Bytes JMP 00110FBE
.text C:\Windows\system32\svchost.exe[940] msvcrt.dll!_creat 7763C6F1 5 Bytes JMP 0011001D
.text C:\Windows\system32\svchost.exe[940] msvcrt.dll!_open 7763DA7E 5 Bytes JMP 00110FE3
.text C:\Windows\system32\svchost.exe[940] msvcrt.dll!_wcreat 7763DC9E 5 Bytes JMP 00110038
.text C:\Windows\system32\svchost.exe[940] msvcrt.dll!_wopen 7763DE79 5 Bytes JMP 00110000
.text C:\Windows\system32\svchost.exe[940] ADVAPI32.dll!RegCreateKeyExA 776AB5E7 5 Bytes JMP 00120FC7
.text C:\Windows\system32\svchost.exe[940] ADVAPI32.dll!RegCreateKeyA 776AB8AE 5 Bytes JMP 00120058
.text C:\Windows\system32\svchost.exe[940] ADVAPI32.dll!RegOpenKeyA 776B0BF5 5 Bytes JMP 00120000
.text C:\Windows\system32\svchost.exe[940] ADVAPI32.dll!RegCreateKeyW 776BB83D 5 Bytes JMP 00120069
.text C:\Windows\system32\svchost.exe[940] ADVAPI32.dll!RegCreateKeyExW 776BBCE1 5 Bytes JMP 00120FB6
.text C:\Windows\system32\svchost.exe[940] ADVAPI32.dll!RegOpenKeyExA 776BD4E8 5 Bytes JMP 00120036
.text C:\Windows\system32\svchost.exe[940] ADVAPI32.dll!RegOpenKeyW 776C3CB0 5 Bytes JMP 00120011
.text C:\Windows\system32\svchost.exe[940] ADVAPI32.dll!RegOpenKeyExW 776CF09D 5 Bytes JMP 00120047
.text C:\Windows\system32\svchost.exe[940] WS2_32.dll!socket 777F36D1 5 Bytes JMP 00160FEF
.text C:\Windows\system32\svchost.exe[1000] ntdll.dll!NtCreateFile 77DA8008 5 Bytes JMP 003D0FEF
.text C:\Windows\system32\svchost.exe[1000] ntdll.dll!NtCreateProcess 77DA80C8 5 Bytes JMP 003D001B
.text C:\Windows\system32\svchost.exe[1000] ntdll.dll!NtProtectVirtualMemory 77DA8968 5 Bytes JMP 003D000A
.text C:\Windows\system32\svchost.exe[1000] kernel32.dll!GetStartupInfoW 765B1929 5 Bytes JMP 003E0F15
.text C:\Windows\system32\svchost.exe[1000] kernel32.dll!GetStartupInfoA 765B19C9 5 Bytes JMP 003E0F26
.text C:\Windows\system32\svchost.exe[1000] kernel32.dll!CreateProcessW 765B1C01 5 Bytes JMP 003E0EDF
.text C:\Windows\system32\svchost.exe[1000] kernel32.dll!CreateProcessA 765B1C36 5 Bytes JMP 003E0EFA
.text C:\Windows\system32\svchost.exe[1000] kernel32.dll!VirtualProtect 765B1DD1 5 Bytes JMP 003E0F77
.text C:\Windows\system32\svchost.exe[1000] kernel32.dll!CreateNamedPipeW 765B5C44 5 Bytes JMP 003E0FCA
.text C:\Windows\system32\svchost.exe[1000] kernel32.dll!LoadLibraryExW 765D30C3 3 Bytes JMP 003E0F94
.text C:\Windows\system32\svchost.exe[1000] kernel32.dll!LoadLibraryExW + 4 765D30C7 1 Byte [89]
.text C:\Windows\system32\svchost.exe[1000] kernel32.dll!LoadLibraryW 765D361F 5 Bytes JMP 003E0FB9
.text C:\Windows\system32\svchost.exe[1000] kernel32.dll!VirtualProtectEx 765D8D7E 5 Bytes JMP 003E0F5C
.text C:\Windows\system32\svchost.exe[1000] kernel32.dll!LoadLibraryExA 765D9469 5 Bytes JMP 003E0051
.text C:\Windows\system32\svchost.exe[1000] kernel32.dll!LoadLibraryA 765D9491 5 Bytes JMP 003E0040
.text C:\Windows\system32\svchost.exe[1000] kernel32.dll!CreatePipe 765E0284 5 Bytes JMP 003E0F41
.text C:\Windows\system32\svchost.exe[1000] kernel32.dll!GetProcAddress 765FB8B6 5 Bytes JMP 003E0ECE
.text C:\Windows\system32\svchost.exe[1000] kernel32.dll!CreateFileW 765FCC4E 5 Bytes JMP 003E0FEF
.text C:\Windows\system32\svchost.exe[1000] kernel32.dll!CreateFileA 765FCF71 5 Bytes JMP 003E000A
.text C:\Windows\system32\svchost.exe[1000] kernel32.dll!CreateNamedPipeA 7664430E 5 Bytes JMP 003E0025
.text C:\Windows\system32\svchost.exe[1000] kernel32.dll!WinExec 766454FF 5 Bytes JMP 003E0076
.text C:\Windows\system32\svchost.exe[1000] msvcrt.dll!_wsystem 77638A47 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[1000] msvcrt.dll!_wsystem 77638A47 5 Bytes JMP 003F004B
.text C:\Windows\system32\svchost.exe[1000] msvcrt.dll!system 77638B63 5 Bytes JMP 003F003A
.text C:\Windows\system32\svchost.exe[1000] msvcrt.dll!_creat 7763C6F1 5 Bytes JMP 003F0018
.text C:\Windows\system32\svchost.exe[1000] msvcrt.dll!_open 7763DA7E 5 Bytes JMP 003F0FEF
.text C:\Windows\system32\svchost.exe[1000] msvcrt.dll!_wcreat 7763DC9E 5 Bytes JMP 003F0029
.text C:\Windows\system32\svchost.exe[1000] msvcrt.dll!_wopen 7763DE79 5 Bytes JMP 003F0FDE
.text C:\Windows\system32\svchost.exe[1000] ADVAPI32.dll!RegCreateKeyExA 776AB5E7 5 Bytes JMP 0052005F
.text C:\Windows\system32\svchost.exe[1000] ADVAPI32.dll!RegCreateKeyA 776AB8AE 5 Bytes JMP 0052003D
.text C:\Windows\system32\svchost.exe[1000] ADVAPI32.dll!RegOpenKeyA 776B0BF5 5 Bytes JMP 00520000
.text C:\Windows\system32\svchost.exe[1000] ADVAPI32.dll!RegCreateKeyW 776BB83D 5 Bytes JMP 0052004E
.text C:\Windows\system32\svchost.exe[1000] ADVAPI32.dll!RegCreateKeyExW 776BBCE1 5 Bytes JMP 00520FAC
.text C:\Windows\system32\svchost.exe[1000] ADVAPI32.dll!RegOpenKeyExA 776BD4E8 5 Bytes JMP 0052001B
.text C:\Windows\system32\svchost.exe[1000] ADVAPI32.dll!RegOpenKeyW 776C3CB0 5 Bytes JMP 00520FE5
.text C:\Windows\system32\svchost.exe[1000] ADVAPI32.dll!RegOpenKeyExW 776CF09D 5 Bytes JMP 0052002C
.text C:\Windows\system32\svchost.exe[1000] WS2_32.dll!socket 777F36D1 5 Bytes JMP 00530000
.text C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe[1008] kernel32.dll!LoadLibraryW 765D361F 5 Bytes JMP 70C39AE2 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe[1008] kernel32.dll!LoadLibraryA 765D9491 5 Bytes JMP 70C39A20 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\Windows\System32\svchost.exe[1184] ntdll.dll!NtCreateFile 77DA8008 5 Bytes JMP 002B0000
.text C:\Windows\System32\svchost.exe[1184] ntdll.dll!NtCreateProcess 77DA80C8 5 Bytes JMP 002B0040
.text C:\Windows\System32\svchost.exe[1184] ntdll.dll!NtProtectVirtualMemory 77DA8968 5 Bytes JMP 002B001B
.text C:\Windows\System32\svchost.exe[1184] kernel32.dll!GetStartupInfoW 765B1929 5 Bytes JMP 002A00B3
.text C:\Windows\System32\svchost.exe[1184] kernel32.dll!GetStartupInfoA 765B19C9 5 Bytes JMP 002A00A2
.text C:\Windows\System32\svchost.exe[1184] kernel32.dll!CreateProcessW 765B1C01 5 Bytes JMP 002A00FA
.text C:\Windows\System32\svchost.exe[1184] kernel32.dll!CreateProcessA 765B1C36 5 Bytes JMP 002A00E9
.text C:\Windows\System32\svchost.exe[1184] kernel32.dll!VirtualProtect 765B1DD1 5 Bytes JMP 002A0F92
.text C:\Windows\System32\svchost.exe[1184] kernel32.dll!CreateNamedPipeW 765B5C44 5 Bytes JMP 002A0FD4
.text C:\Windows\System32\svchost.exe[1184] kernel32.dll!LoadLibraryExW 765D30C3 5 Bytes JMP 002A0076
.text C:\Windows\System32\svchost.exe[1184] kernel32.dll!LoadLibraryW 765D361F 5 Bytes JMP 002A0FB9
.text C:\Windows\System32\svchost.exe[1184] kernel32.dll!VirtualProtectEx 765D8D7E 5 Bytes JMP 002A0087
.text C:\Windows\System32\svchost.exe[1184] kernel32.dll!LoadLibraryExA 765D9469 5 Bytes JMP 002A0065
.text C:\Windows\System32\svchost.exe[1184] kernel32.dll!LoadLibraryA 765D9491 5 Bytes JMP 002A0036
.text C:\Windows\System32\svchost.exe[1184] kernel32.dll!CreatePipe 765E0284 5 Bytes JMP 002A0F77
.text C:\Windows\System32\svchost.exe[1184] kernel32.dll!GetProcAddress 765FB8B6 5 Bytes JMP 002A0115
.text C:\Windows\System32\svchost.exe[1184] kernel32.dll!CreateFileW 765FCC4E 5 Bytes JMP 002A001B
.text C:\Windows\System32\svchost.exe[1184] kernel32.dll!CreateFileA 765FCF71 5 Bytes JMP 002A000A
.text C:\Windows\System32\svchost.exe[1184] kernel32.dll!CreateNamedPipeA 7664430E 5 Bytes JMP 002A0FEF
.text C:\Windows\System32\svchost.exe[1184] kernel32.dll!WinExec 766454FF 5 Bytes JMP 002A00CE
.text C:\Windows\System32\svchost.exe[1184] msvcrt.dll!_wsystem 77638A47 5 Bytes JMP 0030004E
.text C:\Windows\System32\svchost.exe[1184] msvcrt.dll!system 77638B63 5 Bytes JMP 0030003D
.text C:\Windows\System32\svchost.exe[1184] msvcrt.dll!_creat 7763C6F1 5 Bytes JMP 00300011
.text C:\Windows\System32\svchost.exe[1184] msvcrt.dll!_open 7763DA7E 5 Bytes JMP 00300000
.text C:\Windows\System32\svchost.exe[1184] msvcrt.dll!_wcreat 7763DC9E 5 Bytes JMP 0030002C
.text C:\Windows\System32\svchost.exe[1184] msvcrt.dll!_wopen 7763DE79 5 Bytes JMP 00300FD7
.text C:\Windows\System32\svchost.exe[1184] ADVAPI32.dll!RegCreateKeyExA 776AB5E7 5 Bytes JMP 00320040
.text C:\Windows\System32\svchost.exe[1184] ADVAPI32.dll!RegCreateKeyA 776AB8AE 5 Bytes JMP 00320014
.text C:\Windows\System32\svchost.exe[1184] ADVAPI32.dll!RegOpenKeyA 776B0BF5 5 Bytes JMP 00320FEF
.text C:\Windows\System32\svchost.exe[1184] ADVAPI32.dll!RegCreateKeyW 776BB83D 5 Bytes JMP 0032002F
.text C:\Windows\System32\svchost.exe[1184] ADVAPI32.dll!RegCreateKeyExW 776BBCE1 5 Bytes JMP 00320F8D
.text C:\Windows\System32\svchost.exe[1184] ADVAPI32.dll!RegOpenKeyExA 776BD4E8 5 Bytes JMP 00320FC3
.text C:\Windows\System32\svchost.exe[1184] ADVAPI32.dll!RegOpenKeyW 776C3CB0 5 Bytes JMP 00320FDE
.text C:\Windows\System32\svchost.exe[1184] ADVAPI32.dll!RegOpenKeyExW 776CF09D 5 Bytes JMP 00320FA8
.text C:\Windows\System32\svchost.exe[1184] WS2_32.dll!socket 777F36D1 5 Bytes JMP 00330000
.text C:\Windows\System32\svchost.exe[1212] ntdll.dll!NtCreateFile 77DA8008 5 Bytes JMP 00A20000
.text C:\Windows\System32\svchost.exe[1212] ntdll.dll!NtCreateProcess 77DA80C8 5 Bytes JMP 00A20022
.text C:\Windows\System32\svchost.exe[1212] ntdll.dll!NtProtectVirtualMemory 77DA8968 5 Bytes JMP 00A20011
.text C:\Windows\System32\svchost.exe[1212] kernel32.dll!GetStartupInfoW 765B1929 5 Bytes JMP 009D0073
.text C:\Windows\System32\svchost.exe[1212] kernel32.dll!GetStartupInfoA 765B19C9 5 Bytes JMP 009D0F2D
.text C:\Windows\System32\svchost.exe[1212] kernel32.dll!CreateProcessW 765B1C01 5 Bytes JMP 009D00BA
.text C:\Windows\System32\svchost.exe[1212] kernel32.dll!CreateProcessA 765B1C36 5 Bytes JMP 009D00A9
.text C:\Windows\System32\svchost.exe[1212] kernel32.dll!VirtualProtect 765B1DD1 5 Bytes JMP 009D0F63
.text C:\Windows\System32\svchost.exe[1212] kernel32.dll!CreateNamedPipeW 765B5C44 5 Bytes JMP 009D0FC7
.text C:\Windows\System32\svchost.exe[1212] kernel32.dll!LoadLibraryExW 765D30C3 5 Bytes JMP 009D0F7E
.text C:\Windows\System32\svchost.exe[1212] kernel32.dll!LoadLibraryW 765D361F 5 Bytes JMP 009D003D
.text C:\Windows\System32\svchost.exe[1212] kernel32.dll!VirtualProtectEx 765D8D7E 5 Bytes JMP 009D0F48
.text C:\Windows\System32\svchost.exe[1212] kernel32.dll!LoadLibraryExA 765D9469 5 Bytes JMP 009D0F9B
.text C:\Windows\System32\svchost.exe[1212] kernel32.dll!LoadLibraryA 765D9491 5 Bytes JMP 009D0FB6
.text C:\Windows\System32\svchost.exe[1212] kernel32.dll!CreatePipe 765E0284 5 Bytes JMP 009D0058
.text C:\Windows\System32\svchost.exe[1212] kernel32.dll!GetProcAddress 765FB8B6 5 Bytes JMP 009D0F08
.text C:\Windows\System32\svchost.exe[1212] kernel32.dll!CreateFileW 765FCC4E 5 Bytes JMP 009D0011
.text C:\Windows\System32\svchost.exe[1212] kernel32.dll!CreateFileA 765FCF71 5 Bytes JMP 009D0000
.text C:\Windows\System32\svchost.exe[1212] kernel32.dll!CreateNamedPipeA 7664430E 5 Bytes JMP 009D0022
.text C:\Windows\System32\svchost.exe[1212] kernel32.dll!WinExec 766454FF 5 Bytes JMP 009D0098
.text C:\Windows\System32\svchost.exe[1212] msvcrt.dll!_wsystem 77638A47 5 Bytes JMP 00A70058
.text C:\Windows\System32\svchost.exe[1212] msvcrt.dll!system 77638B63 5 Bytes JMP 00A70047
.text C:\Windows\System32\svchost.exe[1212] msvcrt.dll!_creat 7763C6F1 5 Bytes JMP 00A70011
.text C:\Windows\System32\svchost.exe[1212] msvcrt.dll!_open 7763DA7E 5 Bytes JMP 00A70FEF
.text C:\Windows\System32\svchost.exe[1212] msvcrt.dll!_wcreat 7763DC9E 5 Bytes JMP 00A70036
.text C:\Windows\System32\svchost.exe[1212] msvcrt.dll!_wopen 7763DE79 5 Bytes JMP 00A70000
.text C:\Windows\System32\svchost.exe[1212] ADVAPI32.dll!RegCreateKeyExA 776AB5E7 5 Bytes JMP 00A80036
.text C:\Windows\System32\svchost.exe[1212] ADVAPI32.dll!RegCreateKeyA 776AB8AE 5 Bytes JMP 00A80FB9
.text C:\Windows\System32\svchost.exe[1212] ADVAPI32.dll!RegOpenKeyA 776B0BF5 5 Bytes JMP 00A80FEF
.text C:\Windows\System32\svchost.exe[1212] ADVAPI32.dll!RegCreateKeyW 776BB83D 5 Bytes JMP 00A80F9E
.text C:\Windows\System32\svchost.exe[1212] ADVAPI32.dll!RegCreateKeyExW 776BBCE1 5 Bytes JMP 00A80051
.text C:\Windows\System32\svchost.exe[1212] ADVAPI32.dll!RegOpenKeyExA 776BD4E8 5 Bytes JMP 00A8001B
.text C:\Windows\System32\svchost.exe[1212] ADVAPI32.dll!RegOpenKeyW 776C3CB0 5 Bytes JMP 00A8000A
.text C:\Windows\System32\svchost.exe[1212] ADVAPI32.dll!RegOpenKeyExW 776CF09D 5 Bytes JMP 00A80FCA
.text C:\Windows\System32\svchost.exe[1212] WS2_32.dll!socket 777F36D1 5 Bytes JMP 00F30FEF
.text C:\Windows\system32\svchost.exe[1228] ntdll.dll!NtCreateFile 77DA8008 5 Bytes JMP 00AB0FEF
.text C:\Windows\system32\svchost.exe[1228] ntdll.dll!NtCreateProcess 77DA80C8 5 Bytes JMP 00AB0014
.text C:\Windows\system32\svchost.exe[1228] ntdll.dll!NtProtectVirtualMemory 77DA8968 5 Bytes JMP 00AB0FDE
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!GetStartupInfoW 765B1929 5 Bytes JMP 00AA0F65
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!GetStartupInfoA 765B19C9 5 Bytes JMP 00AA0F76
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!CreateProcessW 765B1C01 5 Bytes JMP 00AA00F5
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!CreateProcessA 765B1C36 5 Bytes JMP 00AA00D0
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!VirtualProtect 765B1DD1 5 Bytes JMP 00AA0075
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!CreateNamedPipeW 765B5C44 5 Bytes JMP 00AA000A
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!LoadLibraryExW 765D30C3 5 Bytes JMP 00AA0064
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!LoadLibraryW 765D361F 5 Bytes JMP 00AA002C
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!VirtualProtectEx 765D8D7E 5 Bytes JMP 00AA0090
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!LoadLibraryExA 765D9469 5 Bytes JMP 00AA003D
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!LoadLibraryA 765D9491 5 Bytes JMP 00AA001B
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!CreatePipe 765E0284 5 Bytes JMP 00AA00A1
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!GetProcAddress 765FB8B6 5 Bytes JMP 00AA0106
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!CreateFileW 765FCC4E 5 Bytes JMP 00AA0FD4
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!CreateFileA 765FCF71 5 Bytes JMP 00AA0FEF
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!CreateNamedPipeA 7664430E 5 Bytes JMP 00AA0FB9
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!WinExec 766454FF 5 Bytes JMP 00AA0F54
.text C:\Windows\system32\svchost.exe[1228] msvcrt.dll!_wsystem 77638A47 5 Bytes JMP 00E90031
.text C:\Windows\system32\svchost.exe[1228] msvcrt.dll!system 77638B63 5 Bytes JMP 00E90FA6
.text C:\Windows\system32\svchost.exe[1228] msvcrt.dll!_creat 7763C6F1 5 Bytes JMP 00E90FD2
.text C:\Windows\system32\svchost.exe[1228] msvcrt.dll!_open 7763DA7E 5 Bytes JMP 00E90FEF
.text C:\Windows\system32\svchost.exe[1228] msvcrt.dll!_wcreat 7763DC9E 5 Bytes JMP 00E90FC1
.text C:\Windows\system32\svchost.exe[1228] msvcrt.dll!_wopen 7763DE79 5 Bytes JMP 00E9000C
.text C:\Windows\system32\svchost.exe[1228] ADVAPI32.dll!RegCreateKeyExA 776AB5E7 5 Bytes JMP 00F20FB9
.text C:\Windows\system32\svchost.exe[1228] ADVAPI32.dll!RegCreateKeyA 776AB8AE 5 Bytes JMP 00F20040
.text C:\Windows\system32\svchost.exe[1228] ADVAPI32.dll!RegOpenKeyA 776B0BF5 5 Bytes JMP 00F20FE5
.text C:\Windows\system32\svchost.exe[1228] ADVAPI32.dll!RegCreateKeyW 776BB83D 5 Bytes JMP 00F2005B
.text C:\Windows\system32\svchost.exe[1228] ADVAPI32.dll!RegCreateKeyExW 776BBCE1 5 Bytes JMP 00F20076
.text C:\Windows\system32\svchost.exe[1228] ADVAPI32.dll!RegOpenKeyExA 776BD4E8 5 Bytes JMP 00F20014
.text C:\Windows\system32\svchost.exe[1228] ADVAPI32.dll!RegOpenKeyW 776C3CB0 5 Bytes JMP 00F20FD4
.text C:\Windows\system32\svchost.exe[1228] ADVAPI32.dll!RegOpenKeyExW 776CF09D 5 Bytes JMP 00F20025
.text C:\Windows\system32\svchost.exe[1228] WS2_32.dll!socket 777F36D1 5 Bytes JMP 00F30FEF
.text C:\Windows\system32\svchost.exe[1228] WININET.dll!InternetOpenA 77EED690 5 Bytes JMP 01F4000A
.text C:\Windows\system32\svchost.exe[1228] WININET.dll!InternetOpenW 77EEDB09 5 Bytes JMP 01F4001B
.text C:\Windows\system32\svchost.exe[1228] WININET.dll!InternetOpenUrlA 77EEF3A4 5 Bytes JMP 01F4002C
.text C:\Windows\system32\svchost.exe[1228] WININET.dll!InternetOpenUrlW 77F36D5F 5 Bytes JMP 01F40FDB
.text C:\Windows\system32\svchost.exe[1328] ntdll.dll!NtCreateFile 77DA8008 5 Bytes JMP 0042000A
.text C:\Windows\system32\svchost.exe[1328] ntdll.dll!NtCreateProcess 77DA80C8 5 Bytes JMP 00420036
.text C:\Windows\system32\svchost.exe[1328] ntdll.dll!NtProtectVirtualMemory 77DA8968 5 Bytes JMP 0042001B
.text C:\Windows\system32\svchost.exe[1328] kernel32.dll!GetStartupInfoW 765B1929 5 Bytes JMP 004100A5
.text C:\Windows\system32\svchost.exe[1328] kernel32.dll!GetStartupInfoA 765B19C9 5 Bytes JMP 00410F5F
.text C:\Windows\system32\svchost.exe[1328] kernel32.dll!CreateProcessW 765B1C01 5 Bytes JMP 00410F33
.text C:\Windows\system32\svchost.exe[1328] kernel32.dll!CreateProcessA 765B1C36 5 Bytes JMP 004100C0
.text C:\Windows\system32\svchost.exe[1328] kernel32.dll!VirtualProtect 765B1DD1 5 Bytes JMP 00410F8B
.text C:\Windows\system32\svchost.exe[1328] kernel32.dll!CreateNamedPipeW 765B5C44 5 Bytes JMP 0041002F
.text C:\Windows\system32\svchost.exe[1328] kernel32.dll!LoadLibraryExW 765D30C3 5 Bytes JMP 00410FA8
.text C:\Windows\system32\svchost.exe[1328] kernel32.dll!LoadLibraryW 765D361F 5 Bytes JMP 0041004A
.text C:\Windows\system32\svchost.exe[1328] kernel32.dll!VirtualProtectEx 765D8D7E 5 Bytes JMP 00410F7A
.text C:\Windows\system32\svchost.exe[1328] kernel32.dll!LoadLibraryExA 765D9469 5 Bytes JMP 00410065
.text C:\Windows\system32\svchost.exe[1328] kernel32.dll!LoadLibraryA 765D9491 5 Bytes JMP 00410FC3
.text C:\Windows\system32\svchost.exe[1328] kernel32.dll!CreatePipe 765E0284 5 Bytes JMP 0041008A
.text C:\Windows\system32\svchost.exe[1328] kernel32.dll!GetProcAddress 765FB8B6 5 Bytes JMP 00410F22
.text C:\Windows\system32\svchost.exe[1328] kernel32.dll!CreateFileW 765FCC4E 5 Bytes JMP 00410FEF
.text C:\Windows\system32\svchost.exe[1328] kernel32.dll!CreateFileA 765FCF71 5 Bytes JMP 0041000A
.text C:\Windows\system32\svchost.exe[1328] kernel32.dll!CreateNamedPipeA 7664430E 5 Bytes JMP 00410FDE
.text C:\Windows\system32\svchost.exe[1328] kernel32.dll!WinExec 766454FF 5 Bytes JMP 00410F4E
.text C:\Windows\system32\svchost.exe[1328] msvcrt.dll!_wsystem 77638A47 5 Bytes JMP 00430053
.text C:\Windows\system32\svchost.exe[1328] msvcrt.dll!system 77638B63 5 Bytes JMP 00430042
.text C:\Windows\system32\svchost.exe[1328] msvcrt.dll!_creat 7763C6F1 5 Bytes JMP 0043001D
.text C:\Windows\system32\svchost.exe[1328] msvcrt.dll!_open 7763DA7E 5 Bytes JMP 00430FEF
.text C:\Windows\system32\svchost.exe[1328] msvcrt.dll!_wcreat 7763DC9E 5 Bytes JMP 00430FD2
.text C:\Windows\system32\svchost.exe[1328] msvcrt.dll!_wopen 7763DE79 5 Bytes JMP 0043000C
.text C:\Windows\system32\svchost.exe[1328] ADVAPI32.dll!RegCreateKeyExA 776AB5E7 5 Bytes JMP 00440040
.text C:\Windows\system32\svchost.exe[1328] ADVAPI32.dll!RegCreateKeyA 776AB8AE 5 Bytes JMP 00440FB9
.text C:\Windows\system32\svchost.exe[1328] ADVAPI32.dll!RegOpenKeyA 776B0BF5 5 Bytes JMP 00440000
.text C:\Windows\system32\svchost.exe[1328] ADVAPI32.dll!RegCreateKeyW 776BB83D 5 Bytes JMP 00440F9E
.text C:\Windows\system32\svchost.exe[1328] ADVAPI32.dll!RegCreateKeyExW 776BBCE1 5 Bytes JMP 0044005B
.text C:\Windows\system32\svchost.exe[1328] ADVAPI32.dll!RegOpenKeyExA 776BD4E8 5 Bytes JMP 00440FDB
.text C:\Windows\system32\svchost.exe[1328] ADVAPI32.dll!RegOpenKeyW 776C3CB0 5 Bytes JMP 0044001B
.text C:\Windows\system32\svchost.exe[1328] ADVAPI32.dll!RegOpenKeyExW 776CF09D 5 Bytes JMP 00440FCA
.text C:\Windows\system32\svchost.exe[1328] WS2_32.dll!socket 777F36D1 5 Bytes JMP 00490FEF
.text C:\Windows\system32\svchost.exe[1384] ntdll.dll!NtCreateFile 77DA8008 5 Bytes JMP 01400000
.text C:\Windows\system32\svchost.exe[1384] ntdll.dll!NtCreateProcess 77DA80C8 5 Bytes JMP 01400FCA
.text C:\Windows\system32\svchost.exe[1384] ntdll.dll!NtProtectVirtualMemory 77DA8968 5 Bytes JMP 01400FEF
.text C:\Windows\system32\svchost.exe[1384] kernel32.dll!GetStartupInfoW 765B1929 5 Bytes JMP 00080F32
.text C:\Windows\system32\svchost.exe[1384] kernel32.dll!GetStartupInfoA 765B19C9 5 Bytes JMP 00080082
.text C:\Windows\system32\svchost.exe[1384] kernel32.dll!CreateProcessW 765B1C01 5 Bytes JMP 000800B8
.text C:\Windows\system32\svchost.exe[1384] kernel32.dll!CreateProcessA 765B1C36 5 Bytes JMP 00080F21
.text C:\Windows\system32\svchost.exe[1384] kernel32.dll!VirtualProtect 765B1DD1 5 Bytes JMP 00080F61
.text C:\Windows\system32\svchost.exe[1384] kernel32.dll!CreateNamedPipeW 765B5C44 5 Bytes JMP 00080FC3
.text C:\Windows\system32\svchost.exe[1384] kernel32.dll!LoadLibraryExW 765D30C3 5 Bytes JMP 00080F72
.text C:\Windows\system32\svchost.exe[1384] kernel32.dll!LoadLibraryW 765D361F 5 Bytes JMP 00080F9E
.text C:\Windows\system32\svchost.exe[1384] kernel32.dll!VirtualProtectEx 765D8D7E 5 Bytes JMP 00080060
.text C:\Windows\system32\svchost.exe[1384] kernel32.dll!LoadLibraryExA 765D9469 5 Bytes JMP 00080F83
.text C:\Windows\system32\svchost.exe[1384] kernel32.dll!LoadLibraryA 765D9491 5 Bytes JMP 00080025
.text C:\Windows\system32\svchost.exe[1384] kernel32.dll!CreatePipe 765E0284 5 Bytes JMP 00080071
.text C:\Windows\system32\svchost.exe[1384] kernel32.dll!GetProcAddress 765FB8B6 5 Bytes JMP 000800C9
.text C:\Windows\system32\svchost.exe[1384] kernel32.dll!CreateFileW 765FCC4E 5 Bytes JMP 00080FEF
.text C:\Windows\system32\svchost.exe[1384] kernel32.dll!CreateFileA 765FCF71 5 Bytes JMP 0008000A
.text C:\Windows\system32\svchost.exe[1384] kernel32.dll!CreateNamedPipeA 7664430E 5 Bytes JMP 00080FD4
.text C:\Windows\system32\svchost.exe[1384] kernel32.dll!WinExec 766454FF 5 Bytes JMP 00080093
.text C:\Windows\system32\svchost.exe[1384] msvcrt.dll!_wsystem 77638A47 5 Bytes JMP 01450047
.text C:\Windows\system32\svchost.exe[1384] msvcrt.dll!system 77638B63 5 Bytes JMP 01450FBC
.text C:\Windows\system32\svchost.exe[1384] msvcrt.dll!_creat 7763C6F1 5 Bytes JMP 01450FDE
.text C:\Windows\system32\svchost.exe[1384] msvcrt.dll!_open 7763DA7E 5 Bytes JMP 01450FEF
.text C:\Windows\system32\svchost.exe[1384] msvcrt.dll!_wcreat 7763DC9E 5 Bytes JMP 01450FCD
.text C:\Windows\system32\svchost.exe[1384] msvcrt.dll!_wopen 7763DE79 5 Bytes JMP 0145000C
.text C:\Windows\system32\svchost.exe[1384] ADVAPI32.dll!RegCreateKeyExA 776AB5E7 5 Bytes JMP 014A0F61
.text C:\Windows\system32\svchost.exe[1384] ADVAPI32.dll!RegCreateKeyA 776AB8AE 5 Bytes JMP 014A0F8D
.text C:\Windows\system32\svchost.exe[1384] ADVAPI32.dll!RegOpenKeyA 776B0BF5 5 Bytes JMP 014A0FE5
.text C:\Windows\system32\svchost.exe[1384] ADVAPI32.dll!RegCreateKeyW 776BB83D 5 Bytes JMP 014A0F72
.text C:\Windows\system32\svchost.exe[1384] ADVAPI32.dll!RegCreateKeyExW 776BBCE1 5 Bytes JMP 014A0F50
.text C:\Windows\system32\svchost.exe[1384] ADVAPI32.dll!RegOpenKeyExA 776BD4E8 5 Bytes JMP 014A0FB9
.text C:\Windows\system32\svchost.exe[1384] ADVAPI32.dll!RegOpenKeyW 776C3CB0 5 Bytes JMP 014A0FCA
.text C:\Windows\system32\svchost.exe[1384] ADVAPI32.dll!RegOpenKeyExW 776CF09D 5 Bytes JMP 014A0FA8
.text C:\Windows\system32\svchost.exe[1384] WS2_32.dll!socket 777F36D1 5 Bytes JMP 01570FEF
.text C:\Windows\system32\svchost.exe[1384] WinInet.dll!InternetOpenA 77EED690 5 Bytes JMP 0160000A
.text C:\Windows\system32\svchost.exe[1384] WinInet.dll!InternetOpenW 77EEDB09 5 Bytes JMP 01600025
.text C:\Windows\system32\svchost.exe[1384] WinInet.dll!InternetOpenUrlA 77EEF3A4 5 Bytes JMP 01600036
.text C:\Windows\system32\svchost.exe[1384] WinInet.dll!InternetOpenUrlW 77F36D5F 5 Bytes JMP 01600FEF
.text C:\Windows\system32\svchost.exe[1492] ntdll.dll!NtCreateFile 77DA8008 5 Bytes JMP 00D10FE5
.text C:\Windows\system32\svchost.exe[1492] ntdll.dll!NtCreateProcess 77DA80C8 5 Bytes JMP 00D1000A
.text C:\Windows\system32\svchost.exe[1492] ntdll.dll!NtProtectVirtualMemory 77DA8968 5 Bytes JMP 00D10FD4
.text C:\Windows\system32\svchost.exe[1492] kernel32.dll!GetStartupInfoW 765B1929 5 Bytes JMP 00D00F15
.text C:\Windows\system32\svchost.exe[1492] kernel32.dll!GetStartupInfoA 765B19C9 5 Bytes JMP 00D00F26
.text C:\Windows\system32\svchost.exe[1492] kernel32.dll!CreateProcessW 765B1C01 5 Bytes JMP 00D0008A
.text C:\Windows\system32\svchost.exe[1492] kernel32.dll!CreateProcessA 765B1C36 5 Bytes JMP 00D00EE9
.text C:\Windows\system32\svchost.exe[1492] kernel32.dll!VirtualProtect 765B1DD1 5 Bytes JMP 00D0003D
.text C:\Windows\system32\svchost.exe[1492] kernel32.dll!CreateNamedPipeW 765B5C44 5 Bytes JMP 00D00FB9
.text C:\Windows\system32\svchost.exe[1492] kernel32.dll!LoadLibraryExW 765D30C3 5 Bytes JMP 00D0002C
.text C:\Windows\system32\svchost.exe[1492] kernel32.dll!LoadLibraryW 765D361F 5 Bytes JMP 00D00F8A
.text C:\Windows\system32\svchost.exe[1492] kernel32.dll!VirtualProtectEx 765D8D7E 5 Bytes JMP 00D00F52
.text C:\Windows\system32\svchost.exe[1492] kernel32.dll!LoadLibraryExA 765D9469 5 Bytes JMP 00D00F6F
.text C:\Windows\system32\svchost.exe[1492] kernel32.dll!LoadLibraryA 765D9491 5 Bytes JMP 00D0001B
.text C:\Windows\system32\svchost.exe[1492] kernel32.dll!CreatePipe 765E0284 5 Bytes JMP 00D00F41
.text C:\Windows\system32\svchost.exe[1492] kernel32.dll!GetProcAddress 765FB8B6 5 Bytes JMP 00D00ECE
.text C:\Windows\system32\svchost.exe[1492] kernel32.dll!CreateFileW 765FCC4E 5 Bytes JMP 00D00000
.text C:\Windows\system32\svchost.exe[1492] kernel32.dll!CreateFileA 765FCF71 5 Bytes JMP 00D00FEF
.text C:\Windows\system32\svchost.exe[1492] kernel32.dll!CreateNamedPipeA 7664430E 5 Bytes JMP 00D00FCA
.text C:\Windows\system32\svchost.exe[1492] kernel32.dll!WinExec 766454FF 5 Bytes JMP 00D00EFA
.text C:\Windows\system32\svchost.exe[1492] msvcrt.dll!_wsystem 77638A47 5 Bytes JMP 00D20FC8
.text C:\Windows\system32\svchost.exe[1492] msvcrt.dll!system 77638B63 5 Bytes JMP 00D2005D
.text C:\Windows\system32\svchost.exe[1492] msvcrt.dll!_creat 7763C6F1 5 Bytes JMP 00D2001D
.text C:\Windows\system32\svchost.exe[1492] msvcrt.dll!_open 7763DA7E 5 Bytes JMP 00D2000C
.text C:\Windows\system32\svchost.exe[1492] msvcrt.dll!_wcreat 7763DC9E 5 Bytes JMP 00D20042
.text C:\Windows\system32\svchost.exe[1492] msvcrt.dll!_wopen 7763DE79 5 Bytes JMP 00D20FE3
.text C:\Windows\system32\svchost.exe[1492] ADVAPI32.dll!RegCreateKeyExA 776AB5E7 5 Bytes JMP 00D3006C
.text C:\Windows\system32\svchost.exe[1492] ADVAPI32.dll!RegCreateKeyA 776AB8AE 5 Bytes JMP 00D3004A
.text C:\Windows\system32\svchost.exe[1492] ADVAPI32.dll!RegOpenKeyA 776B0BF5 5 Bytes JMP 00D30000
.text C:\Windows\system32\svchost.exe[1492] ADVAPI32.dll!RegCreateKeyW 776BB83D 5 Bytes JMP 00D3005B
.text C:\Windows\system32\svchost.exe[1492] ADVAPI32.dll!RegCreateKeyExW 776BBCE1 5 Bytes JMP 00D3007D
.text C:\Windows\system32\svchost.exe[1492] ADVAPI32.dll!RegOpenKeyExA 776BD4E8 5 Bytes JMP 00D30FD4
.text C:\Windows\system32\svchost.exe[1492] ADVAPI32.dll!RegOpenKeyW 776C3CB0 5 Bytes JMP 00D30FE5
.text C:\Windows\system32\svchost.exe[1492] ADVAPI32.dll!RegOpenKeyExW 776CF09D 5 Bytes JMP 00D30025
.text C:\Windows\system32\svchost.exe[1492] WS2_32.dll!socket 777F36D1 5 Bytes JMP 010D0FEF
.text C:\Windows\system32\svchost.exe[2016] ntdll.dll!NtCreateFile 77DA8008 5 Bytes JMP 00350000
.text C:\Windows\system32\svchost.exe[2016] ntdll.dll!NtCreateProcess 77DA80C8 5 Bytes JMP 00350FD4
.text C:\Windows\system32\svchost.exe[2016] ntdll.dll!NtProtectVirtualMemory 77DA8968 5 Bytes JMP 00350FE5
.text C:\Windows\system32\svchost.exe[2016] kernel32.dll!GetStartupInfoW 765B1929 5 Bytes JMP 002C0F37
.text C:\Windows\system32\svchost.exe[2016] kernel32.dll!GetStartupInfoA 765B19C9 5 Bytes JMP 002C007D
.text C:\Windows\system32\svchost.exe[2016] kernel32.dll!CreateProcessW 765B1C01 5 Bytes JMP 002C0F12
.text C:\Windows\system32\svchost.exe[2016] kernel32.dll!CreateProcessA 765B1C36 5 Bytes JMP 002C009F
.text C:\Windows\system32\svchost.exe[2016] kernel32.dll!VirtualProtect 765B1DD1 5 Bytes JMP 002C0F77
.text C:\Windows\system32\svchost.exe[2016] kernel32.dll!CreateNamedPipeW 765B5C44 5 Bytes JMP 002C0014
.text C:\Windows\system32\svchost.exe[2016] kernel32.dll!LoadLibraryExW 765D30C3 5 Bytes JMP 002C0051
.text C:\Windows\system32\svchost.exe[2016] kernel32.dll!LoadLibraryW 765D361F 5 Bytes JMP 002C0F9E
.text C:\Windows\system32\svchost.exe[2016] kernel32.dll!VirtualProtectEx 765D8D7E 5 Bytes JMP 002C0F5C
.text C:\Windows\system32\svchost.exe[2016] kernel32.dll!LoadLibraryExA 765D9469 5 Bytes JMP 002C0040
.text C:\Windows\system32\svchost.exe[2016] kernel32.dll!LoadLibraryA 765D9491 5 Bytes JMP 002C0025
.text C:\Windows\system32\svchost.exe[2016] kernel32.dll!CreatePipe 765E0284 5 Bytes JMP 002C006C
.text C:\Windows\system32\svchost.exe[2016] kernel32.dll!GetProcAddress 765FB8B6 5 Bytes JMP 002C00C4
.text C:\Windows\system32\svchost.exe[2016] kernel32.dll!CreateFileW 765FCC4E 5 Bytes JMP 002C0FD4
.text C:\Windows\system32\svchost.exe[2016] kernel32.dll!CreateFileA 765FCF71 5 Bytes JMP 002C0FEF
.text C:\Windows\system32\svchost.exe[2016] kernel32.dll!CreateNamedPipeA 7664430E 5 Bytes JMP 002C0FC3
.text C:\Windows\system32\svchost.exe[2016] kernel32.dll!WinExec 766454FF 5 Bytes JMP 002C008E
.text C:\Windows\system32\svchost.exe[2016] msvcrt.dll!_wsystem 77638A47 5 Bytes JMP 00360064
.text C:\Windows\system32\svchost.exe[2016] msvcrt.dll!system 77638B63 5 Bytes JMP 00360FD9
.text C:\Windows\system32\svchost.exe[2016] msvcrt.dll!_creat 7763C6F1 5 Bytes JMP 0036002E
.text C:\Windows\system32\svchost.exe[2016] msvcrt.dll!_open 7763DA7E 5 Bytes JMP 00360000
.text C:\Windows\system32\svchost.exe[2016] msvcrt.dll!_wcreat 7763DC9E 5 Bytes JMP 0036003F
.text C:\Windows\system32\svchost.exe[2016] msvcrt.dll!_wopen 7763DE79 5 Bytes JMP 0036001D
.text C:\Windows\system32\svchost.exe[2016] ADVAPI32.dll!RegCreateKeyExA 776AB5E7 5 Bytes JMP 0037005B
.text C:\Windows\system32\svchost.exe[2016] ADVAPI32.dll!RegCreateKeyA 776AB8AE 5 Bytes JMP 00370FAF
.text C:\Windows\system32\svchost.exe[2016] ADVAPI32.dll!RegOpenKeyA 776B0BF5 5 Bytes JMP 00370000
.text C:\Windows\system32\svchost.exe[2016] ADVAPI32.dll!RegCreateKeyW 776BB83D 5 Bytes JMP 00370036
.text C:\Windows\system32\svchost.exe[2016] ADVAPI32.dll!RegCreateKeyExW 776BBCE1 5 Bytes JMP 0037006C
.text C:\Windows\system32\svchost.exe[2016] ADVAPI32.dll!RegOpenKeyExA 776BD4E8 5 Bytes JMP 00370011
.text C:\Windows\system32\svchost.exe[2016] ADVAPI32.dll!RegOpenKeyW 776C3CB0 5 Bytes JMP 00370FE5
.text C:\Windows\system32\svchost.exe[2016] ADVAPI32.dll!RegOpenKeyExW 776CF09D 5 Bytes JMP 00370FC0
.text C:\Windows\system32\svchost.exe[2016] WS2_32.dll!socket 777F36D1 5 Bytes JMP 00590000
.text C:\Windows\system32\svchost.exe[2080] ntdll.dll!NtCreateFile 77DA8008 5 Bytes JMP 00340000
.text C:\Windows\system32\svchost.exe[2080] ntdll.dll!NtCreateProcess 77DA80C8 5 Bytes JMP 00340FD1
.text C:\Windows\system32\svchost.exe[2080] ntdll.dll!NtProtectVirtualMemory 77DA8968 5 Bytes JMP 00340011
.text C:\Windows\system32\svchost.exe[2080] kernel32.dll!GetStartupInfoW 765B1929 5 Bytes JMP 00070F12
.text C:\Windows\system32\svchost.exe[2080] kernel32.dll!GetStartupInfoA 765B19C9 5 Bytes JMP 00070062
.text C:\Windows\system32\svchost.exe[2080] kernel32.dll!CreateProcessW 765B1C01 5 Bytes JMP 00070087
.text C:\Windows\system32\svchost.exe[2080] kernel32.dll!CreateProcessA 765B1C36 5 Bytes JMP 00070EF0
.text C:\Windows\system32\svchost.exe[2080] kernel32.dll!VirtualProtect 765B1DD1 5 Bytes JMP 00070F66
.text C:\Windows\system32\svchost.exe[2080] kernel32.dll!CreateNamedPipeW 765B5C44 5 Bytes JMP 00070FD4
.text C:\Windows\system32\svchost.exe[2080] kernel32.dll!LoadLibraryExW 765D30C3 5 Bytes JMP 00070F83
.text C:\Windows\system32\svchost.exe[2080] kernel32.dll!LoadLibraryW 765D361F 5 Bytes JMP 00070F9E
.text C:\Windows\system32\svchost.exe[2080] kernel32.dll!VirtualProtectEx 765D8D7E 5 Bytes JMP 00070F4B
.text C:\Windows\system32\svchost.exe[2080] kernel32.dll!LoadLibraryExA 765D9469 5 Bytes JMP 00070040
.text C:\Windows\system32\svchost.exe[2080] kernel32.dll!LoadLibraryA 765D9491 5 Bytes JMP 00070FB9
.text C:\Windows\system32\svchost.exe[2080] kernel32.dll!CreatePipe 765E0284 5 Bytes JMP 00070051
.text C:\Windows\system32\svchost.exe[2080] kernel32.dll!GetProcAddress 765FB8B6 5 Bytes JMP 00070098
.text C:\Windows\system32\svchost.exe[2080] kernel32.dll!CreateFileW 765FCC4E 5 Bytes JMP 0007000A
.text C:\Windows\system32\svchost.exe[2080] kernel32.dll!CreateFileA 765FCF71 5 Bytes JMP 00070FEF
.text C:\Windows\system32\svchost.exe[2080] kernel32.dll!CreateNamedPipeA 7664430E 5 Bytes JMP 00070025
.text C:\Windows\system32\svchost.exe[2080] kernel32.dll!WinExec 766454FF 5 Bytes JMP 00070F01
.text C:\Windows\system32\svchost.exe[2080] msvcrt.dll!_wsystem 77638A47 5 Bytes JMP 00370FAD
.text C:\Windows\system32\svchost.exe[2080] msvcrt.dll!system 77638B63 5 Bytes JMP 00370038
.text C:\Windows\system32\svchost.exe[2080] msvcrt.dll!_creat 7763C6F1 5 Bytes JMP 0037000C
.text C:\Windows\system32\svchost.exe[2080] msvcrt.dll!_open 7763DA7E 5 Bytes JMP 00370FEF
.text C:\Windows\system32\svchost.exe[2080] msvcrt.dll!_wcreat 7763DC9E 5 Bytes JMP 00370027
.text C:\Windows\system32\svchost.exe[2080] msvcrt.dll!_wopen 7763DE79 5 Bytes JMP 00370FDE
.text C:\Windows\system32\svchost.exe[2080] ADVAPI32.dll!RegCreateKeyExA 776AB5E7 5 Bytes JMP 005D0FA8
.text C:\Windows\system32\svchost.exe[2080] ADVAPI32.dll!RegCreateKeyA 776AB8AE 5 Bytes JMP 005D002F
.text C:\Windows\system32\svchost.exe[2080] ADVAPI32.dll!RegOpenKeyA 776B0BF5 5 Bytes JMP 005D0FEF
.text C:\Windows\system32\svchost.exe[2080] ADVAPI32.dll!RegCreateKeyW 776BB83D 5 Bytes JMP 005D0040
.text C:\Windows\system32\svchost.exe[2080] ADVAPI32.dll!RegCreateKeyExW 776BBCE1 5 Bytes JMP 005D0F97
.text C:\Windows\system32\svchost.exe[2080] ADVAPI32.dll!RegOpenKeyExA 776BD4E8 5 Bytes JMP 005D0FDE
.text C:\Windows\system32\svchost.exe[2080] ADVAPI32.dll!RegOpenKeyW 776C3CB0 5 Bytes JMP 005D000A
.text C:\Windows\system32\svchost.exe[2080] ADVAPI32.dll!RegOpenKeyExW 776CF09D 5 Bytes JMP 005D0FCD
.text C:\Windows\system32\svchost.exe[2080] WS2_32.dll!socket 777F36D1 5 Bytes JMP 005E0000
.text C:\Windows\system32\svchost.exe[2112] ntdll.dll!NtCreateFile 77DA8008 5 Bytes JMP 002C0FEF
.text C:\Windows\system32\svchost.exe[2112] ntdll.dll!NtCreateProcess 77DA80C8 5 Bytes JMP 002C0FCA
.text C:\Windows\system32\svchost.exe[2112] ntdll.dll!NtProtectVirtualMemory 77DA8968 5 Bytes JMP 002C0000
.text C:\Windows\system32\svchost.exe[2112] kernel32.dll!GetStartupInfoW 765B1929 5 Bytes JMP 002B0FA3
.text C:\Windows\system32\svchost.exe[2112] kernel32.dll!GetStartupInfoA 765B19C9 5 Bytes JMP 002B00DF
.text C:\Windows\system32\svchost.exe[2112] kernel32.dll!CreateProcessW 765B1C01 5 Bytes JMP 002B013A
.text C:\Windows\system32\svchost.exe[2112] kernel32.dll!CreateProcessA 765B1C36 5 Bytes JMP 002B011F
.text C:\Windows\system32\svchost.exe[2112] kernel32.dll!VirtualProtect 765B1DD1 5 Bytes JMP 002B0098
.text C:\Windows\system32\svchost.exe[2112] kernel32.dll!CreateNamedPipeW 765B5C44 5 Bytes JMP 002B002F
.text C:\Windows\system32\svchost.exe[2112] kernel32.dll!LoadLibraryExW 765D30C3 5 Bytes JMP 002B0087
.text C:\Windows\system32\svchost.exe[2112] kernel32.dll!LoadLibraryW 765D361F 5 Bytes JMP 002B0051
.text C:\Windows\system32\svchost.exe[2112] kernel32.dll!VirtualProtectEx 765D8D7E 5 Bytes JMP 002B00A9
.text C:\Windows\system32\svchost.exe[2112] kernel32.dll!LoadLibraryExA 765D9469 5 Bytes JMP 002B006C
.text C:\Windows\system32\svchost.exe[2112] kernel32.dll!LoadLibraryA 765D9491 5 Bytes JMP 002B0040
.text C:\Windows\system32\svchost.exe[2112] kernel32.dll!CreatePipe 765E0284 5 Bytes JMP 002B00CE
.text C:\Windows\system32\svchost.exe[2112] kernel32.dll!GetProcAddress 765FB8B6 5 Bytes JMP 002B0155
.text C:\Windows\system32\svchost.exe[2112] kernel32.dll!CreateFileW 765FCC4E 5 Bytes JMP 002B0FDE
.text C:\Windows\system32\svchost.exe[2112] kernel32.dll!CreateFileA 765FCF71 5 Bytes JMP 002B0FEF
.text C:\Windows\system32\svchost.exe[2112] kernel32.dll!CreateNamedPipeA 7664430E 5 Bytes JMP 002B0014
.text C:\Windows\system32\svchost.exe[2112] kernel32.dll!WinExec 766454FF 5 Bytes JMP 002B0104
.text C:\Windows\system32\svchost.exe[2112] msvcrt.dll!_wsystem 77638A47 5 Bytes JMP 003D0042
.text C:\Windows\system32\svchost.exe[2112] msvcrt.dll!system 77638B63 5 Bytes JMP 003D0FB7
.text C:\Windows\system32\svchost.exe[2112] msvcrt.dll!_creat 7763C6F1 5 Bytes JMP 003D001D
.text C:\Windows\system32\svchost.exe[2112] msvcrt.dll!_open 7763DA7E 5 Bytes JMP 003D0000
.text C:\Windows\system32\svchost.exe[2112] msvcrt.dll!_wcreat 7763DC9E 5 Bytes JMP 003D0FC8
.text C:\Windows\system32\svchost.exe[2112] msvcrt.dll!_wopen 7763DE79 5 Bytes JMP 003D0FE3
.text C:\Windows\system32\svchost.exe[2112] ADVAPI32.dll!RegCreateKeyExA 776AB5E7 5 Bytes JMP 003E0FA1
.text C:\Windows\system32\svchost.exe[2112] ADVAPI32.dll!RegCreateKeyA 776AB8AE 5 Bytes JMP 003E002F
.text C:\Windows\system32\svchost.exe[2112] ADVAPI32.dll!RegOpenKeyA 776B0BF5 5 Bytes JMP 003E0FEF
.text C:\Windows\system32\svchost.exe[2112] ADVAPI32.dll!RegCreateKeyW 776BB83D 5 Bytes JMP 003E0FB2
.text C:\Windows\system32\svchost.exe[2112] ADVAPI32.dll!RegCreateKeyExW 776BBCE1 5 Bytes JMP 003E0054
.text C:\Windows\system32\svchost.exe[2112] ADVAPI32.dll!RegOpenKeyExA 776BD4E8 5 Bytes JMP 003E0014
.text C:\Windows\system32\svchost.exe[2112] ADVAPI32.dll!RegOpenKeyW 776C3CB0 5 Bytes JMP 003E0FDE
.text C:\Windows\system32\svchost.exe[2112] ADVAPI32.dll!RegOpenKeyExW 776CF09D 5 Bytes JMP 003E0FCD
.text C:\Windows\system32\svchost.exe[2112] WS2_32.dll!socket 777F36D1 5 Bytes JMP 00540000
.text C:\Windows\System32\svchost.exe[2144] ntdll.dll!NtCreateFile 77DA8008 5 Bytes JMP 00060000
.text C:\Windows\System32\svchost.exe[2144] ntdll.dll!NtCreateProcess 77DA80C8 5 Bytes JMP 00060FDB
.text C:\Windows\System32\svchost.exe[2144] ntdll.dll!NtProtectVirtualMemory 77DA8968 5 Bytes JMP 00060011
.text C:\Windows\System32\svchost.exe[2144] kernel32.dll!GetStartupInfoW 765B1929 5 Bytes JMP 00050F54
.text C:\Windows\System32\svchost.exe[2144] kernel32.dll!GetStartupInfoA 765B19C9 5 Bytes JMP 000500A4
.text C:\Windows\System32\svchost.exe[2144] kernel32.dll!CreateProcessW 765B1C01 5 Bytes JMP 000500DA
.text C:\Windows\System32\svchost.exe[2144] kernel32.dll!CreateProcessA 765B1C36 5 Bytes JMP 000500BF
.text C:\Windows\System32\svchost.exe[2144] kernel32.dll!VirtualProtect 765B1DD1 5 Bytes JMP 00050F94
.text C:\Windows\System32\svchost.exe[2144] kernel32.dll!CreateNamedPipeW 765B5C44 5 Bytes JMP 00050025
.text C:\Windows\System32\svchost.exe[2144] kernel32.dll!LoadLibraryExW 765D30C3 5 Bytes JMP 0005006E
.text C:\Windows\System32\svchost.exe[2144] kernel32.dll!LoadLibraryW 765D361F 5 Bytes JMP 00050FAF
.text C:\Windows\System32\svchost.exe[2144] kernel32.dll!VirtualProtectEx 765D8D7E 5 Bytes JMP 00050093
.text C:\Windows\System32\svchost.exe[2144] kernel32.dll!LoadLibraryExA 765D9469 5 Bytes JMP 00050051
.text C:\Windows\System32\svchost.exe[2144] kernel32.dll!LoadLibraryA 765D9491 5 Bytes JMP 00050040
.text C:\Windows\System32\svchost.exe[2144] kernel32.dll!CreatePipe 765E0284 5 Bytes JMP 00050F79
.text C:\Windows\System32\svchost.exe[2144] kernel32.dll!GetProcAddress 765FB8B6 5 Bytes JMP 000500EB
.text C:\Windows\System32\svchost.exe[2144] kernel32.dll!CreateFileW 765FCC4E 5 Bytes JMP 0005000A
.text C:\Windows\System32\svchost.exe[2144] kernel32.dll!CreateFileA 765FCF71 5 Bytes JMP 00050FE5
.text C:\Windows\System32\svchost.exe[2144] kernel32.dll!CreateNamedPipeA 7664430E 5 Bytes JMP 00050FD4
.text C:\Windows\System32\svchost.exe[2144] kernel32.dll!WinExec 766454FF 5 Bytes JMP 00050F43
.text C:\Windows\System32\svchost.exe[2144] msvcrt.dll!_wsystem 77638A47 5 Bytes JMP 00070F97
.text C:\Windows\System32\svchost.exe[2144] msvcrt.dll!system 77638B63 5 Bytes JMP 00070FA8
.text C:\Windows\System32\svchost.exe[2144] msvcrt.dll!_creat 7763C6F1 5 Bytes JMP 00070FC3
.text C:\Windows\System32\svchost.exe[2144] msvcrt.dll!_open 7763DA7E 5 Bytes JMP 00070FEF
.text C:\Windows\System32\svchost.exe[2144] msvcrt.dll!_wcreat 7763DC9E 5 Bytes JMP 00070022
.text C:\Windows\System32\svchost.exe[2144] msvcrt.dll!_wopen 7763DE79 5 Bytes JMP 00070FDE
.text C:\Windows\System32\svchost.exe[2144] ADVAPI32.dll!RegCreateKeyExA 776AB5E7 5 Bytes JMP 00080051
.text C:\Windows\System32\svchost.exe[2144] ADVAPI32.dll!RegCreateKeyA 776AB8AE 5 Bytes JMP 00080036
.text C:\Windows\System32\svchost.exe[2144] ADVAPI32.dll!RegOpenKeyA 776B0BF5 5 Bytes JMP 00080000
.text C:\Windows\System32\svchost.exe[2144] ADVAPI32.dll!RegCreateKeyW 776BB83D 5 Bytes JMP 00080FAF
.text C:\Windows\System32\svchost.exe[2144] ADVAPI32.dll!RegCreateKeyExW 776BBCE1 5 Bytes JMP 00080F9E
.text C:\Windows\System32\svchost.exe[2144] ADVAPI32.dll!RegOpenKeyExA 776BD4E8 5 Bytes JMP 00080FCA
.text C:\Windows\System32\svchost.exe[2144] ADVAPI32.dll!RegOpenKeyW 776C3CB0 5 Bytes JMP 00080FDB
.text C:\Windows\System32\svchost.exe[2144] ADVAPI32.dll!RegOpenKeyExW 776CF09D 5 Bytes JMP 00080025
.text C:\Windows\system32\wuauclt.exe[5732] ntdll.dll!NtCreateFile 77DA8008 5 Bytes JMP 00040000
.text C:\Windows\system32\wuauclt.exe[5732] ntdll.dll!NtCreateProcess 77DA80C8 5 Bytes JMP 00040FD4
.text C:\Windows\system32\wuauclt.exe[5732] ntdll.dll!NtProtectVirtualMemory 77DA8968 5 Bytes JMP 00040FEF
.text C:\Windows\system32\wuauclt.exe[5732] kernel32.dll!GetStartupInfoW 765B1929 5 Bytes JMP 00010082
.text C:\Windows\system32\wuauclt.exe[5732] kernel32.dll!GetStartupInfoA 765B19C9 5 Bytes JMP 00010F46
.text C:\Windows\system32\wuauclt.exe[5732] kernel32.dll!CreateProcessW 765B1C01 5 Bytes JMP 000100C9
.text C:\Windows\system32\wuauclt.exe[5732] kernel32.dll!CreateProcessA 765B1C36 5 Bytes JMP 000100B8
.text C:\Windows\system32\wuauclt.exe[5732] kernel32.dll!VirtualProtect 765B1DD1 5 Bytes JMP 00010F72
.text C:\Windows\system32\wuauclt.exe[5732] kernel32.dll!CreateNamedPipeW 765B5C44 5 Bytes JMP 00010FCA
.text C:\Windows\system32\wuauclt.exe[5732] kernel32.dll!LoadLibraryExW 765D30C3 5 Bytes JMP 00010F83
.text C:\Windows\system32\wuauclt.exe[5732] kernel32.dll!LoadLibraryW 765D361F 5 Bytes JMP 00010036
.text C:\Windows\system32\wuauclt.exe[5732] kernel32.dll!VirtualProtectEx 765D8D7E 5 Bytes JMP 00010F57
.text C:\Windows\system32\wuauclt.exe[5732] kernel32.dll!LoadLibraryExA 765D9469 5 Bytes JMP 00010F94
.text C:\Windows\system32\wuauclt.exe[5732] kernel32.dll!LoadLibraryA 765D9491 5 Bytes JMP 00010FB9
.text C:\Windows\system32\wuauclt.exe[5732] kernel32.dll!CreatePipe 765E0284 5 Bytes JMP 00010067
.text C:\Windows\system32\wuauclt.exe[5732] kernel32.dll!GetProcAddress 765FB8B6 5 Bytes JMP 000100DA
.text C:\Windows\system32\wuauclt.exe[5732] kernel32.dll!CreateFileW 765FCC4E 5 Bytes JMP 00010FE5
.text C:\Windows\system32\wuauclt.exe[5732] kernel32.dll!CreateFileA 765FCF71 5 Bytes JMP 0001000A
.text C:\Windows\system32\wuauclt.exe[5732] kernel32.dll!CreateNamedPipeA 7664430E 5 Bytes JMP 0001001B
.text C:\Windows\system32\wuauclt.exe[5732] kernel32.dll!WinExec 766454FF 5 Bytes JMP 000100A7
.text C:\Windows\system32\wuauclt.exe[5732] msvcrt.dll!_wsystem 77638A47 5 Bytes JMP 0007005F
.text C:\Windows\system32\wuauclt.exe[5732] msvcrt.dll!system 77638B63 5 Bytes JMP 0007004E
.text C:\Windows\system32\wuauclt.exe[5732] msvcrt.dll!_creat 7763C6F1 5 Bytes JMP 00070FDE
.text C:\Windows\system32\wuauclt.exe[5732] msvcrt.dll!_open 7763DA7E 5 Bytes JMP 00070FEF
.text C:\Windows\system32\wuauclt.exe[5732] msvcrt.dll!_wcreat 7763DC9E 5 Bytes JMP 00070033
.text C:\Windows\system32\wuauclt.exe[5732] msvcrt.dll!_wopen 7763DE79 5 Bytes JMP 0007000C
.text C:\Windows\system32\wuauclt.exe[5732] ADVAPI32.dll!RegCreateKeyExA 776AB5E7 5 Bytes JMP 000C0040
.text C:\Windows\system32\wuauclt.exe[5732] ADVAPI32.dll!RegCreateKeyA 776AB8AE 5 Bytes JMP 000C0F9E
.text C:\Windows\system32\wuauclt.exe[5732] ADVAPI32.dll!RegOpenKeyA 776B0BF5 5 Bytes JMP 000C0FE5
.text C:\Windows\system32\wuauclt.exe[5732] ADVAPI32.dll!RegCreateKeyW 776BB83D 5 Bytes JMP 000C0025
.text C:\Windows\system32\wuauclt.exe[5732] ADVAPI32.dll!RegCreateKeyExW 776BBCE1 5 Bytes JMP 000C0F83
.text C:\Windows\system32\wuauclt.exe[5732] ADVAPI32.dll!RegOpenKeyExA 776BD4E8 5 Bytes JMP 000C0FD4
.text C:\Windows\system32\wuauclt.exe[5732] ADVAPI32.dll!RegOpenKeyW 776C3CB0 5 Bytes JMP 000C000A
.text C:\Windows\system32\wuauclt.exe[5732] ADVAPI32.dll!RegOpenKeyExW 776CF09D 5 Bytes JMP 000C0FAF

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\tdx \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\tdx \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\tdx \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

—- EOF - GMER 1.0.15 —-
Log looks ok, no rootkit . Just wondering what this is about


You need to enable windows to show all files and folders, instructions Here

Go to VirusTotal and submit this file for analysis, just use the browse feature and then Send File, you will get a report back, post the report into this thread for me to see. If the site says this file has been checked before, have them check it again


C:\Windows\System32\drivers\rhavlldp.sys <==This file


If the site is busy you can try this one
http://virusscan.jotti.org/en
Internet is much better. Still seems a bit slow on startup and returning from sleep mode. Some progams seem to open slowly still. Overall though it is much better. Thank you.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI