What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Xplorer just Crashes

249 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi to Everyone on the Forum ok i have bean in contact with Ztruker and thePost is hear>>> http://forums.whatthetech.com/index.php?sh…mp;#entry725411 ok its bean about 6 / 7 Weeks now i just canot access any files in Control Panel or Open any Files without XPLORER CRASHING and going right back to the Picture on my Deasktop then Restarting intself the only way i can Access my Files or Down l oads are bye going into SAFEMODE its the only way i can get to my Files . Ztruker said i should visit you guys hear as the only other result would be a Reinstall so you are the Last Resort so lets go.
Post #2
Hi hear is the OTL - Scan Results ::: OTL logfile created on: 22/04/2011 12:08:59 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Jai\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19048)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,014.00 Mb Total Physical Memory | 152.00 Mb Available Physical Memory | 15.00% Memory free
3.00 Gb Paging File | 1.00 Gb Available in Paging File | 33.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111.69 Gb Total Space | 35.44 Gb Free Space | 31.73% Space Free | Partition Type: NTFS
Drive D: | 111.43 Gb Total Space | 94.05 Gb Free Space | 84.40% Space Free | Partition Type: NTFS

Computer Name: MEDIA-PC | User Name: Jai | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/04/22 12:05:30 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\Jai\Downloads\OTL.exe
PRC - [2011/04/04 10:21:56 | 001,165,824 | —- | M] (W3i, LLC) – C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe
PRC - [2011/03/20 00:41:54 | 000,912,344 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/03/15 20:36:59 | 001,191,368 | —- | M] (BitDefender S.R.L.) – C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe
PRC - [2011/03/08 12:50:10 | 000,310,856 | —- | M] (BitDefender S.R.L.) – C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
PRC - [2011/01/25 18:42:10 | 000,083,440 | —- | M] (Google) – C:\Users\Jai\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
PRC - [2010/08/12 19:47:44 | 001,615,688 | —- | M] (BitDefender S.R.L.) – C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe
PRC - [2010/08/12 19:47:04 | 001,506,048 | —- | M] (BitDefender S.R.L.) – C:\Program Files\BitDefender\BitDefender 2010\uiscan.exe
PRC - [2010/08/12 19:46:00 | 001,091,984 | —- | M] (BitDefender S.R.L.) – C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe
PRC - [2010/02/26 06:10:20 | 021,979,992 | —- | M] () – C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2009/11/25 12:00:34 | 000,095,568 | —- | M] (Devguru Co., Ltd.) – C:\Windows\System32\dgdersvc.exe
PRC - [2009/09/10 18:14:18 | 000,238,952 | —- | M] (Teruten) – C:\Windows\System32\FsUsbExService.Exe
PRC - [2009/07/10 18:29:00 | 000,093,064 | —- | M] () – C:\Program Files\Ask.com\UpdateTask.exe
PRC - [2009/06/03 21:52:26 | 000,120,168 | —- | M] (stumbleupon.com) – C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe
PRC - [2009/06/02 12:36:55 | 000,825,152 | R— | M] (SAC) – C:\ProgramData\OfficeGuardian\reminder\SacReminder.exe
PRC - [2009/04/11 07:28:11 | 000,217,088 | —- | M] (Microsoft Corporation) – C:\Windows\System32\WerFault.exe
PRC - [2009/04/11 07:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2008/01/19 08:38:32 | 000,319,544 | —- | M] (Microsoft Corporation) – c:\Program Files\Windows Defender\MpCmdRun.exe
PRC - [2007/08/01 00:25:48 | 000,326,176 | —- | M] () – C:\Acer\Empowering Technology\SysMonitor.exe
PRC - [2007/07/03 18:40:10 | 000,053,248 | —- | M] (Acer Inc.) – C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
PRC - [2007/06/22 02:33:20 | 000,269,448 | —- | M] (CyberLink) – C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
PRC - [2007/06/21 07:04:40 | 000,269,432 | —- | M] (CyberLink) – C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe
PRC - [2007/04/06 22:10:56 | 000,223,704 | —- | M] (Intel® Corporation) – C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
PRC - [2007/04/06 22:07:42 | 000,439,768 | —- | M] (Intel Corporation) – C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
PRC - [2007/02/12 18:46:34 | 000,208,896 | —- | M] () – C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe


========== Modules (SafeList) ==========

MOD - [2011/04/22 12:05:30 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\Jai\Downloads\OTL.exe
MOD - [2011/04/01 12:33:44 | 000,232,968 | —- | M] (BitDefender S.R.L. Bucharest, ROMANIA) – C:\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_88\midas32.dll
MOD - [2010/08/31 16:43:52 | 001,686,016 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] – – (CLTNetCnService)
SRV - [2011/03/08 12:50:10 | 000,310,856 | —- | M] (BitDefender S.R.L.) [Auto | Running] – C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe – (LIVESRV)
SRV - [2010/11/01 21:59:46 | 000,331,296 | —- | M] (Soluto) [Auto | Stopped] – C:\Program Files\Soluto\SolutoService.exe – (SolutoService)
SRV - [2010/08/12 19:55:50 | 000,315,392 | —- | M] (S.C. BitDefender S.R.L) [On_Demand | Running] – C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\scan.dll – (scan)
SRV - [2010/08/12 19:55:13 | 000,183,880 | —- | M] (BitDefender S.R.L. http://www.bitdefender.com) [On_Demand | Stopped] – C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe – (Arrakis3)
SRV - [2010/08/12 19:47:44 | 001,615,688 | —- | M] (BitDefender S.R.L.) [Auto | Running] – C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe – (VSSERV)
SRV - [2010/03/18 11:19:26 | 000,113,152 | —- | M] (ArcSoft Inc.) [On_Demand | Stopped] – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe – (ACDaemon)
SRV - [2009/11/25 12:00:34 | 000,095,568 | —- | M] (Devguru Co., Ltd.) [Auto | Running] – C:\Windows\System32\dgdersvc.exe – (dgdersvc)
SRV - [2009/09/10 18:14:18 | 000,238,952 | —- | M] (Teruten) [Auto | Running] – C:\Windows\System32\FsUsbExService.Exe – (FsUsbExService)
SRV - [2009/08/24 12:36:45 | 000,377,344 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – winhttp.dll – (WinHttpAutoProxySvc)
SRV - [2009/06/17 11:18:42 | 006,582,912 | —- | M] () [Auto | Stopped] – c:\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe – (wampmysqld)
SRV - [2009/06/03 21:52:26 | 000,120,168 | —- | M] (stumbleupon.com) [Auto | Running] – C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe – (StumbleUponUpdateService)
SRV - [2008/12/10 01:10:14 | 000,024,636 | —- | M] (Apache Software Foundation) [Auto | Stopped] – c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe – (wampapache)
SRV - [2008/11/09 21:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [On_Demand | Stopped] – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)
SRV - [2008/01/19 08:38:24 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2007/07/03 18:40:10 | 000,053,248 | —- | M] (Acer Inc.) [Auto | Running] – C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe – (eRecoveryService)
SRV - [2007/06/22 02:33:20 | 000,269,448 | —- | M] (CyberLink) [Auto | Running] – C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe – (Acer HomeMedia Connect Service)
SRV - [2007/06/21 07:04:40 | 000,269,432 | —- | M] (CyberLink) [Auto | Running] – C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe – (Acer TV Share Service)
SRV - [2007/04/26 00:34:30 | 000,457,512 | —- | M] (HiTRSUT) [On_Demand | Stopped] – C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe – (eDataSecurity Service)
SRV - [2007/04/17 02:48:12 | 000,028,672 | —- | M] () [On_Demand | Stopped] – C:\Acer\Empowering Technology\ePerformance\MemCheck.exe – (AcerMemUsageCheckService)
SRV - [2007/04/06 22:10:56 | 000,223,704 | —- | M] (Intel® Corporation) [Auto | Running] – C:\Program Files\Intel\IntelDH\CCU\AlertService.exe – (AlertService) Intel®
SRV - [2007/04/06 22:10:22 | 000,272,856 | —- | M] (Intel® Corporation) [On_Demand | Stopped] – C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe – (QualityManager) Intel®
SRV - [2007/04/06 22:10:08 | 000,449,496 | —- | M] (Intel® Corporation) [On_Demand | Stopped] – C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe – (Remote UI Service) Intel®
SRV - [2007/04/06 22:08:58 | 000,158,168 | —- | M] (Intel® Corporation) [On_Demand | Stopped] – C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe – (MCLServiceATL) Intel®
SRV - [2007/04/06 22:08:36 | 000,036,312 | R— | M] (Intel® Corporation) [On_Demand | Stopped] – C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe – (IntelDHSvcConf)
SRV - [2007/04/06 22:08:24 | 000,039,896 | —- | M] (Intel® Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe – (DHTRACE) Intel®
SRV - [2007/04/06 22:08:14 | 000,059,352 | —- | M] (Intel® Corporation) [On_Demand | Stopped] – C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe – (ISSM) Intel®
SRV - [2007/04/06 22:07:46 | 000,313,816 | —- | M] (Intel® Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe – (NMSCore) Intel®
SRV - [2007/04/06 22:06:48 | 000,256,472 | —- | M] () [On_Demand | Stopped] – C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe – (M1 Server) Intel® Viiv™
SRV - [2007/02/12 18:46:34 | 000,208,896 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe – (DQLWinService)


========== Driver Services (SafeList) ==========

DRV - [2010/11/01 21:50:32 | 000,181,704 | —- | M] (Soluto LTD.) [File_System | Boot | Stopped] – C:\Windows\system32\DRIVERS\PCGenFAM.sys – (PCGenFAM)
DRV - [2010/08/12 20:03:27 | 000,014,720 | —- | M] (BitDefender S.R.L.) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\profos.sys – (Profos)
DRV - [2010/08/12 20:03:09 | 000,153,448 | —- | M] (BitDefender S.R.L. Bucharest, ROMANIA) [File_System | On_Demand | Running] – C:\Windows\System32\drivers\bdfm.sys – (BDFM)
DRV - [2010/08/12 20:02:28 | 000,085,128 | —- | M] (BitDefender) [Kernel | Auto | Running] – C:\Program Files\BitDefender\BitDefender 2010\bdvedisk.sys – (BDVEDISK)
DRV - [2010/08/12 20:02:20 | 000,058,368 | —- | M] (BitDefender) [Kernel | On_Demand | Stopped] – C:\Program Files\BitDefender\BitDefender 2010\bdselfpr.sys – (BDSelfPr)
DRV - [2010/08/12 20:00:58 | 000,291,352 | —- | M] (BitDefender) [File_System | Boot | Running] – C:\Windows\system32\DRIVERS\bdfsfltr.sys – (bdfsfltr)
DRV - [2010/08/12 19:52:05 | 000,119,504 | —- | M] (BitDefender LLC) [Kernel | System | Running] – C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys – (bdftdif)
DRV - [2010/08/12 19:37:46 | 000,072,784 | —- | M] (BitDefender LLC) [Kernel | System | Running] – C:\Windows\System32\drivers\BdfNdisf6.sys – (BdfNdisf)
DRV - [2010/04/29 16:39:38 | 000,038,224 | —- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mbamswissarmy.sys – (MBAMSwissArmy)
DRV - [2009/11/25 12:00:34 | 000,018,136 | —- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\dgderdrv.sys – (dgderdrv)
DRV - [2009/09/21 09:55:36 | 000,121,856 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ss_bmdm.sys – (ss_bmdm)
DRV - [2009/09/21 09:55:36 | 000,090,112 | —- | M] (MCCI) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ss_bbus.sys – (ss_bbus) SAMSUNG USB Mobile Device (WDM)
DRV - [2009/09/21 09:55:36 | 000,014,976 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ss_bmdfl.sys – (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter)
DRV - [2009/08/31 10:23:28 | 000,036,608 | —- | M] () [Kernel | On_Demand | Running] – C:\Windows\System32\FsUsbExDisk.Sys – (FsUsbExDisk)
DRV - [2009/07/29 11:30:18 | 000,005,504 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\IntelDH.sys – (IntelDH)
DRV - [2009/05/07 04:22:06 | 000,039,808 | —- | M] (BitDefender S.R.L.) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\trufos.sys – (Trufos)
DRV - [2008/08/26 10:26:12 | 000,018,816 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\pccsmcfd.sys – (pccsmcfd)
DRV - [2007/07/03 03:05:20 | 000,015,392 | —- | M] (Acer, Inc.) [Kernel | Auto | Running] – C:\Acer\Empowering Technology\eRecovery\int15.sys – (int15)
DRV - [2007/04/25 16:25:34 | 000,221,184 | —- | M] (YUAN High-Tech Development Co. Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\OmniTV.sys – (OmniTV)
DRV - [2007/04/13 06:22:56 | 000,228,224 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\e1e6032.sys – (e1express) Intel®
DRV - [2007/04/06 22:10:40 | 000,014,808 | —- | M] () [File_System | On_Demand | Stopped] – C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.sys – (TSHWMDTCP)
DRV - [2007/02/19 04:34:50 | 000,005,376 | –S- | M] (Gteko Ltd.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\nmsunidr.sys – (nmsunidr)
DRV - [2006/08/03 07:30:48 | 000,856,832 | —- | M] (AVerMedia TECHNOLOGIES, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\AVerM115S.sys – (AVerM115S)
DRV - [2005/02/23 14:58:56 | 000,011,776 | —- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\afc.sys – (Afc)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 68 11 3E 01 8A FE 3A 40 98 05 55 13 32 61 80 52 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
IE - HKCU\..\URLSearchHook: {fa887e92-8f5f-4ec9-99ca-09be0e4120d6} - C:\Program Files\AddThis Toolbar\Helper.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========


FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\ [2010/09/20 18:26:17 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{000a9d1c-beef-4f90-9363-039d445309b8}: C:\Program Files\Google\Google Gears\Firefox\ [2010/03/06 13:59:28 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/07/15 12:57:08 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/15 16:52:51 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/15 16:52:51 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\BitDefender\BitDefender 2009\tbextension\

[2010/03/29 19:01:56 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Extensions
[2009/11/15 22:27:36 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Extensions\[removed]
[2010/03/29 19:01:56 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Extensions\[removed]
[2011/04/21 20:21:10 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions
[2010/11/21 19:07:55 | 000,000,000 | —D | M] (ErrorZilla Plus) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{03651b2d-eb7d-4be7-af1b-dc0cd162dd54}
[2010/09/05 20:41:51 | 000,000,000 | —D | M] (Auto Copy) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{0FED7D55-65D4-47b6-A6DE-9A4ADB55355F}
[2011/03/21 23:33:59 | 000,000,000 | —D | M] (Session Manager) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}
[2011/03/25 20:07:08 | 000,000,000 | —D | M] (ShareThis) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{1b8cc170-8c85-11db-b606-0800200c9a66}
[2010/07/02 20:39:51 | 000,000,000 | —D | M] (Site Launcher) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{20291fcc-1471-46c8-8213-5911f5ce6d67}
[2010/02/23 13:58:48 | 000,000,000 | —D | M] (XUL Cache) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{22459fcd-6248-4643-9877-5e7cab227d76}
[2010/12/30 23:05:05 | 000,000,000 | —D | M] ("Submit'em Now") – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{27ACE843-F2CF-4284-8501-C9306CE44D4A}
[2011/04/15 17:19:02 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011/03/21 23:33:49 | 000,000,000 | —D | M] (SeoQuake) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74}
[2010/07/27 20:43:50 | 000,000,000 | —D | M] (PopupMaster) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{35106bca-6c78-48c7-ac28-56df30b51d2d}
[2011/01/13 22:42:34 | 000,000,000 | —D | M] (AddThis) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{3e0e7d2a-070f-4a47-b019-91fe5385ba79}
[2011/01/31 00:38:29 | 000,000,000 | —D | M] (InFormEnter) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{5546F97E-11A5-46b0-9082-32AD74AAA920}
[2011/03/21 23:33:44 | 000,000,000 | —D | M] (Google Shortcuts) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{5C46D283-ABDE-4dce-B83C-08881401921C}
[2011/02/12 02:43:16 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/03/03 23:18:48 | 000,000,000 | —D | M] ("S3 Firefox Organizer(S3Fox)") – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{7CEA821D-3DAB-4238-B424-BF7324531750}
[2010/03/28 19:59:26 | 000,000,000 | —D | M] (Live PageRank) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{8061ddcf-3632-4287-8d8a-133e219ae838}
[2011/03/03 23:18:47 | 000,000,000 | —D | M] ("StumbleUpon") – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}
[2011/04/08 20:44:18 | 000,000,000 | —D | M] (Power Twitter) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{b2509cd4-17cd-45ed-8146-a82af038f493}
[2011/04/08 20:44:18 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/04/08 20:44:18 | 000,000,000 | —D | M] (Easy Youtube Video Downloader) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}
[2010/07/21 04:05:15 | 000,000,000 | —D | M] (Classic Compact) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{D46E8522-6E86-44b1-A622-58C0668AD78E}
[2011/03/05 14:23:35 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2011/04/08 20:44:12 | 000,000,000 | —D | M] (BitDefender QuickScan) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2010/11/30 17:39:21 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2011/01/21 21:47:45 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}
[2011/03/25 20:06:26 | 000,000,000 | —D | M] (SearchElf 1.2 Community Toolbar) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{f4e6547e-325b-403c-a3bb-ad29ed37a92f}
[2011/01/31 00:38:28 | 000,000,000 | —D | M] (ScribeFire) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{F807FACD-E46A-4793-B345-D58CB177673C}
[2010/08/05 21:54:52 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]
[2011/03/25 20:07:19 | 000,000,000 | —D | M] (Conduit Engine) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]
[2010/07/10 22:31:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]
[2011/04/09 20:53:34 | 000,000,000 | —D | M] (feedly) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\feedly@devhd
[2011/02/12 02:44:29 | 000,000,000 | —D | M] (Firebug) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]
[2011/01/21 00:46:24 | 000,000,000 | —D | M] (Shareaholic) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]
[2010/06/26 22:12:49 | 000,000,000 | —D | M] (Multifox) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\multifox@hultmann
[2011/03/21 23:34:09 | 000,000,000 | —D | M] (ScribeFire Next) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]
[2011/02/12 02:43:53 | 000,000,000 | —D | M] (Amazon Prime/Free Super Saver/Discount Search) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\primefreediscount@veekay
[2011/02/07 20:25:46 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]
[2010/07/10 20:43:13 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\staged
[2011/04/15 17:19:02 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\staged-xpis
[2011/03/03 23:18:49 | 000,000,000 | —D | M] (LastPass) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]
[2011/03/24 17:48:28 | 000,000,000 | —D | M] ("Alexa Toolbar") – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]
[2011/01/21 00:46:22 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]\chrome
[2011/01/21 00:46:22 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]\defaults
[2010/07/21 04:05:14 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{D46E8522-6E86-44b1-A622-58C0668AD78E}\chrome\mozapps\extensions
[2011/03/05 14:23:34 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{dc572301-7619-498c-a57d-39143191b318}\modules\extensions
[2011/04/09 20:53:34 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\feedly@devhd\content\app\extension
[2010/07/10 19:17:05 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\staged\[removed]
[2010/07/10 19:17:09 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\staged\[removed]\chrome
[2010/07/10 20:43:12 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\staged\feedly@devhd\content\app\extension
[2011/04/01 20:01:29 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions
[2010/02/02 20:47:22 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{0fc85f5d-6207-4515-a490-45a549d285c0}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{1b8cc170-8c85-11db-b606-0800200c9a66}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/02/23 13:58:48 | 000,000,000 | —D | M] (XUL Cache) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{22459fcd-6248-4643-9877-5e7cab227d76}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{2fa4ed95-0317-4c6a-a74c-5f3e3912c1f9}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{3e0e7d2a-070f-4a47-b019-91fe5385ba79}
[2010/01/29 22:41:14 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{7C9AE782-DB21-4e40-81FB-AD8A53A6233A}
[2011/04/01 20:01:31 | 000,000,000 | —D | M] (PriceGong) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}
[2010/02/01 22:52:11 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010/02/01 22:44:27 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{d9284e50-81fc-11da-a72b-0800200c9a66}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{fae5bcbc-dd73-439a-a15e-5b9ff39c0e9b}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\[removed]
[2010/02/02 20:47:22 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\staged-xpis
[2010/03/27 21:24:03 | 000,000,000 | —D | M] (LastPass) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\[removed]
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\[removed]
[2011/04/15 16:46:44 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/04/06 18:43:25 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}
[2010/06/12 21:31:16 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/13 20:13:47 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/10/24 00:26:42 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/12/19 21:23:29 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2009/11/06 16:37:19 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2010/11/12 19:53:06 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2009/07/31 14:06:48 | 001,654,784 | —- | M] (LizardTech) – C:\Program Files\Mozilla Firefox\plugins\npdjvu.dll
[2009/11/06 16:37:20 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
[2011/03/19 23:38:28 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2011/03/19 23:38:28 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2011/03/19 23:38:28 | 000,000,769 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2011/03/19 23:38:28 | 000,001,135 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/10/03 14:27:13 | 000,000,782 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.paulponna.com localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O2 - BHO: (StumbleUpon Launcher) - {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll (stumbleupon.com)
O2 - BHO: (PriceGong Plugin) - {1631550F-191D-4826-B069-D9439253D926} - C:\Program Files\PriceGong\2.2.0\PriceGongIE.dll (PriceGong)
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\System32\ActiveToolBand.dll (HiTRUST)
O2 - BHO: (LastPass Browser Helper Object) - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O2 - BHO: (Freecause Toolbar BHO) - {9EBF8AAF-0A31-4786-909A-97A0EF101743} - C:\Program Files\AddThis Toolbar\Toolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.)
O2 - BHO: (Nuclear Games Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O2 - BHO: (Google Gears Helper) - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O2 - BHO: (Simppull Toolbar) - {E4E6BF2A-1667-11DF-A01F-1F9655D89593} - C:\Program Files\simppulltoolbar\simppulltoolbar.dll ()
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (BitDefender Toolbar) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2010\ietoolbar.dll (BitDefender S.R.L.)
O3 - HKLM\..\Toolbar: (StumbleUpon Toolbar) - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll (stumbleupon.com)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (LastPass Toolbar) - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O3 - HKLM\..\Toolbar: (AddThis Toolbar) - {B43176CC-4D9E-493B-A636-D9CBFE39C6DA} - C:\Program Files\AddThis Toolbar\Toolbar.dll ()
O3 - HKLM\..\Toolbar: (Nuclear Games Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Simppull Toolbar) - {E4E6BF2A-1667-11DF-A01F-1F9655D89593} - C:\Program Files\simppulltoolbar\simppulltoolbar.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (AddThis Toolbar) - {B43176CC-4D9E-493B-A636-D9CBFE39C6DA} - C:\Program Files\AddThis Toolbar\Toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Nuclear Games Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe ()
O4 - HKLM..\Run: [Acer Tour] File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [BDAgent] C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe (BitDefender S.R.L.)
O4 - HKLM..\Run: [BitDefender Antiphishing Helper] C:\Program Files\BitDefender\BitDefender 2010\IEShow.exe (BitDefender S.R.L.)
O4 - HKLM..\Run: [eRecoveryService] File not found
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NMSSupport] C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe (Intel Corporation)
O4 - HKLM..\Run: [NPSStartup] File not found
O4 - HKLM..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [InstallIQUpdater] C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
O4 - HKCU..\Run: [SacReminder] C:\ProgramData\OfficeGuardian\reminder\SacReminder.exe (SAC)
O4 - Startup: C:\Users\Jai\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : &Gears; Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O9 - Extra Button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - File not found
O13 - gopher Prefix: missing
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Program Files\Soluto\soluto.exe /userinit) - C:\Program Files\Soluto\soluto.exe (Soluto)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\Jai\Pictures\Picasa\800px-Nick_mason_goodwood.jpg
O24 - Desktop BackupWallPaper: C:\Users\Jai\Pictures\Picasa\800px-Nick_mason_goodwood.jpg
O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/21 18:01:06 | 000,000,000 | —D | C] – C:\Program Files\W3i
[2011/04/21 18:01:06 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InstallIQ Updater
[2011/04/17 07:28:59 | 000,000,000 | —D | C] – C:\Users\Jai\Desktop\back up
[2011/04/17 07:26:50 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\www
[2011/04/17 07:26:50 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\.trash
[2011/04/17 07:26:49 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\tmp
[2011/04/17 07:26:49 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\public_ftp
[2011/04/17 07:26:49 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\.sqmaildata
[2011/04/17 07:26:49 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\.cpanel
[2011/04/17 07:26:48 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\etc
[2011/04/17 07:26:48 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\.sqmailattach
[2011/04/17 07:26:48 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\.htpasswds
[2011/04/17 07:26:48 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\.fantasticodata
[2011/04/17 07:26:48 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\.autorespond
[2011/04/17 07:26:47 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\mail
[2011/04/17 07:26:46 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\.gem
[2011/04/17 07:26:29 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\public_html
[2011/04/17 07:26:29 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\.gnome2
[2011/04/16 22:18:23 | 000,000,000 | —D | C] – C:\Users\Jai\Desktop\autoblogbuddy
[2011/04/16 22:13:38 | 000,000,000 | —D | C] – C:\Users\Jai\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011/04/16 22:13:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011/04/15 15:31:38 | 000,292,864 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2011/04/15 15:31:35 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2011/04/15 15:31:23 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/04/15 15:31:23 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/04/15 15:31:23 | 000,602,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/04/15 15:31:22 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/04/15 15:31:22 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/04/15 15:31:22 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/04/15 15:31:22 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/04/15 15:31:21 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/04/15 15:31:21 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/04/15 15:31:21 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2011/04/15 15:31:21 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/04/15 15:31:20 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/04/15 15:31:20 | 000,173,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/04/15 15:31:20 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2011/04/15 15:31:20 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/04/15 15:31:20 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/04/15 15:31:20 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/04/15 15:31:10 | 001,162,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42u.dll
[2011/04/15 15:31:08 | 001,136,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42.dll
[2011/04/15 15:30:59 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dnscacheugc.exe
[2011/04/15 15:30:55 | 002,041,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/04/15 15:30:46 | 000,726,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[2011/04/15 15:30:45 | 000,420,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vbscript.dll
[2011/04/12 22:51:12 | 000,000,000 | —D | C] – C:\Users\Jai\Desktop\downloads
[2011/04/12 22:50:33 | 000,000,000 | —D | C] – C:\Users\Jai\Desktop\Toolkit
[2011/04/12 22:50:07 | 000,000,000 | —D | C] – C:\Users\Jai\Desktop\Marketing
[2011/04/12 22:49:48 | 000,000,000 | —D | C] – C:\Users\Jai\Desktop\Marketing Graphics Toolkit
[2011/04/09 14:15:23 | 000,000,000 | —D | C] – C:\Windows\pss
[2011/04/08 00:00:49 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\wpcommissionsrr
[2011/04/06 18:43:01 | 000,000,000 | —D | C] – C:\Windows\System32\InstantArticleSuite
[2011/04/06 18:43:00 | 000,000,000 | —D | C] – C:\Program Files\InstantArticleSuite
[2011/04/05 16:02:27 | 000,000,000 | —D | C] – C:\Users\Jai\AppData\Roaming\DriverCure
[2011/04/05 16:02:01 | 000,000,000 | —D | C] – C:\Users\Jai\AppData\Roaming\ParetoLogic
[2011/04/01 22:08:42 | 000,000,000 | —D | C] – C:\Users\Jai\.gimp-2.6
[2011/04/01 22:08:13 | 000,000,000 | —D | C] – C:\Users\Jai\.gegl-0.0
[2011/04/01 20:08:27 | 000,000,000 | —D | C] – C:\Program Files\Uniblue
[2011/04/01 20:05:46 | 000,000,000 | —D | C] – C:\Program Files\KwiClick LLC
[2011/04/01 20:04:16 | 000,000,000 | —D | C] – C:\Users\Jai\AppData\Local\PackageAware
[2011/04/01 20:04:02 | 000,000,000 | —D | C] – C:\ProgramData\W3i
[2011/04/01 20:02:47 | 000,000,000 | —D | C] – C:\Program Files\Free Offers from Freeze.com
[2011/04/01 20:01:15 | 000,000,000 | —D | C] – C:\Program Files\PriceGong
[2011/04/01 20:01:14 | 000,000,000 | —D | C] – C:\Program Files\simppulltoolbar
[2011/03/23 13:41:23 | 001,068,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DWrite.dll
[2011/03/23 13:41:16 | 000,288,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsGdiConverter.dll
[2010/03/27 21:24:00 | 007,377,096 | —- | C] (LastPass) – C:\Program Files\Common Files\lpuninstall.exe
[2009/12/18 00:31:08 | 000,086,683 | —- | C] (Open Source Software community project) – C:\ProgramData\pthreadgc2.dll
[2009/07/29 19:46:47 | 000,016,384 | —- | C] ( ) – C:\Windows\System32\ClearEvent.exe
[2007/08/16 02:50:06 | 000,053,248 | —- | C] ( ) – C:\Windows\System32\Interop.Shell32.dll

========== Files - Modified Within 30 Days ==========

[2011/04/22 12:17:36 | 000,000,418 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{310B1EC3-96B3-4296-BBA8-E5CF53237D0B}.job
[2011/04/22 12:12:06 | 000,000,878 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/22 11:59:15 | 000,003,168 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/04/22 11:59:15 | 000,003,168 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/04/22 11:40:13 | 000,000,900 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3945554959-725833480-59139298-1001UA.job
[2011/04/22 11:10:36 | 003,273,788 | —- | M] () – C:\Users\Jai\Desktop\01-FastAttackSEO-MainGuide.pdf
[2011/04/22 09:55:22 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/04/21 21:42:57 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2011/04/21 21:40:07 | 000,000,848 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3945554959-725833480-59139298-1001Core.job
[2011/04/21 20:12:12 | 000,644,576 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/04/21 20:12:12 | 000,124,378 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/04/21 20:04:25 | 000,000,328 | —- | M] () – C:\Windows\tasks\RegistryBooster.job
[2011/04/21 20:04:04 | 1063,575,552 | -HS- | M] () – C:\hiberfil.sys
[2011/04/21 11:25:11 | 000,000,372 | —- | M] () – C:\Windows\tasks\PC Health Advisor Defrag.job
[2011/04/17 21:22:53 | 000,000,680 | —- | M] () – C:\Users\Jai\AppData\Local\d3d9caps.dat
[2011/04/17 07:26:50 | 000,000,000 | —- | M] () – C:\Users\Jai\Documents\access-logs
[2011/04/16 22:13:38 | 000,000,818 | —- | M] () – C:\Users\Public\Desktop\WinRAR.lnk
[2011/04/16 20:49:05 | 086,259,433 | —- | M] () – C:\Users\Jai\Desktop\jai1985_wp1_wp_20110329_958.sql
[2011/04/16 20:49:05 | 006,133,976 | R— | M] () – C:\Users\Jai\Desktop\jai1985_wp1_wp_20110329_958.sql.gz
[2011/04/16 20:02:40 | 000,001,789 | —- | M] () – C:\Users\Public\Desktop\FileZilla Client.lnk
[2011/04/16 16:36:07 | 000,326,528 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/04/16 16:34:38 | 000,000,052 | —- | M] () – C:\Windows\System32\ashttpstats.csv
[2011/04/16 16:27:58 | 007,291,017 | —- | M] () – C:\Users\Jai\Desktop\quickstartguide.pdf
[2011/04/16 02:16:31 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2011/04/16 02:16:31 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2011/04/16 00:41:34 | 000,000,269 | —- | M] () – C:\Users\Jai\Desktop\rss_button.php.png
[2011/04/15 16:47:20 | 000,001,728 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/04/14 09:42:04 | 001,961,913 | —- | M] () – C:\Users\Jai\Desktop\im_biggest_secret_new.pdf
[2011/04/14 09:37:27 | 001,967,100 | —- | M] () – C:\Users\Jai\Desktop\internet_marketings_biggest_secret.pdf
[2011/04/13 09:09:40 | 000,477,003 | —- | M] () – C:\Users\Jai\Documents\wpcommissions (2).zip
[2011/04/13 09:05:15 | 000,089,868 | —- | M] () – C:\Users\Jai\Documents\MarketingRiches.zip
[2011/04/13 09:05:05 | 000,391,254 | —- | M] () – C:\Users\Jai\Documents\newbiessoftware.zip
[2011/04/13 09:04:17 | 038,624,459 | —- | M] () – C:\Users\Jai\Documents\websitefire.zip
[2011/04/11 16:31:30 | 000,074,240 | —- | M] () – C:\Users\Jai\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/10 12:20:42 | 000,123,556 | —- | M] () – C:\Users\Jai\Desktop\02-NicheKeywordGoldmine-vol2-Bonus.ods
[2011/04/10 12:20:06 | 000,550,574 | —- | M] () – C:\Users\Jai\Desktop\01-NicheKeywordGoldmine-vol2.ods
[2011/04/09 15:00:24 | 000,001,002 | —- | M] () – C:\Users\Jai\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2011/04/08 19:17:45 | 002,293,136 | —- | M] () – C:\Users\Jai\Documents\TrafficInflux2.0.pdf
[2011/04/08 00:00:30 | 000,015,078 | —- | M] () – C:\Users\Jai\Desktop\wpcommissions.zip
[2011/04/07 01:13:52 | 000,348,950 | —- | M] () – C:\Users\Jai\Desktop\HowToTransferAWordpressBlog.pdf
[2011/04/06 23:42:08 | 001,961,913 | —- | M] () – C:\Users\Jai\Desktop\internet_marketings_biggest_secret_new.pdf
[2011/04/06 23:33:32 | 000,262,923 | —- | M] () – C:\Users\Jai\Desktop\ProductReviewReportX_ku53z4liz8.pdf
[2011/04/06 18:43:02 | 000,001,839 | —- | M] () – C:\Users\Jai\Application Data\Microsoft\Internet Explorer\Quick Launch\Instant Article Submitter.lnk
[2011/04/06 18:43:02 | 000,001,832 | —- | M] () – C:\Users\Jai\Application Data\Microsoft\Internet Explorer\Quick Launch\Instant Article Shuffler.lnk
[2011/04/06 18:43:02 | 000,001,825 | —- | M] () – C:\Users\Jai\Application Data\Microsoft\Internet Explorer\Quick Launch\Instant Article Spinner.lnk
[2011/04/06 18:43:02 | 000,001,815 | —- | M] () – C:\Users\Public\Desktop\Instant Article Submitter.lnk
[2011/04/06 18:43:02 | 000,001,808 | —- | M] () – C:\Users\Public\Desktop\Instant Article Shuffler.lnk
[2011/04/06 18:43:02 | 000,001,801 | —- | M] () – C:\Users\Public\Desktop\Instant Article Spinner.lnk
[2011/04/06 00:35:50 | 000,075,410 | —- | M] () – C:\Users\Jai\Desktop\WP-Simplicity-Add-Posts.zip
[2011/04/06 00:35:40 | 000,047,254 | —- | M] () – C:\Users\Jai\Desktop\WP-Simplicity.zip
[2011/04/03 03:24:00 | 000,000,454 | —- | M] () – C:\Windows\tasks\Driver Robot.job
[2011/03/26 21:41:04 | 000,032,471 | —- | M] () – C:\Users\Jai\Documents\90secondwebsitebuilder-AN-125x125.gif
[2011/03/25 01:54:28 | 001,980,668 | —- | M] () – C:\Users\Jai\Desktop\TrafficEruption.pdf
[2011/03/24 01:46:48 | 000,001,728 | —- | M] () – C:\Users\Jai\Documents\Mozilla Firefox (2).lnk

========== Files Created - No Company Name ==========

[2011/04/22 11:10:35 | 003,273,788 | —- | C] () – C:\Users\Jai\Desktop\01-FastAttackSEO-MainGuide.pdf
[2011/04/19 12:44:54 | 1063,575,552 | -HS- | C] () – C:\hiberfil.sys
[2011/04/17 07:26:50 | 000,000,125 | —- | C] () – C:\Users\Jai\Documents\.gemrc
[2011/04/17 07:26:50 | 000,000,000 | —- | C] () – C:\Users\Jai\Documents\access-logs
[2011/04/17 07:26:49 | 000,000,049 | —- | C] () – C:\Users\Jai\Documents\.[removed]
[2011/04/17 07:26:49 | 000,000,020 | —- | C] () – C:\Users\Jai\Documents\.contactemail
[2011/04/17 07:26:49 | 000,000,001 | —- | C] () – C:\Users\Jai\Documents\cpbackup-exclude.conf
[2011/04/17 07:26:48 | 000,000,047 | —- | C] () – C:\Users\Jai\Documents\.my.cnf
[2011/04/17 07:26:48 | 000,000,014 | —- | C] () – C:\Users\Jai\Documents\.ftpquota
[2011/04/17 07:26:48 | 000,000,011 | —- | C] () – C:\Users\Jai\Documents\.lastlogin
[2011/04/17 07:26:46 | 010,505,379 | —- | C] () – C:\Users\Jai\Documents\backup-6.17.2010_15-58-27_jai1985.tar.gz
[2011/04/16 22:50:15 | 006,133,976 | R— | C] () – C:\Users\Jai\Desktop\jai1985_wp1_wp_20110329_958.sql.gz
[2011/04/16 22:18:41 | 000,550,574 | —- | C] () – C:\Users\Jai\Desktop\01-NicheKeywordGoldmine-vol2.ods
[2011/04/16 22:18:41 | 000,123,556 | —- | C] () – C:\Users\Jai\Desktop\02-NicheKeywordGoldmine-vol2-Bonus.ods
[2011/04/16 22:18:08 | 001,961,913 | —- | C] () – C:\Users\Jai\Desktop\internet_marketings_biggest_secret_new.pdf
[2011/04/16 22:16:03 | 086,259,433 | —- | C] () – C:\Users\Jai\Desktop\jai1985_wp1_wp_20110329_958.sql
[2011/04/16 22:13:38 | 000,000,818 | —- | C] () – C:\Users\Public\Desktop\WinRAR.lnk
[2011/04/16 16:27:56 | 007,291,017 | —- | C] () – C:\Users\Jai\Desktop\quickstartguide.pdf
[2011/04/16 02:16:31 | 000,000,000 | RHS- | C] () – C:\MSDOS.SYS
[2011/04/16 02:16:31 | 000,000,000 | RHS- | C] () – C:\IO.SYS
[2011/04/16 00:41:04 | 000,000,269 | —- | C] () – C:\Users\Jai\Desktop\rss_button.php.png
[2011/04/15 19:08:17 | 000,001,002 | —- | C] () – C:\Users\Jai\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2011/04/15 16:47:20 | 000,001,728 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/04/14 10:53:21 | 000,348,950 | —- | C] () – C:\Users\Jai\Desktop\HowToTransferAWordpressBlog.pdf
[2011/04/14 09:42:39 | 000,262,923 | —- | C] () – C:\Users\Jai\Desktop\ProductReviewReportX_ku53z4liz8.pdf
[2011/04/14 09:42:04 | 001,961,913 | —- | C] () – C:\Users\Jai\Desktop\im_biggest_secret_new.pdf
[2011/04/14 09:37:27 | 001,967,100 | —- | C] () – C:\Users\Jai\Desktop\internet_marketings_biggest_secret.pdf
[2011/04/13 09:46:01 | 082,610,235 | —- | C] () – C:\Users\Jai\Desktop\UsingBannerAds(2).zip
[2011/04/13 09:45:55 | 073,521,080 | —- | C] () – C:\Users\Jai\Desktop\UsingAdsensePlugin(2).zip
[2011/04/13 09:45:21 | 000,296,814 | —- | C] () – C:\Users\Jai\Desktop\SSP1.0.4.0.rar
[2011/04/13 09:44:41 | 001,680,021 | —- | C] () – C:\Users\Jai\Desktop\PowerEffectsV2.zip
[2011/04/13 09:43:21 | 052,307,803 | —- | C] () – C:\Users\Jai\Desktop\MoneyMakingReviewBlogVids5-6.zip
[2011/04/13 09:42:21 | 000,006,226 | —- | C] () – C:\Users\Jai\Desktop\jvpress-gopages(3).zip
[2011/04/13 09:41:56 | 000,129,412 | —- | C] () – C:\Users\Jai\Desktop\guide.pdf
[2011/04/13 09:41:38 | 103,567,232 | —- | C] () – C:\Users\Jai\Desktop\free-traffic-webinar.zip
[2011/04/08 19:17:42 | 002,293,136 | —- | C] () – C:\Users\Jai\Documents\TrafficInflux2.0.pdf
[2011/04/06 18:43:02 | 000,001,839 | —- | C] () – C:\Users\Jai\Application Data\Microsoft\Internet Explorer\Quick Launch\Instant Article Submitter.lnk
[2011/04/06 18:43:02 | 000,001,832 | —- | C] () – C:\Users\Jai\Application Data\Microsoft\Internet Explorer\Quick Launch\Instant Article Shuffler.lnk
[2011/04/06 18:43:02 | 000,001,825 | —- | C] () – C:\Users\Jai\Application Data\Microsoft\Internet Explorer\Quick Launch\Instant Article Spinner.lnk
[2011/04/06 18:43:02 | 000,001,815 | —- | C] () – C:\Users\Public\Desktop\Instant Article Submitter.lnk
[2011/04/06 18:43:02 | 000,001,808 | —- | C] () – C:\Users\Public\Desktop\Instant Article Shuffler.lnk
[2011/04/06 18:43:02 | 000,001,801 | —- | C] () – C:\Users\Public\Desktop\Instant Article Spinner.lnk
[2011/04/06 18:34:53 | 000,000,680 | —- | C] () – C:\Users\Jai\AppData\Local\d3d9caps.dat
[2011/04/06 00:35:50 | 000,075,410 | —- | C] () – C:\Users\Jai\Desktop\WP-Simplicity-Add-Posts.zip
[2011/04/06 00:35:40 | 000,047,254 | —- | C] () – C:\Users\Jai\Desktop\WP-Simplicity.zip
[2011/04/05 16:01:11 | 000,000,372 | —- | C] () – C:\Windows\tasks\PC Health Advisor Defrag.job
[2011/04/01 20:10:25 | 000,000,328 | —- | C] () – C:\Windows\tasks\RegistryBooster.job
[2011/03/31 23:28:06 | 000,477,003 | —- | C] () – C:\Users\Jai\Documents\wpcommissions (2).zip
[2011/03/31 23:28:06 | 000,015,078 | —- | C] () – C:\Users\Jai\Desktop\wpcommissions.zip
[2011/03/26 21:40:52 | 000,032,471 | —- | C] () – C:\Users\Jai\Documents\90secondwebsitebuilder-AN-125x125.gif
[2011/03/25 01:54:28 | 001,980,668 | —- | C] () – C:\Users\Jai\Desktop\TrafficEruption.pdf
[2011/03/24 23:55:01 | 000,001,789 | —- | C] () – C:\Users\Public\Desktop\FileZilla Client.lnk
[2011/03/24 01:46:48 | 000,001,728 | —- | C] () – C:\Users\Jai\Documents\Mozilla Firefox (2).lnk
[2011/02/10 20:46:06 | 000,202,121 | —- | C] () – C:\Windows\XHeader Uninstaller.exe
[2011/01/30 17:33:04 | 000,000,098 | —- | C] () – C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2010/10/23 00:11:03 | 000,028,642 | —- | C] () – C:\Users\Jai\AppData\Roaming\UserTile.png
[2010/08/24 13:22:38 | 000,016,968 | —- | C] () – C:\Windows\System32\drivers\hitmanpro35.sys
[2010/08/12 20:10:37 | 000,000,132 | —- | C] () – C:\Windows\System32\rezumatenoi.dat
[2010/07/19 23:36:01 | 000,120,200 | —- | C] () – C:\Windows\System32\DLLDEV32i.dll
[2010/07/19 23:35:28 | 000,006,211 | —- | C] () – C:\Windows\mgxoschk.ini
[2010/07/18 15:38:59 | 000,000,918 | —- | C] () – C:\Windows\hpomdl40.dat.temp
[2010/07/15 12:25:26 | 000,208,236 | —- | C] () – C:\Windows\hpoins40.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\wsbl.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\phar_unmip.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\phar_histprot.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\ph_white.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\ph_summ.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\ph_black.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pcwords2.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pcwords.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_webproxy.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_video.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_tabloids.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_socialnetworks.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_searchengines.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_regionaltlds.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_pornography.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_onlineshop.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_onlinepay.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_onlinedating.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_news.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_im.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_illegal.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_hate.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_games.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_gambling.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_drugs.dat
[2010/04/13 14:50:40 | 000,000,025 | —- | C] () – C:\Users\Jai\AppData\Roaming\bdfvconp.ini
[2010/04/13 13:58:15 | 000,000,016 | —- | C] () – C:\Windows\System32\asdict.dat
[2010/04/13 13:58:15 | 000,000,004 | —- | C] () – C:\Windows\System32\aspdict-en.dat
[2010/04/13 12:52:43 | 000,176,128 | —- | C] () – C:\Windows\System32\msiscan.exe
[2010/02/19 21:23:20 | 000,203,776 | -HS- | C] () – C:\Windows\System32\unrar.exe
[2010/02/02 23:07:17 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\eYe6r.vbs
[2010/02/02 20:33:53 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\Pg4QCyX.vbs
[2010/02/02 16:33:56 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\5R1NaEfBc9oNqAH.vbs
[2010/02/01 20:45:55 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\fBC66.vbs
[2010/02/01 17:37:24 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\udDIEVFtuYtqRY9.vbs
[2010/01/30 21:14:46 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\yWPYBdZMgMqqMjL.vbs
[2010/01/30 14:59:38 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\BsmPF.vbs
[2010/01/30 00:59:46 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\oWjHYUFx7tolNAl.vbs
[2010/01/29 21:17:13 | 000,000,918 | —- | C] () – C:\Windows\hpomdl40.dat
[2010/01/29 20:57:54 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\M7CeIO6TtFtLh.vbs
[2010/01/29 20:40:13 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\iLQd5Ebv2mba41F.vbs
[2010/01/29 16:23:52 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\IGZVJ01xLJpg1.vbs
[2010/01/29 15:51:39 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\m7tnMRFXtrMl1.vbs
[2010/01/28 22:34:48 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\Q4tGw1O.vbs
[2010/01/28 18:05:07 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\deQAGjPZwkitJr1.vbs
[2010/01/27 16:05:11 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\ByJvu.vbs
[2010/01/26 22:36:34 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\s9iZT.vbs
[2010/01/26 21:02:55 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\VzWH5kctq2GyGcL.vbs
[2010/01/26 19:46:46 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\wKGQ2.vbs
[2010/01/25 16:07:35 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\2s4eE.vbs
[2010/01/24 18:55:53 | 000,000,191 | —- | C] () – C:\Users\Jai\AppData\Roaming\44050abe
[2010/01/24 14:02:46 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\5rdPE.vbs
[2010/01/24 00:39:39 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\pGMoov8UIqHbH.vbs
[2009/12/20 02:11:16 | 000,000,020 | —- | C] () – C:\Windows\prefs_zb.dll
[2009/12/18 01:25:18 | 000,110,592 | —- | C] () – C:\Windows\System32\FsUsbExDevice.Dll
[2009/12/18 01:25:18 | 000,036,608 | —- | C] () – C:\Windows\System32\FsUsbExDisk.Sys
[2009/12/18 00:31:07 | 000,203,264 | —- | C] () – C:\ProgramData\swscale-0.dll
[2009/12/18 00:31:07 | 000,028,672 | —- | C] () – C:\ProgramData\avutil-49.dll
[2009/12/18 00:30:56 | 007,876,608 | —- | C] () – C:\ProgramData\avcodec-51.dll
[2009/12/18 00:30:55 | 000,555,520 | —- | C] () – C:\ProgramData\avformat-51.dll
[2009/11/09 03:08:10 | 000,974,848 | —- | C] () – C:\Windows\System32\cis-2.4.dll
[2009/11/09 03:08:10 | 000,081,920 | —- | C] () – C:\Windows\System32\issacapi_bs-2.3.dll
[2009/11/09 03:08:10 | 000,065,536 | —- | C] () – C:\Windows\System32\issacapi_pe-2.3.dll
[2009/11/09 03:08:10 | 000,057,344 | —- | C] () – C:\Windows\System32\issacapi_se-2.3.dll
[2009/09/04 18:02:47 | 000,000,097 | —- | C] () – C:\Windows\System32\PICSDK.ini
[2009/09/04 18:02:46 | 000,111,932 | —- | C] () – C:\Windows\System32\EPPICPrinterDB.dat
[2009/09/04 18:02:46 | 000,031,053 | —- | C] () – C:\Windows\System32\EPPICPattern131.dat
[2009/09/04 18:02:46 | 000,027,417 | —- | C] () – C:\Windows\System32\EPPICPattern121.dat
[2009/09/04 18:02:46 | 000,026,154 | —- | C] () – C:\Windows\System32\EPPICPattern1.dat
[2009/09/04 18:02:46 | 000,024,903 | —- | C] () – C:\Windows\System32\EPPICPattern3.dat
[2009/09/04 18:02:46 | 000,021,390 | —- | C] () – C:\Windows\System32\EPPICPattern5.dat
[2009/09/04 18:02:46 | 000,020,148 | —- | C] () – C:\Windows\System32\EPPICPattern2.dat
[2009/09/04 18:02:46 | 000,011,811 | —- | C] () – C:\Windows\System32\EPPICPattern4.dat
[2009/09/04 18:02:46 | 000,004,943 | —- | C] () – C:\Windows\System32\EPPICPattern6.dat
[2009/09/04 18:02:46 | 000,001,146 | —- | C] () – C:\Windows\System32\EPPICPresetData_DU.dat
[2009/09/04 18:02:46 | 000,001,139 | —- | C] () – C:\Windows\System32\EPPICPresetData_PT.dat
[2009/09/04 18:02:46 | 000,001,139 | —- | C] () – C:\Windows\System32\EPPICPresetData_BP.dat
[2009/09/04 18:02:46 | 000,001,136 | —- | C] () – C:\Windows\System32\EPPICPresetData_ES.dat
[2009/09/04 18:02:46 | 000,001,129 | —- | C] () – C:\Windows\System32\EPPICPresetData_FR.dat
[2009/09/04 18:02:46 | 000,001,129 | —- | C] () – C:\Windows\System32\EPPICPresetData_CF.dat
[2009/09/04 18:02:46 | 000,001,120 | —- | C] () – C:\Windows\System32\EPPICPresetData_IT.dat
[2009/09/04 18:02:46 | 000,001,107 | —- | C] () – C:\Windows\System32\EPPICPresetData_GE.dat
[2009/09/04 18:02:46 | 000,001,104 | —- | C] () – C:\Windows\System32\EPPICPresetData_EN.dat
[2009/08/26 18:04:44 | 000,000,000 | —- | C] () – C:\Users\Jai\AppData\Roaming\wklnhst.dat
[2009/08/11 08:22:31 | 000,000,121 | —- | C] () – C:\Windows\bdagent.INI
[2009/08/11 02:43:55 | 000,081,984 | —- | C] () – C:\Windows\System32\bdod.bin
[2009/08/11 00:43:32 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/08/11 00:43:31 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/08/06 11:03:50 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/07/31 21:17:55 | 000,074,240 | —- | C] () – C:\Users\Jai\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/07/29 20:14:06 | 000,000,044 | —- | C] () – C:\Windows\Acer(Normal).ini
[2009/07/29 20:14:06 | 000,000,042 | —- | C] () – C:\Windows\Acer(Wide).ini
[2009/07/29 19:46:47 | 000,016,384 | —- | C] () – C:\Windows\System32\LauncheRyAgentUser.exe
[2009/07/20 21:17:58 | 000,122,880 | —- | C] () – C:\Windows\System32\AitVirtualComInstall.exe
[2009/07/20 21:10:48 | 000,307,200 | —- | C] () – C:\Windows\System32\InstallVCOM.exe
[2009/01/15 13:45:34 | 000,181,248 | —- | C] () – C:\Windows\System32\txmlutil.dll
[2008/05/04 18:39:34 | 000,002,560 | —- | C] () – C:\Windows\System32\ViaClassCoInstaller.dll
[2008/02/12 03:55:18 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1437.dll
[2008/02/12 03:34:48 | 002,215,364 | —- | C] () – C:\Windows\System32\igklg400.bin
[2008/02/12 03:34:48 | 001,971,732 | —- | C] () – C:\Windows\System32\igklg450.bin
[2008/02/12 03:34:48 | 000,029,932 | —- | C] () – C:\Windows\System32\igmedcompkrn.bin
[2007/12/27 13:14:25 | 000,020,480 | —- | C] () – C:\Windows\System32\PosTickerLib.dll
[2007/10/25 18:26:10 | 000,005,632 | —- | C] () – C:\Windows\System32\drivers\StarOpen.sys
[2007/08/16 03:39:17 | 000,001,024 | RH– | C] () – C:\Windows\System32\NTIBUN4.dll
[2007/08/16 02:50:04 | 000,331,776 | —- | C] () – C:\Windows\System32\ScrollBarLib.dll
[2007/08/16 01:53:36 | 000,000,707 | —- | C] () – C:\Windows\generic.ini
[2007/08/16 01:53:36 | 000,000,107 | —- | C] () – C:\Windows\Alaunch.ini
[2007/08/16 01:53:35 | 000,910,464 | —- | C] () – C:\Windows\System32\igmedkrn.dll
[2007/08/16 01:53:35 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v1283.dll
[2007/08/16 01:53:34 | 000,003,072 | —- | C] () – C:\Windows\System32\34CoInstaller.dll
[2007/04/26 00:33:22 | 000,266,240 | —- | C] () – C:\Windows\System32\NotesExtmngr.dll
[2007/04/26 00:32:50 | 000,204,800 | —- | C] () – C:\Windows\System32\NotesActnMenu.dll
[2007/04/26 00:32:46 | 000,086,016 | —- | C] () – C:\Windows\System32\MSNSpook.dll
[2007/04/26 00:31:00 | 000,028,672 | —- | C] () – C:\Windows\System32\BatchCrypto.dll
[2007/04/26 00:30:52 | 000,073,728 | —- | C] () – C:\Windows\System32\APISlice.dll
[2007/04/26 00:30:44 | 000,063,488 | —- | C] () – C:\Windows\System32\ShowErrMsg.dll
[2007/01/31 14:50:32 | 000,913,408 | —- | C] () – C:\Windows\System32\xreglib.dll
[2006/12/25 23:44:48 | 000,022,016 | —- | C] () – C:\Windows\System32\MailFormat_U.dll
[2006/11/13 13:50:06 | 000,071,680 | —- | C] () – C:\Windows\System32\HTCA_SelfExtract.bin
[2006/11/02 13:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 13:47:37 | 000,326,528 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:33:01 | 000,644,576 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 11:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 11:33:01 | 000,124,378 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 11:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 11:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 09:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 09:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 08:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/06/23 18:09:34 | 000,019,968 | R— | C] () – C:\Windows\System32\cpuinf32.dll
[2001/12/27 00:12:30 | 000,065,536 | —- | C] () – C:\Windows\System32\multiplex_vcd.dll
[2001/09/04 07:46:38 | 000,110,592 | —- | C] () – C:\Windows\System32\Hmpg12.dll
[2001/07/31 00:33:56 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC.dll
[2001/07/24 06:04:36 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC_MMX.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:D1B5B4F1

< End of report >
Post #3
Hi hear is the OTL Extras - Scan Results ::: OTL Extras logfile created on: 22/04/2011 12:08:59 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Jai\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19048)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,014.00 Mb Total Physical Memory | 152.00 Mb Available Physical Memory | 15.00% Memory free
3.00 Gb Paging File | 1.00 Gb Available in Paging File | 33.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111.69 Gb Total Space | 35.44 Gb Free Space | 31.73% Space Free | Partition Type: NTFS
Drive D: | 111.43 Gb Total Space | 94.05 Gb Free Space | 84.40% Space Free | Partition Type: NTFS

Computer Name: MEDIA-PC | User Name: Jai | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – C:\Program Files\ParetoLogic\FileCure\FileCure_noapp.exe %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3945554959-725833480-59139298-1001]
"EnableNotifications" = 1
"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02F77B27-561C-47A3-A4C4-58A576763C71}" = lport=2869 | protocol=6 | dir=in | app=system |
"{0D1E6E0F-D7D7-4E9D-A0D2-65EC27C4A9CF}" = rport=137 | protocol=17 | dir=out | app=system |
"{165110FB-C553-4859-94BF-D2BC6A921AAA}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{16DABF78-628C-416F-A055-4D1BCD85C2ED}" = rport=10243 | protocol=6 | dir=out | app=system |
"{3A5A1814-27C0-4274-8967-E9106BAB71C3}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3F0D7F46-E859-48BE-BB03-3DAE50176F0B}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{405A839A-F379-42B7-B3F6-605C5311BAA4}" = rport=138 | protocol=17 | dir=out | app=system |
"{657FD5DC-C4A0-49F9-B6BC-59D86CB71057}" = lport=137 | protocol=17 | dir=in | app=system |
"{68838CD4-A344-46D7-A522-BF598EC0044C}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7D85750A-8D0D-42CC-B772-9534C598A64E}" = rport=139 | protocol=6 | dir=out | app=system |
"{84E94D36-DC27-498E-BE6C-15A61CCD6E1B}" = lport=1900 | protocol=17 | dir=in | name=intel® viiv™ media server upnp discovery |
"{85BD9B6F-C8E4-49EF-AA2E-7C8BC69E743C}" = lport=138 | protocol=17 | dir=in | app=system |
"{8903B4C6-4E19-4598-BA43-2EB5D6AFFF18}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8A21F3F7-A1BE-4FCA-8DBE-9736C32D4301}" = lport=10243 | protocol=6 | dir=in | app=system |
"{8A56F176-38E3-43DC-8FBF-4CBA3E2F8853}" = lport=9442 | protocol=17 | dir=in | name=intel® viiv™ media server discovery |
"{9555951F-DF52-42A8-B3DA-8AE1A690E34A}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{97D86FA3-D770-41A1-B464-EB0FF397DCA8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{C8B1C73B-63F9-4302-962F-9B6363B84DD9}" = rport=427 | protocol=17 | dir=in | svc=hpslpsvc | app=c:\windows\system32\svchost.exe |
"{D0285658-0947-40A4-8AE6-02B82A4465D1}" = rport=445 | protocol=6 | dir=out | app=system |
"{E9C53840-FA40-4A5B-9C95-BB6F7C151CC0}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EF2B067A-678C-4541-9007-64ADE7FF66ED}" = lport=139 | protocol=6 | dir=in | app=system |
"{F5900EB5-2DBC-4911-9A21-476871A6AEAB}" = lport=445 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05DD27C3-5B7E-4F87-ABB4-448D939EE769}" = dir=in | app=c:\program files\acer arcade live\acer homemedia connect\kernel\dms\clmsserver.exe |
"{06CFA052-F9E8-4B4E-988F-E67F2D593FAD}" = protocol=6 | dir=out | app=system |
"{0B4BA3C1-6C57-49CD-8790-D4A76B980860}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{112A5505-0E3E-4A00-8E74-FDDCBAFC18E4}" = protocol=17 | dir=in | app=c:\users\jai\appdata\roaming\dropbox\bin\dropbox.exe |
"{1ADCEF70-CBFF-466D-AFBB-75E0661B1C37}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1BAEBA4A-FB3D-415F-BC9E-FF84B3A6097C}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{2218BE1B-DE9D-44CB-95AF-D7C069173A58}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe |
"{22D7EB11-4C39-44AF-A86E-30F41E946200}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{23198EDC-2F54-4FE2-946F-4CD41E9886EA}" = protocol=6 | dir=in | app=c:\program files\addthis toolbar\toolbarupdate.exe |
"{2E343D87-94A9-417B-A236-66FF86164E43}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe |
"{2FF604D5-65E3-4FC2-9C54-C94B7C25CBE3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{32C7DF5E-AC7E-448F-ACCE-92CFEC231BCF}" = protocol=6 | dir=in | app=c:\program files\addthis toolbar\troubleshooter.exe |
"{382FF1FF-74B1-4A20-B000-7A7B8B3D554F}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe |
"{3AC4FB62-2A88-46B2-A7AC-9612A7F12A5A}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\tshwmdtcp.exe |
"{3BD40E90-7A4B-45C6-A9B4-76A7466DA10D}" = dir=in | app=c:\program files\acer arcade live\acer slideshow dvd\acer slideshow dvd.exe |
"{3D824A4E-918B-47EA-BA66-0792109EC03F}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe |
"{3DD840E8-DA16-4C9E-B20F-9908161934E4}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\tshwmdtcp.exe |
"{446CF1CE-D71A-4E45-88DB-01DC302944A1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{477EF352-7C0B-4856-AC69-E0F2A6C2C738}" = protocol=17 | dir=in | app=c:\program files\addthis toolbar\troubleshooter.exe |
"{47BD0288-03DD-43A9-BC27-56703B372131}" = protocol=6 | dir=in | app=c:\users\jai\appdata\roaming\dropbox\bin\dropbox.exe |
"{4FA36BFE-F450-4CE3-AA7A-C4B725F98F7E}" = protocol=6 | dir=in | app=c:\program files\soluto\soluto.exe |
"{52924DDB-6F32-4EC1-8C78-798A9B10DE14}" = protocol=17 | dir=in | app=c:\program files\addthis toolbar\toolbarupdate.exe |
"{53388AF0-9CC7-4515-BBCF-F7F1680D79D0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{57163650-79C3-4701-A5B2-B6AE51A2B2E5}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe |
"{5753C735-F9DE-482F-99BC-FAB82CE22CC9}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe |
"{58507D20-4A8F-448C-80D0-5FA52FF05EBD}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe |
"{5990801C-73F0-44CC-B530-B831BB3C7206}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe |
"{5CEBC44C-FC92-4776-81FA-FDE953ABFC1D}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe |
"{5F31478C-A1B6-4ACC-9525-F910897320F0}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe |
"{5FEF965A-6A50-48D2-8541-D680B0D1416B}" = dir=in | app=e:\setup\hpznui01.exe |
"{609A3F1C-23CD-44DD-B599-0DFE836C4093}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6A9BA957-E207-4DE4-BB7F-69E62FAF9286}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe |
"{6FF3199A-36E0-484E-ACED-8E562F25A8D4}" = dir=in | app=c:\program files\acer arcade live\acer dv magician\acer dv magician.exe |
"{7177F581-4614-4E77-98DC-74BFC13EC06B}" = protocol=6 | dir=in | app=c:\users\jai\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{72883586-F614-420F-BE13-01D840A2E175}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{72AC1439-9558-4834-83F3-B1220AEAEE54}" = dir=in | app=c:\program files\acer arcade live\acer arcade live main page\acer arcade live.exe |
"{78E7717C-C12E-474A-93D9-3431FBC2EB5C}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe |
"{792C3911-B196-4936-8B08-BC5B425944D8}" = protocol=6 | dir=in | app=c:\program files\soluto\solutoconsole.exe |
"{7D9A6EAC-0CD9-4C7C-B7DE-CAAD3BF8E224}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{828F8D2E-D959-40F3-907D-D846C458CA56}" = dir=in | app=c:\program files\acer arcade live\acer tv share\acer tv share.exe |
"{85BE130B-69B9-434F-977B-D2E3F311BD73}" = protocol=6 | dir=in | app=%systemroot%\explorer.exe |
"{863F90E0-6C83-42AD-A2BD-77CDBD2FFC66}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe |
"{8751DEA0-27B4-4992-BF24-2F0A8CD50E11}" = dir=in | app=c:\program files\acer arcade live\acer dvdivine\acer dvdivine.exe |
"{897ECBB4-11ED-4673-BFC5-F3C0ADBF717B}" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"{8C1FB117-656A-4A9E-8254-0BD723200AB0}" = dir=in | app=c:\program files\acer arcade live\acer homemedia\acer homemedia.exe |
"{8F34E120-CC73-45BF-8349-94F29315F1A2}" = dir=in | app=c:\program files\acer arcade live\acer homemedia connect\acer homemedia connect.exe |
"{908EF462-AB9D-4E13-9259-82FBEE7A7BC8}" = dir=in | app=c:\program files\acer arcade live\acer tv share\kernel\dmstv\clmsserver.exe |
"{91C4A579-7ACB-4D80-8A37-071FBFCD2FC2}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\mediaserver.exe |
"{9867BA57-B1CA-4920-AD34-89E424C3CF29}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe |
"{9CD1ECDF-B01B-46D4-BC7A-F920A7437737}" = protocol=17 | dir=in | app=c:\program files\soluto\soluto.exe |
"{9EEB8C8B-99C7-4F54-AEF6-380EE6A6651D}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A0A3532E-A889-4938-ABBF-59D25B628B05}" = protocol=17 | dir=in | app=c:\program files\soluto\solutoservice.exe |
"{A0A48F34-E306-41FB-92A1-7E8C23494231}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A19FBC56-1E8F-4731-BA3C-68B5D7C1BE56}" = protocol=17 | dir=in | app=c:\program files\soluto\solutoupdateservice.exe |
"{A2C1F9BF-F231-4A00-85A9-D4339E06D247}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A741EF68-F30B-4572-A76F-DFF3F19BD25B}" = dir=in | app=c:\program files\acer arcade live\acer videomagician\acer videomagician.exe |
"{A86E6AAE-1230-45F5-8B06-40EBCB0D0BDE}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{B01847D7-401B-4886-B611-7970B4DC1260}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\mediaserver.exe |
"{B508D169-CA84-481B-AE55-9A341DF50BA0}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe |
"{B62165D7-7A34-4E59-8D59-E602D85F2B97}" = protocol=17 | dir=in | app=c:\program files\soluto\solutoconsole.exe |
"{BA2DA54F-6CF2-4D25-9666-5B01FA2B5B16}" = protocol=17 | dir=in | app=c:\users\jai\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{BA62D781-CC26-4550-8ADC-6BC694C411C5}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{C6E0235B-0639-41D6-A6C0-9FC67EE60175}" = protocol=6 | dir=in | app=c:\program files\soluto\solutoservice.exe |
"{CD8CCE93-A107-408E-9424-C60930DE5598}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\shells\remote ui service.exe |
"{D0C539DC-B2D6-4694-8A40-063016B41FA3}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{D592EB49-BEE1-4A45-8CFB-F1BB3D514C5F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D734E208-CBBD-4886-8D12-BF617C67EB68}" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"{D87A8BC1-E029-479F-9507-4B63CE992B68}" = protocol=6 | dir=out | app=%systemroot%\explorer.exe |
"{DA1F1E3C-9376-4BC7-83BD-535D290804E6}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{E2C187DB-5884-4DE8-9467-3A677DFE42BB}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{E60B0A51-04CD-4C25-8A2E-029439F88CE5}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe |
"{ED681D70-E3CF-4F11-9B3D-7604EE048F07}" = protocol=6 | dir=in | app=c:\program files\soluto\solutoupdateservice.exe |
"{ED904386-CB8D-4CE3-806C-64B3C2D89CB6}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe |
"{F66D12E7-0F19-4673-B028-6E2265D16FBC}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe |
"{FAC199C3-16BC-4158-B18A-FB3E74C2E8B5}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\shells\remote ui service.exe |
"{FAE9A7ED-CD02-494D-ABBC-23FB53222D6F}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe |
"{FDC24876-C6D2-408F-BACE-8B46B2191306}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"TCP Query User{052C7A76-99D2-4366-8032-6DF2404D12E6}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{90873209-8FA0-4577-B929-2E5E68CFB0AA}C:\program files\mobiledit!\webvideodownloader.exe" = protocol=6 | dir=in | app=c:\program files\mobiledit!\webvideodownloader.exe |
"TCP Query User{9BC10677-61A1-48C1-8A4D-0E639A6CD39A}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{F179B4B6-8E61-4097-9B1F-80C923CA4139}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{294276FD-8B7B-48A9-9639-18409F561D28}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{62328EC2-3915-447B-B222-459BE6B77CFB}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{80B9CD6C-5285-4256-8E7A-3E2B04133207}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{8940288B-C14E-4029-A7CC-F68E704650C6}C:\program files\mobiledit!\webvideodownloader.exe" = protocol=17 | dir=in | app=c:\program files\mobiledit!\webvideodownloader.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{005F78AF-110D-398A-8430-BE98950A1E22}" = Google Talk Plugin
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{097CDB1E-07C9-40F1-9972-F0F9F3A287E4}" = Network
"{0C297A75-3111-4B3F-9264-84D61FF79F0D}" = Acer TV Share
"{0DAA5653-60D4-44C1-AD10-EC7D4FA4D820}" = Intel® Viiv™ Software
"{105CFC7C-6992-11D5-BD9D-000102C10FD8}" = LizardTech DjVu Control
"{132888AE-EF67-41C5-BCA2-7D5D2488AB63}" = Acer HomeMedia Connect
"{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery
"{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{1598034D-7147-432C-8CA8-888E0632D124}" = NTI Backup NOW! 4.7
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1943A043-5C85-4A16-A0D0-D687B2C1A40F}" = VirtualCom driver
"{1BB744F5-793A-4F94-A019-4EFD792370B8}" = BlogBot
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 23
"{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox
"{2A697B53-0DE3-42DA-B41D-C3F804B1C538}" = iTunes
"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support
"{2FA41EBB-3F5A-35C3-85D6-51EC72A11FBD}" = Google Gears
"{2FB9EA69-51D4-4913-9AD5-762C034DE811}" = Status
"{34095DCB-8356-2DC3-0AF0-133EAB7CEB93}" = eLert Gadget
"{3515DF4C-3529-407E-A1E1-E2C0EDB36FF0}" = KwiClick
"{3B9D1BC9-B8FE-4CD8-945F-A72897E904B6}" = Soluto
"{3DA3F35E-32DB-47D2-9AF7-926460A05E30}" = MagicListBot
"{41581EF5-45A7-11DA-9D78-000129760D75}" = Acer SlideShow DVD
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{497A1721-088F-41EF-8876-B43C9DA5528B}" = ArcSoft Software Suite
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5DCF0E4B-F8EA-4229-A0BD-5CA6D4AFB749}" = SolutionCenter
"{60FFB3E0-6D5B-4D73-AE5B-07E58B83AF0C}" = 32 Bit HP CIO Components Installer
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{710EF1B0-0052-4628-87ED-57FA78CAC6BB}" = SoftwareSubmitterPro
"{7184F382-8A6C-4B85-A3AC-B63734B1E241}" = SAMSUNG Mobile USB Driver
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74DC0593-6BC6-4001-AD5F-D810AFB68D86}" = HP Update
"{7655E113-C306-11D9-A373-0050BAE317E1}" = MCE Software Encoder 1.1
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11029123}" = Bricks of Egypt
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111263673}" = Treasures of the Deep
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111271497}" = Mystery Case Files - Prime Suspects
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}" = Galapago
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111473353}" = Dynasty
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11170417}" = Luxor 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111771833}" = Jewel Quest Solitaire
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112179547}" = MCF Ravenhearst
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{85E563C7-E45B-47AA-BF6D-34983C2BEEF8}" = BitDefender Total Security 2010
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8E0E6383-9754-4471-939E-E4ABE02E3440}" = InstallIQ Updater
"{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90024193-9F13-4877-89D5-A1CDF0CBBF28}" = Feedback Tool
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{94389919-B0AA-4882-9BE8-9F0B004ECA35}" = Acer Tour
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A9DBEBC-C800-4776-A970-D76D6AA405B1}" = PHOTOfunSTUDIO -viewer-
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA4BF92B-2AAF-11DA-9D78-000129760D75}" = Acer HomeMedia
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}" = HPSSupply
"{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X (10.0.1)
"{AEEAE013-92F1-4515-B278-139F1A692A36}" = Acer eDataSecurity Management
"{B145EC69-66F5-11D8-9D75-000129760D75}" = Acer DVDivine
"{B2DAB009-8236-48A0-AD7F-E940F5AB1578}" = HP Photosmart Plus B209a-m All-in-One Driver Software 14.0 Rel. 6
"{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C619A1DC-8EE4-4BD2-82AB-D9424A23E42A}" = Auto Blog Samurai
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp
"{CDC8DBA8-37FF-4C82-84FF-DEBEDF93BEC4}" = PS_AIO_06_B209a-m_SW_Min
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D360FA88-17C8-4F14-B67F-13AAF9607B12}" = MarketResearch
"{D462BF9E-0C35-4705-BF9B-3DF9F3816643}" = Acer ePerformance Management
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"{D8CE69B0-9274-4b8c-BA49-0FF6A20A3C65}" = SAMSUNG SYMBIAN USB Download Driver
"{DDD2DBF1-CB97-481E-9589-41D9EE92B259}_is1" = Hard Cash Hijack Traffic Control 1.0
"{DEB38E1A-F4E5-4DF0-96F4-4050567A9D09}" = AV Input Selection
"{E517094C-06B6-419F-8FFD-EF4F57972130}" = QuickTransfer
"{E617721F-B66C-4D5A-AA2A-B2D60820CDC3}" = B209a-m
"{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}" = Acer Arcade Live Main Page
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F6EFFB76-4A07-11DA-9D78-000129760D75}" = Acer DV Magician
"{F79A208D-D929-11D9-9D77-000129760D75}" = Acer VideoMagician
"{F8131A35-47FD-27AD-116D-0E79AF5DE5EE}" = Acrobat.com
"{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm
"90_Second_Website_Builder" = 90 Second Website Builder 5.5
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"AddThis Toolbar" = AddThis Toolbar
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.9
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"E24870CB6AA1C3511635FF9020A3E9471287FBE7" = Windows Driver Package - MobileTop (sshpmdm) Modem (01/26/2008 2.6.0.0)
"eLertGadget.4E424E86CF86EBE29924D0FD908DE0A0B24C8950.1" = eLert Gadget
"FeedReader_is1" = FeedReader
"FileZilla Client" = FileZilla Client 3.4.0
"Flickr Uploadr" = Flickr Uploadr 3.2.1
"Google Updater" = Google Updater
"HDMI" = Intel® Graphics Media Accelerator Driver
"Heri's RSS Feed Buzz_is1" = Heri's RSS Feed Buzz v2.01
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Imaging Device Functions" = HP Imaging Device Functions 14.0
"HP Photo Creations" = HP Photo Creations
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0
"HPExtendedCapabilities" = HP Customer Participation Program 14.0
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"InstallShield_{1598034D-7147-432C-8CA8-888E0632D124}" = NTI Backup NOW! 4.7
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"Instant Article Suite_is1" = Instant Article Suite v1.10
"Intel® Configuration Center" = Intel® Viiv™ Software
"Kernel for Exchange Server Evaluation ver_is1" = Kernel for Exchange Server Evaluation ver 10.08.01
"LastFM_is1" = Last.fm 1.5.4.24567
"Magic Pop-Up" = Magic Pop-Up 1.0
"MAGIX Slideshow Maker US" = MAGIX Slideshow Maker 1.0.1.3 (US)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"MozBackup" = MozBackup 1.4.10
"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)
"Picasa 3" = Picasa 3
"PriceGong" = PriceGong 2.2.0
"PROSet" = Intel® PRO Network Connections Drivers
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Download Driver" = SAMSUNG Mobile USB Download Driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"Shop for HP Supplies" = Shop for HP Supplies
"StumbleUponIEToolbar" = StumbleUpon IE Toolbar
"Traffic Predator PRO by Clayne Keegan_is1" = Traffic Predator PRO by Clayne Keegan
"Tube Fool" = Tube Fool
"UltraISO_is1" = UltraISO Premium V9.33
"WinRAR archiver" = WinRAR 4.00 (32-bit)
"WinX DVD Ripper Platinum_is1" = WinX DVD Ripper Platinum 5.1.1
"XHeader" = XHeader
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Software Update" = Yahoo! Software Update
"YInstHelper" = Yahoo! Install Manager

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"GoToMeeting" = GoToMeeting 4.5.0.457
"LastPass" = LastPass (uninstall only)

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 21/04/2011 19:01:29 | Computer Name = MEDIA-PC | Source = MySQL | ID = 100
Description = Can't find messagefile 'c:\wamp\bin\mysql\mysql5.1.36\share\english\errmsg.sys'

For
more information, see Help and Support Center at http://www.mysql.com.

Error - 21/04/2011 19:01:33 | Computer Name = MEDIA-PC | Source = MySQL | ID = 100
Description = Can't open the mysql.plugin table. Please run mysql_upgrade to create
it. For more information, see Help and Support Center at http://www.mysql.com.

Error - 21/04/2011 19:01:36 | Computer Name = MEDIA-PC | Source = MySQL | ID = 100
Description = Aborting For more information, see Help and Support Center at http://www.mysql.com.



Error - 21/04/2011 19:02:41 | Computer Name = MEDIA-PC | Source = MySQL | ID = 100
Description = Can't find messagefile 'c:\wamp\bin\mysql\mysql5.1.36\share\english\errmsg.sys'

For
more information, see Help and Support Center at http://www.mysql.com.

Error - 21/04/2011 19:02:48 | Computer Name = MEDIA-PC | Source = MySQL | ID = 100
Description = Can't open the mysql.plugin table. Please run mysql_upgrade to create
it. For more information, see Help and Support Center at http://www.mysql.com.

Error - 21/04/2011 19:02:52 | Computer Name = MEDIA-PC | Source = MySQL | ID = 100
Description = Aborting For more information, see Help and Support Center at http://www.mysql.com.



Error - 22/04/2011 05:08:50 | Computer Name = MEDIA-PC | Source = Application Error | ID = 1000
Description = Faulting application Explorer.EXE, version 6.0.6002.18005, time stamp
0x49e01da5, faulting module simppulltoolbar.dll, version 5.0.8.112, time stamp
0x4b5eb5ce, exception code 0xc0000005, fault offset 0x0001b725, process id 0x8d4,
application start time 0x01cc0056ee621913.

Error - 22/04/2011 05:33:33 | Computer Name = MEDIA-PC | Source = Application Hang | ID = 1002
Description = The program firefox.exe version 1.9.2.4095 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 5e8 Start Time: 01cc0057d33060b3 Termination Time: 28797

Error - 22/04/2011 05:33:37 | Computer Name = MEDIA-PC | Source = Application Error | ID = 1000
Description = Faulting application plugin-container.exe, version 1.9.2.4095, time
stamp 0x4d852c62, faulting module ntdll.dll, version 6.0.6002.18327, time stamp
0x4cb73436, exception code 0xc0000005, fault offset 0x00048822, process id 0x14f0,
application start time 0x01cc00581e70dfa3.

Error - 22/04/2011 07:09:55 | Computer Name = MEDIA-PC | Source = Application Hang | ID = 1002
Description = The program firefox.exe version 1.9.2.4095 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 1788 Start Time: 01cc00d07412b390 Termination Time: 60000

[ IntelDH Events ]
Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

[ Media Center Events ]
Error - 24/01/2011 10:27:43 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 01/24/2011 14:27:42. You may need to reschedule your recordings.

Error - 25/01/2011 10:13:42 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 01/25/2011 14:13:40. You may need to reschedule your recordings.

Error - 27/01/2011 10:40:56 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 01/27/2011 14:40:52. You may need to reschedule your recordings.

Error - 29/01/2011 15:18:04 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 01/29/2011 19:18:02. You may need to reschedule your recordings.

Error - 30/01/2011 14:30:43 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 01/30/2011 18:30:43. You may need to reschedule your recordings.

Error - 30/01/2011 14:30:46 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 01/30/2011 18:30:46. You may need to reschedule your recordings.

Error - 30/01/2011 19:18:05 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 01/30/2011 23:18:05. You may need to reschedule your recordings.

Error - 13/02/2011 17:36:41 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 02/13/2011 21:36:41. You may need to reschedule your recordings.

Error - 14/02/2011 21:58:15 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 02/15/2011 01:58:15. You may need to reschedule your recordings.

Error - 08/04/2011 06:49:17 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 04/08/2011 11:49:16. You may need to reschedule your recordings.

[ System Events ]
Error - 21/04/2011 18:53:59 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 21/04/2011 18:55:15 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 21/04/2011 18:56:29 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 21/04/2011 18:57:43 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 21/04/2011 18:59:01 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 21/04/2011 19:00:25 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 21/04/2011 19:01:38 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 21/04/2011 19:02:59 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 22/04/2011 04:55:46 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7009
Description =

Error - 22/04/2011 04:55:46 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7000
Description =


< End of report >
Post #4
Hi hear is the OTL File Age 90 Days - Scan Results ::: OTL logfile created on: 22/04/2011 12:57:11 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Jai\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19048)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,014.00 Mb Total Physical Memory | 218.00 Mb Available Physical Memory | 21.00% Memory free
3.00 Gb Paging File | 1.00 Gb Available in Paging File | 43.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111.69 Gb Total Space | 35.14 Gb Free Space | 31.47% Space Free | Partition Type: NTFS
Drive D: | 111.43 Gb Total Space | 94.05 Gb Free Space | 84.40% Space Free | Partition Type: NTFS

Computer Name: MEDIA-PC | User Name: Jai | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 90 Days

========== Processes (All) ==========

PRC - [2011/04/22 12:05:30 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\Jai\Downloads\OTL.exe
PRC - [2011/04/04 10:21:56 | 001,165,824 | —- | M] (W3i, LLC) – C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe
PRC - [2011/03/15 20:36:59 | 001,191,368 | —- | M] (BitDefender S.R.L.) – C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe
PRC - [2011/03/08 12:50:10 | 000,310,856 | —- | M] (BitDefender S.R.L.) – C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
PRC - [2011/03/07 16:33:40 | 000,421,160 | —- | M] (Apple Inc.) – C:\Program Files\iTunes\iTunesHelper.exe
PRC - [2011/03/07 16:33:34 | 000,820,520 | —- | M] (Apple Inc.) – C:\Program Files\iPod\bin\iPodService.exe
PRC - [2011/02/22 05:43:04 | 000,013,312 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
PRC - [2011/02/18 17:37:16 | 000,037,664 | —- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/11/04 17:34:06 | 000,171,520 | —- | M] (Microsoft Corporation) – C:\Windows\System32\taskeng.exe
PRC - [2010/08/12 19:47:44 | 001,615,688 | —- | M] (BitDefender S.R.L.) – C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe
PRC - [2010/08/12 19:47:04 | 001,506,048 | —- | M] (BitDefender S.R.L.) – C:\Program Files\BitDefender\BitDefender 2010\uiscan.exe
PRC - [2010/08/12 19:46:00 | 001,091,984 | —- | M] (BitDefender S.R.L.) – C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe
PRC - [2010/02/26 06:10:20 | 021,979,992 | —- | M] () – C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2009/11/25 12:00:34 | 000,095,568 | —- | M] (Devguru Co., Ltd.) – C:\Windows\System32\dgdersvc.exe
PRC - [2009/09/10 18:14:18 | 000,238,952 | —- | M] (Teruten) – C:\Windows\System32\FsUsbExService.Exe
PRC - [2009/08/07 03:24:04 | 000,053,472 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wuauclt.exe
PRC - [2009/06/15 13:48:49 | 000,009,728 | —- | M] (Microsoft Corporation) – C:\Windows\System32\lsass.exe
PRC - [2009/06/03 21:52:26 | 000,120,168 | —- | M] (stumbleupon.com) – C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe
PRC - [2009/06/02 12:36:55 | 000,825,152 | R— | M] (SAC) – C:\ProgramData\OfficeGuardian\reminder\SacReminder.exe
PRC - [2009/04/11 07:28:15 | 000,247,296 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wbem\WmiPrvSE.exe
PRC - [2009/04/11 07:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) – C:\Windows\System32\winlogon.exe
PRC - [2009/04/11 07:28:08 | 000,037,888 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wbem\unsecapp.exe
PRC - [2009/04/11 07:28:07 | 000,039,424 | —- | M] (Microsoft Corporation) – C:\Windows\servicing\TrustedInstaller.exe
PRC - [2009/04/11 07:28:04 | 000,064,000 | —- | M] (Microsoft Corporation) – C:\Windows\System32\smss.exe
PRC - [2009/04/11 07:28:03 | 001,233,920 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Sidebar\sidebar.exe
PRC - [2009/04/11 07:27:59 | 000,441,344 | —- | M] (Microsoft Corporation) – C:\Windows\System32\SearchIndexer.exe
PRC - [2009/04/11 07:27:59 | 000,279,552 | —- | M] (Microsoft Corporation) – C:\Windows\System32\services.exe
PRC - [2009/04/11 07:27:59 | 000,185,344 | —- | M] (Microsoft Corporation) – C:\Windows\System32\SearchProtocolHost.exe
PRC - [2009/04/11 07:27:58 | 000,087,552 | —- | M] (Microsoft Corporation) – C:\Windows\System32\SearchFilterHost.exe
PRC - [2009/04/11 07:27:49 | 003,408,896 | —- | M] (Microsoft Corporation) – C:\Windows\System32\SLsvc.exe
PRC - [2009/04/11 07:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2009/04/11 07:27:33 | 000,081,920 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dwm.exe
PRC - [2009/02/18 19:39:20 | 000,043,904 | —- | M] (Microsoft Corporation) – C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
PRC - [2008/02/12 04:13:10 | 000,256,536 | —- | M] (Intel Corporation) – C:\Windows\System32\igfxsrvc.exe
PRC - [2008/02/12 04:13:08 | 000,133,656 | —- | M] (Intel Corporation) – C:\Windows\System32\igfxpers.exe
PRC - [2008/01/19 08:38:32 | 000,319,544 | —- | M] (Microsoft Corporation) – c:\Program Files\Windows Defender\MpCmdRun.exe
PRC - [2008/01/19 08:33:40 | 000,142,336 | —- | M] (Microsoft Corporation) – C:\Windows\System32\WUDFHost.exe
PRC - [2008/01/19 08:33:39 | 000,896,512 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Media Player\wmpnetwk.exe
PRC - [2008/01/19 08:33:37 | 000,096,768 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wininit.exe
PRC - [2008/01/19 08:33:32 | 000,021,504 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2008/01/19 08:33:32 | 000,021,504 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2008/01/19 08:33:32 | 000,021,504 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2008/01/19 08:33:32 | 000,021,504 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2008/01/19 08:33:32 | 000,021,504 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2008/01/19 08:33:32 | 000,021,504 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2008/01/19 08:33:32 | 000,021,504 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2008/01/19 08:33:32 | 000,021,504 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2008/01/19 08:33:32 | 000,021,504 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2008/01/19 08:33:32 | 000,021,504 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2008/01/19 08:33:32 | 000,021,504 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2008/01/19 08:33:32 | 000,021,504 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2008/01/19 08:33:32 | 000,021,504 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2008/01/19 08:33:32 | 000,021,504 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2008/01/19 08:33:32 | 000,021,504 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2008/01/19 08:33:32 | 000,021,504 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2008/01/19 08:33:23 | 000,020,480 | —- | M] (Microsoft Corporation) – C:\Windows\System32\RacAgent.exe
PRC - [2008/01/19 08:33:15 | 000,095,744 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mobsync.exe
PRC - [2008/01/19 08:33:14 | 000,229,888 | —- | M] (Microsoft Corporation) – C:\Windows\System32\lsm.exe
PRC - [2008/01/19 08:33:09 | 000,292,352 | —- | M] (Microsoft Corporation) – C:\Windows\ehome\ehrecvr.exe
PRC - [2008/01/19 08:33:05 | 000,006,144 | —- | M] (Microsoft Corporation) – C:\Windows\System32\csrss.exe
PRC - [2007/08/01 00:25:48 | 000,326,176 | —- | M] () – C:\Acer\Empowering Technology\SysMonitor.exe
PRC - [2007/07/03 18:40:10 | 000,053,248 | —- | M] (Acer Inc.) – C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
PRC - [2007/06/22 02:33:20 | 000,269,448 | —- | M] (CyberLink) – C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
PRC - [2007/06/21 07:04:40 | 000,269,432 | —- | M] (CyberLink) – C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe
PRC - [2007/04/06 22:10:56 | 000,223,704 | —- | M] (Intel® Corporation) – C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
PRC - [2007/04/06 22:07:42 | 000,439,768 | —- | M] (Intel Corporation) – C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
PRC - [2007/02/12 18:46:34 | 000,208,896 | —- | M] () – C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
PRC - [2006/11/02 13:35:29 | 000,131,072 | —- | M] (Microsoft Corporation) – C:\Windows\ehome\ehsched.exe


========== Modules (All) ==========

MOD - [2011/04/22 12:05:30 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\Jai\Downloads\OTL.exe
MOD - [2011/04/01 12:33:44 | 000,232,968 | —- | M] (BitDefender S.R.L. Bucharest, ROMANIA) – C:\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_88\midas32.dll
MOD - [2011/02/22 07:21:17 | 001,210,880 | —- | M] (Microsoft Corporation) – C:\Windows\System32\urlmon.dll
MOD - [2011/02/22 07:16:40 | 001,991,680 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iertutil.dll
MOD - [2011/01/21 17:35:22 | 011,586,048 | —- | M] (Microsoft Corporation) – C:\Windows\System32\shell32.dll
MOD - [2011/01/21 17:35:22 | 000,353,280 | —- | M] (Microsoft Corporation) – C:\Windows\System32\shlwapi.dll
MOD - [2011/01/20 17:07:42 | 000,258,048 | —- | M] (Microsoft Corporation) – C:\Windows\System32\winspool.drv
MOD - [2011/01/20 17:07:03 | 001,075,712 | —- | M] (Microsoft Corporation) – C:\Windows\System32\shdocvw.dll
MOD - [2010/10/15 14:48:59 | 001,205,080 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ntdll.dll
MOD - [2010/08/31 16:43:52 | 001,686,016 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll
MOD - [2010/06/28 18:00:21 | 001,316,864 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ole32.dll
MOD - [2010/04/16 17:46:48 | 000,502,272 | —- | M] (Microsoft Corporation) – C:\Windows\System32\usp10.dll
MOD - [2009/07/31 18:27:58 | 000,023,552 | —- | M] (Microsoft Corporation) – C:\Windows\System32\lpk.dll
MOD - [2009/07/30 07:32:53 | 000,784,896 | —- | M] (Microsoft Corporation) – C:\Windows\System32\rpcrt4.dll
MOD - [2009/07/17 14:54:43 | 000,071,680 | —- | M] (Microsoft Corporation) – C:\Windows\System32\atl.dll
MOD - [2009/06/15 15:53:43 | 000,072,704 | —- | M] (Microsoft Corporation) – C:\Windows\System32\secur32.dll
MOD - [2009/04/11 07:28:25 | 001,077,248 | —- | M] (Microsoft Corporation) – C:\Windows\System32\vssapi.dll
MOD - [2009/04/11 07:28:25 | 000,627,712 | —- | M] (Microsoft Corporation) – C:\Windows\System32\user32.dll
MOD - [2009/04/11 07:28:25 | 000,287,744 | —- | M] (Microsoft Corporation) – C:\Windows\System32\Wldap32.dll
MOD - [2009/04/11 07:28:25 | 000,108,544 | —- | M] (Microsoft Corporation) – C:\Windows\System32\userenv.dll
MOD - [2009/04/11 07:28:25 | 000,020,480 | —- | M] (Microsoft Corporation) – C:\Windows\System32\version.dll
MOD - [2009/04/11 07:28:24 | 001,591,296 | —- | M] (Microsoft Corporation) – C:\Windows\System32\setupapi.dll
MOD - [2009/04/11 07:28:24 | 000,142,336 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spp.dll
MOD - [2009/04/11 07:28:24 | 000,057,344 | —- | M] (Microsoft Corporation) – C:\Windows\System32\samlib.dll
MOD - [2009/04/11 07:28:23 | 000,754,688 | —- | M] (Microsoft Corporation) – C:\Windows\System32\propsys.dll
MOD - [2009/04/11 07:28:23 | 000,563,712 | —- | M] (Microsoft Corporation) – C:\Windows\System32\oleaut32.dll
MOD - [2009/04/11 07:28:23 | 000,467,456 | —- | M] (Microsoft Corporation) – C:\Windows\System32\netapi32.dll
MOD - [2009/04/11 07:28:23 | 000,121,344 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ntmarta.dll
MOD - [2009/04/11 07:28:23 | 000,088,576 | —- | M] (Microsoft Corporation) – C:\Windows\System32\olepro32.dll
MOD - [2009/04/11 07:28:22 | 000,679,936 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msvcrt.dll
MOD - [2009/04/11 07:28:20 | 000,891,392 | —- | M] (Microsoft Corporation) – C:\Windows\System32\kernel32.dll
MOD - [2009/04/11 07:28:20 | 000,807,424 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msctf.dll
MOD - [2009/04/11 07:28:20 | 000,114,688 | —- | M] (Microsoft Corporation) – C:\Windows\System32\imm32.dll
MOD - [2009/04/11 07:28:20 | 000,068,608 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mpr.dll
MOD - [2009/04/11 07:28:19 | 000,297,472 | —- | M] (Microsoft Corporation) – C:\Windows\System32\gdi32.dll
MOD - [2009/04/11 07:28:18 | 000,450,560 | —- | M] (Microsoft Corporation) – C:\Windows\System32\comdlg32.dll
MOD - [2009/04/11 07:28:18 | 000,079,872 | —- | M] (Microsoft Corporation) – C:\Windows\System32\authz.dll
MOD - [2009/04/11 07:28:17 | 000,800,768 | —- | M] (Microsoft Corporation) – C:\Windows\System32\advapi32.dll
MOD - [2009/04/11 07:28:17 | 000,171,008 | —- | M] (Microsoft Corporation) – C:\Windows\System32\apphelp.dll
MOD - [2008/01/19 08:37:12 | 000,183,296 | —- | M] (Microsoft Corporation) – C:\Windows\System32\xmllite.dll
MOD - [2008/01/19 08:37:09 | 000,179,200 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ws2_32.dll
MOD - [2008/01/19 08:36:48 | 000,069,120 | —- | M] (Microsoft Corporation) – C:\Windows\System32\vsstrace.dll
MOD - [2008/01/19 08:36:47 | 000,240,128 | —- | M] (Microsoft Corporation) – C:\Windows\System32\uxtheme.dll
MOD - [2008/01/19 08:36:35 | 000,040,960 | —- | M] (Microsoft Corporation) – C:\Windows\System32\srclient.dll
MOD - [2008/01/19 08:35:57 | 000,008,192 | —- | M] (Microsoft Corporation) – C:\Windows\System32\nsi.dll
MOD - [2008/01/19 08:33:52 | 000,523,776 | —- | M] (Microsoft Corporation) – C:\Windows\System32\clbcatq.dll
MOD - [2008/01/19 08:33:00 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msscript.ocx
MOD - [2006/11/02 13:34:48 | 000,022,016 | —- | M] (Microsoft Corporation) – C:\Windows\System32\linkinfo.dll
MOD - [2006/11/02 10:46:12 | 000,012,288 | —- | M] (Microsoft Corporation) – C:\Windows\System32\psapi.dll


========== Win32 Services (All) ==========

SRV - File not found [Auto | Stopped] – – (CLTNetCnService)
SRV - [2011/03/08 12:50:10 | 000,310,856 | —- | M] (BitDefender S.R.L.) [Auto | Running] – C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe – (LIVESRV)
SRV - [2011/03/07 16:33:34 | 000,820,520 | —- | M] (Apple Inc.) [On_Demand | Running] – C:\Program Files\iPod\bin\iPodService.exe – (iPod Service)
SRV - [2011/03/02 16:44:27 | 000,086,528 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\dnsrslvr.dll – (Dnscache)
SRV - [2011/02/22 14:33:09 | 000,797,696 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\FntCache.dll – (FontCache)
SRV - [2011/02/18 17:37:16 | 000,037,664 | —- | M] (Apple Inc.) [Auto | Running] – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe – (Apple Mobile Device)
SRV - [2010/11/04 19:55:12 | 000,601,600 | —- | M] (Microsoft Corporation) [Unknown | Running] – C:\Windows\System32\schedsvc.dll – (Schedule)
SRV - [2010/11/01 21:59:46 | 000,331,296 | —- | M] (Soluto) [Auto | Stopped] – C:\Program Files\Soluto\SolutoService.exe – (SolutoService)
SRV - [2010/09/06 17:20:29 | 000,125,952 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\srvsvc.dll – (LanmanServer)
SRV - [2010/08/17 15:11:37 | 000,128,000 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\spoolsv.exe – (Spooler)
SRV - [2010/08/12 19:55:50 | 000,315,392 | —- | M] (S.C. BitDefender S.R.L) [On_Demand | Running] – C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\scan.dll – (scan)
SRV - [2010/08/12 19:55:13 | 000,183,880 | —- | M] (BitDefender S.R.L. http://www.bitdefender.com) [On_Demand | Stopped] – C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe – (Arrakis3)
SRV - [2010/08/12 19:47:44 | 001,615,688 | —- | M] (BitDefender S.R.L.) [Auto | Running] – C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe – (VSSERV)
SRV - [2010/03/18 11:19:26 | 000,113,152 | —- | M] (ArcSoft Inc.) [On_Demand | Stopped] – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe – (ACDaemon)
SRV - [2010/02/18 14:30:03 | 000,200,704 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\iphlpsvc.dll – (iphlpsvc)
SRV - [2010/01/29 23:40:52 | 000,700,032 | —- | M] (Hewlett-Packard Co.) [On_Demand | Stopped] – C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL – (HPSLPSVC)
SRV - [2009/11/25 12:00:34 | 000,095,568 | —- | M] (Devguru Co., Ltd.) [Auto | Running] – C:\Windows\System32\dgdersvc.exe – (dgdersvc)
SRV - [2009/11/18 04:42:52 | 000,253,568 | —- | M] (Hewlett-Packard Co.) [On_Demand | Stopped] – C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll – (hpqcxs08)
SRV - [2009/11/18 04:16:42 | 000,137,344 | —- | M] (Hewlett-Packard Co.) [On_Demand | Stopped] – C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll – (hpqddsvc)
SRV - [2009/10/09 22:56:18 | 001,181,696 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\WsmSvc.dll – (WinRM) Windows Remote Management (WS-Management)
SRV - [2009/10/09 22:55:52 | 000,146,944 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wecsvc.dll – (Wecsvc)
SRV - [2009/10/01 02:01:54 | 000,081,920 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\wpdbusenum.dll – (WPDBusEnum)
SRV - [2009/09/10 18:14:18 | 000,238,952 | —- | M] (Teruten) [Auto | Running] – C:\Windows\System32\FsUsbExService.Exe – (FsUsbExService)
SRV - [2009/09/04 13:39:01 | 000,133,104 | —- | M] (Google Inc.) [On_Demand | Stopped] – C:\Program Files\Google\Update\GoogleUpdate.exe – (gupdate1ca2d5cb198ca24) Google Update Service (gupdate1ca2d5cb198ca24)
SRV - [2009/09/04 13:38:32 | 000,194,032 | —- | M] (Google) [Auto | Stopped] – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe – (gusvc)
SRV - [2009/08/24 12:36:45 | 000,377,344 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – winhttp.dll – (WinHttpAutoProxySvc)
SRV - [2009/08/07 03:23:45 | 001,929,952 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\wuaueng.dll – (wuauserv)
SRV - [2009/07/11 20:01:42 | 000,513,536 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wlansvc.dll – (Wlansvc)
SRV - [2009/07/10 12:47:42 | 000,247,808 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\shsvcs.dll – (Themes)
SRV - [2009/07/10 12:47:42 | 000,247,808 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\shsvcs.dll – (ShellHWDetection)
SRV - [2009/06/17 11:18:42 | 006,582,912 | —- | M] () [Auto | Stopped] – c:\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe – (wampmysqld)
SRV - [2009/06/15 13:48:49 | 000,009,728 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\lsass.exe – (SamSs)
SRV - [2009/06/15 13:48:49 | 000,009,728 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\lsass.exe – (ProtectedStorage)
SRV - [2009/06/15 13:48:49 | 000,009,728 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\lsass.exe – (Netlogon)
SRV - [2009/06/15 13:48:49 | 000,009,728 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\lsass.exe – (KeyIso)
SRV - [2009/06/10 12:42:23 | 000,160,256 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\wkssvc.dll – (LanmanWorkstation)
SRV - [2009/06/03 21:52:26 | 000,120,168 | —- | M] (stumbleupon.com) [Auto | Running] – C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe – (StumbleUponUpdateService)
SRV - [2009/05/14 16:48:08 | 000,053,760 | —- | M] (Hewlett-Packard) [On_Demand | Stopped] – C:\Windows\System32\HPZipm12.dll – (Pml Driver HPZ12)
SRV - [2009/05/14 16:48:06 | 000,044,032 | —- | M] (Hewlett-Packard) [On_Demand | Stopped] – C:\Windows\System32\HPZinw12.dll – (Net Driver HPZ12)
SRV - [2009/04/11 07:28:26 | 000,061,440 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\wscsvc.dll – (wscsvc)
SRV - [2009/04/11 07:28:25 | 001,017,856 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\wevtsvc.dll – (Eventlog)
SRV - [2009/04/11 07:28:25 | 000,453,120 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\wiaservc.dll – (stisvc) Windows Image Acquisition (WIA)
SRV - [2009/04/11 07:28:25 | 000,413,696 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wcncsvc.dll – (wcncsvc)
SRV - [2009/04/11 07:28:25 | 000,282,624 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\w32time.dll – (W32Time)
SRV - [2009/04/11 07:28:25 | 000,222,720 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\umpnpmgr.dll – (PlugPlay)
SRV - [2009/04/11 07:28:25 | 000,199,680 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\WebClnt.dll – (WebClient)
SRV - [2009/04/11 07:28:25 | 000,162,304 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\wbem\WMIsvc.dll – (Winmgmt)
SRV - [2009/04/11 07:28:25 | 000,140,288 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wpcsvc.dll – (WPCSvc)
SRV - [2009/04/11 07:28:25 | 000,126,976 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\wersvc.dll – (WerSvc)
SRV - [2009/04/11 07:28:25 | 000,029,184 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\uxsms.dll – (UxSms)
SRV - [2009/04/11 07:28:24 | 000,558,080 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\sysmain.dll – (SysMain)
SRV - [2009/04/11 07:28:24 | 000,550,400 | —- | M] (Microsoft Corporation) [Unknown | Running] – C:\Windows\System32\rpcss.dll – (RpcSs) Remote Procedure Call (RPC)
SRV - [2009/04/11 07:28:24 | 000,550,400 | —- | M] (Microsoft Corporation) [Unknown | Running] – C:\Windows\System32\rpcss.dll – (DcomLaunch)
SRV - [2009/04/11 07:28:24 | 000,449,024 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\termsrv.dll – (TermService)
SRV - [2009/04/11 07:28:24 | 000,311,808 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\swprv.dll – (swprv)
SRV - [2009/04/11 07:28:24 | 000,262,144 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\rasmans.dll – (RasMan)
SRV - [2009/04/11 07:28:24 | 000,242,688 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\tapisrv.dll – (TapiSrv)
SRV - [2009/04/11 07:28:24 | 000,107,008 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\regsvc.dll – (RemoteRegistry)
SRV - [2009/04/11 07:28:24 | 000,095,232 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\SCardSvr.dll – (SCardSvr)
SRV - [2009/04/11 07:28:24 | 000,060,928 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\SLUINotify.dll – (SLUINotify)
SRV - [2009/04/11 07:28:23 | 000,758,784 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\qmgr.dll – (BITS)
SRV - [2009/04/11 07:28:23 | 000,644,608 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\p2psvc.dll – (PNRPsvc)
SRV - [2009/04/11 07:28:23 | 000,644,608 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\p2psvc.dll – (PNRPAutoReg)
SRV - [2009/04/11 07:28:23 | 000,644,608 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\p2psvc.dll – (p2psvc)
SRV - [2009/04/11 07:28:23 | 000,644,608 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\p2psvc.dll – (p2pimsvc)
SRV - [2009/04/11 07:28:23 | 000,302,592 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\QAGENTRT.DLL – (napagent)
SRV - [2009/04/11 07:28:23 | 000,153,088 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\profsvc.dll – (ProfSvc)
SRV - [2009/04/11 07:28:20 | 000,438,784 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\IKEEXT.DLL – (IKEEXT)
SRV - [2009/04/11 07:28:20 | 000,407,552 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\MPSSVC.dll – (MpsSvc)
SRV - [2009/04/11 07:28:20 | 000,364,032 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\IPSECSVC.DLL – (PolicyAgent)
SRV - [2009/04/11 07:28:19 | 000,576,512 | —- | M] (Microsoft Corporation) [Unknown | Running] – C:\Windows\System32\gpsvc.dll – (gpsvc)
SRV - [2009/04/11 07:28:19 | 000,564,224 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\emdmgmt.dll – (EMDMgmt)
SRV - [2009/04/11 07:28:19 | 000,268,800 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\es.dll – (EventSystem)
SRV - [2009/04/11 07:28:19 | 000,026,112 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\hidserv.dll – (hidserv)
SRV - [2009/04/11 07:28:18 | 000,334,848 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\BFE.DLL – (BFE)
SRV - [2009/04/11 07:28:18 | 000,315,392 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\audiosrv.dll – (Audiosrv)
SRV - [2009/04/11 07:28:18 | 000,315,392 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\audiosrv.dll – (AudioEndpointBuilder)
SRV - [2009/04/11 07:28:18 | 000,204,288 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\dhcpcsvc.dll – (Dhcp)
SRV - [2009/04/11 07:28:18 | 000,175,616 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\dot3svc.dll – (dot3svc)
SRV - [2009/04/11 07:28:18 | 000,129,024 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\cryptsvc.dll – (CryptSvc)
SRV - [2009/04/11 07:28:18 | 000,040,448 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\certprop.dll – (SCPolicySvc)
SRV - [2009/04/11 07:28:18 | 000,040,448 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\certprop.dll – (CertPropSvc)
SRV - [2009/04/11 07:28:15 | 000,137,728 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wbem\WmiApSrv.exe – (wmiApSrv)
SRV - [2009/04/11 07:28:10 | 001,055,232 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\VSSVC.exe – (VSS)
SRV - [2009/04/11 07:28:09 | 000,385,536 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\vds.exe – (vds)
SRV - [2009/04/11 07:28:07 | 000,039,424 | —- | M] (Microsoft Corporation) [Unknown | Running] – C:\Windows\servicing\TrustedInstaller.exe – (TrustedInstaller)
SRV - [2009/04/11 07:27:59 | 000,441,344 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\SearchIndexer.exe – (WSearch)
SRV - [2009/04/11 07:27:49 | 003,408,896 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\SLsvc.exe – (slsvc)
SRV - [2009/04/11 07:27:45 | 000,073,216 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\msiexec.exe – (msiserver)
SRV - [2009/04/11 07:27:31 | 002,092,544 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\dfsr.exe – (DFSR)
SRV - [2009/03/30 05:42:14 | 000,066,368 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)
SRV - [2009/03/30 05:42:10 | 000,031,048 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe – (aspnet_state)
SRV - [2009/02/18 19:39:20 | 000,043,904 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe – (FontCache3.0.0.0)
SRV - [2009/02/18 19:38:43 | 000,129,880 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe – (NetTcpPortSharing)
SRV - [2009/02/18 19:38:42 | 000,879,448 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe – (idsvc)
SRV - [2008/12/10 01:10:14 | 000,024,636 | —- | M] (Apache Software Foundation) [Auto | Stopped] – c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe – (wampapache)
SRV - [2008/11/09 21:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [On_Demand | Stopped] – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)
SRV - [2008/01/19 08:38:24 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2008/01/19 08:37:12 | 000,055,296 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\WUDFSvc.dll – (wudfsvc)
SRV - [2008/01/19 08:36:52 | 000,062,976 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wercplsupport.dll – (wercplsupport)
SRV - [2008/01/19 08:36:50 | 000,073,728 | —- | M] (Microsoft Corporation) [Unknown | Running] – C:\Windows\System32\wdi.dll – (WdiSystemHost)
SRV - [2008/01/19 08:36:50 | 000,073,728 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\wdi.dll – (WdiServiceHost)
SRV - [2008/01/19 08:36:46 | 000,259,072 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\upnphost.dll – (upnphost)
SRV - [2008/01/19 08:36:42 | 000,075,264 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\trkwks.dll – (TrkWks)
SRV - [2008/01/19 08:36:39 | 000,056,320 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\tbssvc.dll – (TBS)
SRV - [2008/01/19 08:36:36 | 000,155,648 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\ssdpsrv.dll – (SSDPSRV)
SRV - [2008/01/19 08:36:36 | 000,116,736 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\sstpsvc.dll – (SstpSvc)
SRV - [2008/01/19 08:36:21 | 000,084,992 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\SessEnv.dll – (SessionEnv)
SRV - [2008/01/19 08:36:21 | 000,047,104 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\Sens.dll – (SENS)
SRV - [2008/01/19 08:36:20 | 000,104,960 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sdrsvc.dll – (SDRSVC)
SRV - [2008/01/19 08:36:20 | 000,019,968 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\seclogon.dll – (seclogon)
SRV - [2008/01/19 08:36:15 | 000,090,624 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\rasauto.dll – (RasAuto)
SRV - [2008/01/19 08:36:14 | 000,243,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\qwave.dll – (QWAVE)
SRV - [2008/01/19 08:36:06 | 001,502,208 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\pla.dll – (pla)
SRV - [2008/01/19 08:36:03 | 000,037,888 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\pcasvc.dll – (PcaSvc)
SRV - [2008/01/19 08:35:57 | 000,018,432 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\nsisvc.dll – (nsi)
SRV - [2008/01/19 08:35:38 | 000,168,448 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\nlasvc.dll – (NlaSvc)
SRV - [2008/01/19 08:35:36 | 000,274,432 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\netman.dll – (Netman)
SRV - [2008/01/19 08:35:36 | 000,237,056 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\netprofm.dll – (netprofm)
SRV - [2008/01/19 08:34:56 | 000,344,576 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\msdtckrm.dll – (KtmRm)
SRV - [2008/01/19 08:34:53 | 000,068,608 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\System32\mprdim.dll – (RemoteAccess)
SRV - [2008/01/19 08:34:49 | 000,045,056 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\mmcss.dll – (THREADORDER)
SRV - [2008/01/19 08:34:49 | 000,045,056 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\mmcss.dll – (MMCSS)
SRV - [2008/01/19 08:34:44 | 000,053,760 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\System32\Mcx2Svc.dll – (Mcx2Svc)
SRV - [2008/01/19 08:34:42 | 000,188,928 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\lltdsvc.dll – (lltdsvc)
SRV - [2008/01/19 08:34:36 | 000,068,096 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\KMSVC.DLL – (hkmsvc)
SRV - [2008/01/19 08:34:35 | 000,111,616 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\iscsiexe.dll – (MSiSCSI)
SRV - [2008/01/19 08:34:34 | 000,288,256 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\System32\ipnathlp.dll – (SharedAccess) Internet Connection Sharing (ICS)
SRV - [2008/01/19 08:34:34 | 000,074,240 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\IPBusEnum.dll – (IPBusEnum)
SRV - [2008/01/19 08:34:21 | 000,013,312 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\fdPHost.dll – (fdPHost)
SRV - [2008/01/19 08:34:08 | 000,057,344 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\eapsvc.dll – (EapHost)
SRV - [2008/01/19 08:34:06 | 000,134,656 | —- | M] (Microsoft Corporation) [Unknown | Running] – C:\Windows\System32\dps.dll – (DPS)
SRV - [2008/01/19 08:33:49 | 000,081,920 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\browser.dll – (Browser)
SRV - [2008/01/19 08:33:43 | 000,033,280 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\appinfo.dll – (Appinfo)
SRV - [2008/01/19 08:33:39 | 000,896,512 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Media Player\wmpnetwk.exe – (WMPNetworkSvc)
SRV - [2008/01/19 08:33:33 | 000,035,840 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\UI0Detect.exe – (UI0Detect)
SRV - [2008/01/19 08:33:16 | 000,105,984 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\msdtc.exe – (MSDTC)
SRV - [2008/01/19 08:33:09 | 000,292,352 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\ehome\ehrecvr.exe – (ehRecvr)
SRV - [2008/01/19 08:33:01 | 000,059,392 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\alg.exe – (ALG)
SRV - [2007/07/03 18:40:10 | 000,053,248 | —- | M] (Acer Inc.) [Auto | Running] – C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe – (eRecoveryService)
SRV - [2007/06/22 02:33:20 | 000,269,448 | —- | M] (CyberLink) [Auto | Running] – C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe – (Acer HomeMedia Connect Service)
SRV - [2007/06/21 07:04:40 | 000,269,432 | —- | M] (CyberLink) [Auto | Running] – C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe – (Acer TV Share Service)
SRV - [2007/04/26 00:34:30 | 000,457,512 | —- | M] (HiTRSUT) [On_Demand | Stopped] – C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe – (eDataSecurity Service)
SRV - [2007/04/17 02:48:12 | 000,028,672 | —- | M] () [On_Demand | Stopped] – C:\Acer\Empowering Technology\ePerformance\MemCheck.exe – (AcerMemUsageCheckService)
SRV - [2007/04/06 22:10:56 | 000,223,704 | —- | M] (Intel® Corporation) [Auto | Running] – C:\Program Files\Intel\IntelDH\CCU\AlertService.exe – (AlertService) Intel®
SRV - [2007/04/06 22:10:22 | 000,272,856 | —- | M] (Intel® Corporation) [On_Demand | Stopped] – C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe – (QualityManager) Intel®
SRV - [2007/04/06 22:10:08 | 000,449,496 | —- | M] (Intel® Corporation) [On_Demand | Stopped] – C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe – (Remote UI Service) Intel®
SRV - [2007/04/06 22:08:58 | 000,158,168 | —- | M] (Intel® Corporation) [On_Demand | Stopped] – C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe – (MCLServiceATL) Intel®
SRV - [2007/04/06 22:08:36 | 000,036,312 | R— | M] (Intel® Corporation) [On_Demand | Stopped] – C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe – (IntelDHSvcConf)
SRV - [2007/04/06 22:08:24 | 000,039,896 | —- | M] (Intel® Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe – (DHTRACE) Intel®
SRV - [2007/04/06 22:08:14 | 000,059,352 | —- | M] (Intel® Corporation) [On_Demand | Stopped] – C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe – (ISSM) Intel®
SRV - [2007/04/06 22:07:46 | 000,313,816 | —- | M] (Intel® Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe – (NMSCore) Intel®
SRV - [2007/04/06 22:06:48 | 000,256,472 | —- | M] () [On_Demand | Stopped] – C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe – (M1 Server) Intel® Viiv™
SRV - [2007/02/12 18:46:34 | 000,208,896 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe – (DQLWinService)
SRV - [2007/01/17 19:20:10 | 000,061,440 | —- | M] (Hewlett-Packard Company) [On_Demand | Stopped] – C:\Program Files\Common Files\LightScribe\LSSrvc.exe – (LightScribeService)
SRV - [2006/11/02 13:35:29 | 000,131,072 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\ehome\ehsched.exe – (ehSched)
SRV - [2006/11/02 13:35:29 | 000,013,312 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\ehome\ehstart.dll – (ehstart)
SRV - [2006/11/02 13:35:24 | 000,068,096 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\TabSvc.dll – (TabletInputService)
SRV - [2006/11/02 10:46:13 | 000,032,256 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\WcsPlugInService.dll – (WcsPlugInService)
SRV - [2006/11/02 10:46:05 | 000,018,944 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\lmhsvc.dll – (lmhosts)
SRV - [2006/11/02 10:46:04 | 000,027,648 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\FDResPub.dll – (FDResPub)
SRV - [2006/11/02 10:46:02 | 000,024,576 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\aelupsvc.dll – (AeLookupSvc)
SRV - [2006/11/02 10:45:46 | 000,012,800 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\snmptrap.exe – (SNMPTRAP)
SRV - [2006/11/02 10:45:21 | 000,007,680 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\Locator.exe – (RpcLocator) Remote Procedure Call (RPC)
SRV - [2006/11/02 10:45:02 | 000,007,168 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\dllhost.exe – (COMSysApp)
SRV - [2006/10/27 03:49:34 | 000,441,136 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE – (odserv)
SRV - [2006/10/26 22:03:08 | 000,145,184 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE – (ose)
SRV - [2006/07/19 19:36:56 | 000,262,247 | —- | M] () [On_Demand | Stopped] – C:\Program Files\CyberLink\Shared Files\RichVideo.exe – (RichVideo) Cyberlink RichVideo Service(CRVS)


========== Driver Services (All) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – – (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] – – (blbdrive)
DRV - [2011/02/22 14:24:10 | 000,213,504 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Running] – C:\Windows\System32\drivers\mrxsmb10.sys – (mrxsmb10)
DRV - [2011/02/22 14:24:02 | 000,079,360 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Running] – C:\Windows\System32\drivers\mrxsmb20.sys – (mrxsmb20)
DRV - [2011/02/22 14:23:59 | 000,106,496 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Running] – C:\Windows\System32\drivers\mrxsmb.sys – (mrxsmb)
DRV - [2011/02/22 14:23:55 | 000,069,632 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Running] – C:\Windows\System32\drivers\bowser.sys – (bowser)
DRV - [2011/02/18 15:03:32 | 000,305,152 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Running] – C:\Windows\System32\drivers\srv.sys – (srv)
DRV - [2011/02/18 15:03:10 | 000,146,432 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Running] – C:\Windows\System32\drivers\srv2.sys – (srv2)
DRV - [2011/02/18 15:03:06 | 000,102,400 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Running] – C:\Windows\System32\drivers\srvnet.sys – (srvnet)
DRV - [2011/01/20 17:37:37 | 000,638,336 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\dxgkrnl.sys – (DXGKrnl)
DRV - [2010/11/01 21:50:32 | 000,181,704 | —- | M] (Soluto LTD.) [File_System | Boot | Stopped] – C:\Windows\system32\DRIVERS\PCGenFAM.sys – (PCGenFAM)
DRV - [2010/08/12 20:03:27 | 000,014,720 | —- | M] (BitDefender S.R.L.) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\profos.sys – (Profos)
DRV - [2010/08/12 20:03:09 | 000,153,448 | —- | M] (BitDefender S.R.L. Bucharest, ROMANIA) [File_System | On_Demand | Running] – C:\Windows\System32\drivers\bdfm.sys – (BDFM)
DRV - [2010/08/12 20:02:28 | 000,085,128 | —- | M] (BitDefender) [Kernel | Auto | Running] – C:\Program Files\BitDefender\BitDefender 2010\bdvedisk.sys – (BDVEDISK)
DRV - [2010/08/12 20:02:20 | 000,058,368 | —- | M] (BitDefender) [Kernel | On_Demand | Stopped] – C:\Program Files\BitDefender\BitDefender 2010\bdselfpr.sys – (BDSelfPr)
DRV - [2010/08/12 20:00:58 | 000,291,352 | —- | M] (BitDefender) [File_System | Boot | Running] – C:\Windows\system32\DRIVERS\bdfsfltr.sys – (bdfsfltr)
DRV - [2010/08/12 19:52:05 | 000,119,504 | —- | M] (BitDefender LLC) [Kernel | System | Running] – C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys – (bdftdif)
DRV - [2010/08/12 19:37:46 | 000,072,784 | —- | M] (BitDefender LLC) [Kernel | System | Running] – C:\Windows\System32\drivers\BdfNdisf6.sys – (BdfNdisf)
DRV - [2010/06/16 17:04:57 | 000,905,088 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\tcpip.sys – (Tcpip6)
DRV - [2010/06/16 17:04:57 | 000,905,088 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\tcpip.sys – (Tcpip)
DRV - [2010/04/29 16:39:38 | 000,038,224 | —- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mbamswissarmy.sys – (MBAMSwissArmy)
DRV - [2010/02/20 21:53:34 | 000,411,648 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\http.sys – (HTTP)
DRV - [2010/02/18 12:28:13 | 000,025,088 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tunnel.sys – (tunnel)
DRV - [2009/12/08 18:26:18 | 000,030,720 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\Windows\System32\drivers\tcpipreg.sys – (tcpipreg)
DRV - [2009/11/25 12:00:34 | 000,018,136 | —- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\dgderdrv.sys – (dgderdrv)
DRV - [2009/09/21 09:55:36 | 000,121,856 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ss_bmdm.sys – (ss_bmdm)
DRV - [2009/09/21 09:55:36 | 000,090,112 | —- | M] (MCCI) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ss_bbus.sys – (ss_bbus) SAMSUNG USB Mobile Device (WDM)
DRV - [2009/09/21 09:55:36 | 000,014,976 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ss_bmdfl.sys – (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter)
DRV - [2009/08/31 10:23:28 | 000,036,608 | —- | M] () [Kernel | On_Demand | Running] – C:\Windows\System32\FsUsbExDisk.Sys – (FsUsbExDisk)
DRV - [2009/08/28 20:42:52 | 000,040,448 | —- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\usbaapl.sys – (USBAAPL)
DRV - [2009/07/29 11:30:18 | 000,005,504 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\IntelDH.sys – (IntelDH)
DRV - [2009/06/16 00:15:25 | 000,439,864 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\Drivers\ksecdd.sys – (KSecDD)
DRV - [2009/05/18 14:17:00 | 000,026,600 | —- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\GEARAspiWDM.sys – (GEARAspiWDM)
DRV - [2009/05/07 04:22:06 | 000,039,808 | —- | M] (BitDefender S.R.L.) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\trufos.sys – (Trufos)
DRV - [2009/04/11 07:33:03 | 000,292,840 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\volmgrx.sys – (volmgrx)
DRV - [2009/04/11 07:32:55 | 000,226,280 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\volsnap.sys – (volsnap)
DRV - [2009/04/11 07:32:55 | 000,149,480 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\pci.sys – (pci)
DRV - [2009/04/11 07:32:52 | 000,053,224 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\termdd.sys – (TermDD)
DRV - [2009/04/11 07:32:49 | 001,083,880 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Running] – C:\Windows\System32\drivers\ntfs.sys – (Ntfs)
DRV - [2009/04/11 07:32:49 | 000,527,848 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\ndis.sys – (NDIS)
DRV - [2009/04/11 07:32:46 | 000,265,688 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\acpi.sys – (ACPI)
DRV - [2009/04/11 07:32:46 | 000,245,736 | —- | M] (Microsoft Corporation) [Kernel | Unknown | Running] – C:\Windows\System32\clfs.sys – (CLFS) Common Log (CLFS)
DRV - [2009/04/11 07:32:46 | 000,190,424 | —- | M] (Microsoft Corporation) [File_System | Boot | Running] – C:\Windows\system32\drivers\fltmgr.sys – (FltMgr)
DRV - [2009/04/11 07:32:46 | 000,180,712 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\msiscsi.sys – (iScsiPrt)
DRV - [2009/04/11 07:32:46 | 000,161,752 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\msrpc.sys – (MsRPC)
DRV - [2009/04/11 07:32:43 | 000,141,288 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\ecache.sys – (Ecache)
DRV - [2009/04/11 07:32:31 | 000,054,248 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\partmgr.sys – (partmgr)
DRV - [2009/04/11 07:32:31 | 000,053,736 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\disk.sys – (disk)
DRV - [2009/04/11 07:32:31 | 000,048,104 | —- | M] (Microsoft Corporation) [File_System | Boot | Running] – C:\Windows\System32\Drivers\mup.sys – (Mup)
DRV - [2009/04/11 07:32:26 | 000,019,944 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\atapi.sys – (atapi)
DRV - [2009/04/11 05:51:27 | 000,180,736 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\rdpwd.sys – (RDPWD)
DRV - [2009/04/11 05:47:03 | 000,273,920 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\system32\drivers\afd.sys – (AFD)
DRV - [2009/04/11 05:46:40 | 000,069,120 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\rassstp.sys – (RasSstp) WAN Miniport (SSTP)
DRV - [2009/04/11 05:46:32 | 000,121,344 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\ndiswan.sys – (NdisWan)
DRV - [2009/04/11 05:46:30 | 000,041,472 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\raspppoe.sys – (RasPppoe)
DRV - [2009/04/11 05:45:56 | 000,072,192 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\tdx.sys – (tdx)
DRV - [2009/04/11 05:45:51 | 000,072,192 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\pacer.sys – (PSched)
DRV - [2009/04/11 05:45:37 | 000,185,856 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\netbt.sys – (netbt)
DRV - [2009/04/11 05:45:22 | 000,066,560 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\smb.sys – (Smb) Message-oriented TCP/IP and TCP/IPv6 Protocol (SMB session)
DRV - [2009/04/11 05:43:28 | 000,148,480 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\nwifi.sys – (NativeWifiP)
DRV - [2009/04/11 05:43:16 | 000,196,096 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\usbhub.sys – (usbhub)
DRV - [2009/04/11 05:43:04 | 000,062,208 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\ohci1394.sys – (ohci1394)
DRV - [2009/04/11 05:42:55 | 000,065,536 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\USBSTOR.SYS – (USBSTOR)
DRV - [2009/04/11 05:42:52 | 000,039,936 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\usbehci.sys – (usbehci)
DRV - [2009/04/11 05:42:48 | 000,012,800 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\hidusb.sys – (HidUsb)
DRV - [2009/04/11 05:42:42 | 000,561,152 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\hdaudbus.sys – (HDAudBus)
DRV - [2009/04/11 05:39:17 | 000,067,072 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\cdrom.sys – (cdrom)
DRV - [2009/04/11 05:38:40 | 000,017,408 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\kbdhid.sys – (kbdhid)
DRV - [2009/04/11 05:14:40 | 000,114,688 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Running] – C:\Windows\system32\drivers\mrxdav.sys – (MRxDAV)
DRV - [2009/04/11 05:14:29 | 000,225,280 | —- | M] (Microsoft Corporation) [File_System | System | Running] – C:\Windows\System32\drivers\rdbss.sys – (rdbss)
DRV - [2009/04/11 05:14:12 | 000,075,264 | —- | M] (Microsoft Corporation) [File_System | System | Running] – C:\Windows\System32\drivers\dfsc.sys – (DfsC)
DRV - [2009/04/11 05:14:01 | 000,035,328 | —- | M] (Microsoft Corporation) [File_System | System | Running] – C:\Windows\System32\drivers\npfs.sys – (Npfs)
DRV - [2009/04/11 05:13:59 | 000,226,816 | —- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] – C:\Windows\System32\drivers\udfs.sys – (udfs)
DRV - [2009/04/11 05:13:53 | 000,136,704 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\exfat.sys – (exfat)
DRV - [2009/04/11 05:13:52 | 000,142,848 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\fastfat.sys – (fastfat)
DRV - [2008/08/26 10:26:12 | 000,018,816 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\pccsmcfd.sys – (pccsmcfd)
DRV - [2008/02/12 03:36:10 | 002,302,976 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\igdkmd32.sys – (igfx)
DRV - [2008/01/19 08:43:27 | 000,503,864 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\Wdf01000.sys – (Wdf01000)
DRV - [2008/01/19 08:42:31 | 000,058,936 | —- | M] (Microsoft Corporation) [File_System | Boot | Running] – C:\Windows\system32\drivers\fileinfo.sys – (FileInfo)
DRV - [2008/01/19 08:42:28 | 000,057,400 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\mountmgr.sys – (MountMgr)
DRV - [2008/01/19 08:42:18 | 000,052,792 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\volmgr.sys – (volmgr)
DRV - [2008/01/19 08:41:52 | 000,035,384 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\kbdclass.sys – (kbdclass)
DRV - [2008/01/19 08:41:52 | 000,034,360 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\mouclass.sys – (mouclass)
DRV - [2008/01/19 08:41:49 | 000,031,288 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\mssmbios.sys – (mssmbios)
DRV - [2008/01/19 08:41:30 | 000,021,048 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\spldr.sys – (spldr)
DRV - [2008/01/19 08:41:20 | 000,017,976 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\intelide.sys – (intelide)
DRV - [2008/01/19 08:41:14 | 000,016,440 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\msisadrv.sys – (msisadrv)
DRV - [2008/01/19 08:41:14 | 000,015,288 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\swenum.sys – (swenum)
DRV - [2008/01/19 07:14:40 | 000,018,944 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\usbprint.sys – (usbprint)
DRV - [2008/01/19 07:14:10 | 000,009,216 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\serscan.sys – (StillCam)
DRV - [2008/01/19 07:14:09 | 000,035,328 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\usbscan.sys – (usbscan)
DRV - [2008/01/19 07:01:15 | 000,023,552 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\tssecsrv.sys – (tssecsrv)
DRV - [2008/01/19 07:01:09 | 000,006,144 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\RDPENCDD.sys – (RDPENCDD)
DRV - [2008/01/19 07:01:08 | 000,029,184 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\tdtcp.sys – (TDTCP)
DRV - [2008/01/19 07:01:08 | 000,006,144 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\RDPCDD.sys – (RDPCDD)
DRV - [2008/01/19 07:01:07 | 000,017,920 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\tdpipe.sys – (TDPIPE)
DRV - [2008/01/19 06:57:16 | 000,031,744 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\modem.sys – (Modem)
DRV - [2008/01/19 06:56:49 | 000,015,872 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ws2ifsl.sys – (ws2ifsl)
DRV - [2008/01/19 06:56:34 | 000,076,288 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\rasl2tp.sys – (Rasl2tp) WAN Miniport (L2TP)
DRV - [2008/01/19 06:56:34 | 000,062,976 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\raspptp.sys – (PptpMiniport) WAN Miniport (PPTP)
DRV - [2008/01/19 06:56:31 | 000,062,464 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\wanarp.sys – (Wanarpv6)
DRV - [2008/01/19 06:56:31 | 000,062,464 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\wanarp.sys – (Wanarp)
DRV - [2008/01/19 06:56:31 | 000,011,776 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\rasacd.sys – (RasAcd)
DRV - [2008/01/19 06:56:29 | 000,017,408 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\asyncmac.sys – (AsyncMac)
DRV - [2008/01/19 06:56:28 | 000,100,864 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ipnat.sys – (IPNAT)
DRV - [2008/01/19 06:56:28 | 000,049,664 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\ndproxy.sys – (NDProxy)
DRV - [2008/01/19 06:56:24 | 000,020,992 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\ndistapi.sys – (NdisTapi)
DRV - [2008/01/19 06:56:23 | 000,047,616 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ipfltdrv.sys – (IpFilterDriver)
DRV - [2008/01/19 06:56:07 | 000,031,232 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\qwavedrv.sys – (QWAVEdrv)
DRV - [2008/01/19 06:55:50 | 000,016,384 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\nsiproxy.sys – (nsiproxy)
DRV - [2008/01/19 06:55:45 | 000,035,840 | —- | M] (Microsoft Corporation) [File_System | System | Running] – C:\Windows\System32\drivers\netbios.sys – (NetBIOS)
DRV - [2008/01/19 06:55:41 | 000,015,360 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\TUNMP.SYS – (tunmp)
DRV - [2008/01/19 06:55:40 | 000,016,896 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ndisuio.sys – (Ndisuio)
DRV - [2008/01/19 06:55:19 | 000,013,312 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\irenum.sys – (IRENUM)
DRV - [2008/01/19 06:55:03 | 000,060,416 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rspndr.sys – (rspndr)
DRV - [2008/01/19 06:55:03 | 000,047,104 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\Windows\System32\drivers\lltdio.sys – (lltdio)
DRV - [2008/01/19 06:54:46 | 000,064,000 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\mpsdrv.sys – (mpsdrv)
DRV - [2008/01/19 06:53:40 | 000,034,816 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\umbus.sys – (umbus)
DRV - [2008/01/19 06:53:29 | 000,073,216 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\usbccgp.sys – (usbccgp)
DRV - [2008/01/19 06:53:20 | 000,023,552 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\usbuhci.sys – (usbuhci)
DRV - [2008/01/19 06:53:16 | 000,005,632 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\drmkaud.sys – (drmkaud)
DRV - [2008/01/19 06:53:04 | 000,083,328 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\WUDFRd.sys – (WUDFRd)
DRV - [2008/01/19 06:52:19 | 000,041,984 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\monitor.sys – (monitor)
DRV - [2008/01/19 06:52:06 | 000,025,088 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\vga.sys – (VgaSave)
DRV - [2008/01/19 06:49:20 | 000,008,192 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mskssrv.sys – (MSKSSRV)
DRV - [2008/01/19 06:49:19 | 000,006,016 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mstee.sys – (MSTEE)
DRV - [2008/01/19 06:49:18 | 000,054,784 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\System32\drivers\i8042prt.sys – (i8042prt)
DRV - [2008/01/19 06:49:18 | 000,005,888 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mspclock.sys – (MSPCLOCK)
DRV - [2008/01/19 06:49:18 | 000,005,504 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\mspqm.sys – (MSPQM)
DRV - [2008/01/19 06:49:16 | 000,019,968 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sermouse.sys – (sermouse)
DRV - [2008/01/19 06:49:16 | 000,015,872 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\mouhid.sys – (mouhid)
DRV - [2008/01/19 06:49:12 | 000,131,584 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\Dot4.sys – (Dot4)
DRV - [2008/01/19 06:49:12 | 000,004,608 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\null.sys – (Null)
DRV - [2008/01/19 06:49:10 | 000,036,864 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\Dot4usb.sys – (dot4usb)
DRV - [2008/01/19 06:49:10 | 000,006,144 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\beep.sys – (Beep)
DRV - [2008/01/19 06:49:09 | 000,016,384 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\Dot4Prt.sys – (Dot4Print)
DRV - [2008/01/19 06:30:36 | 000,084,480 | —- | M] (Microsoft Corporation) [File_System | Auto | Running] – C:\Windows\system32\drivers\luafv.sys – (luafv)
DRV - [2008/01/19 06:30:23 | 000,027,648 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\filetrace.sys – (Filetrace)
DRV - [2008/01/19 06:28:09 | 000,022,528 | —- | M] (Microsoft Corporation) [File_System | System | Running] – C:\Windows\System32\drivers\msfs.sys – (Msfs)
DRV - [2008/01/19 06:28:02 | 000,070,144 | —- | M] (Microsoft Corporation) [File_System | Disabled | Running] – C:\Windows\System32\drivers\cdfs.sys – (cdfs)
DRV - [2008/01/19 06:27:21 | 000,041,472 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\intelppm.sys – (intelppm)
DRV - [2007/08/16 02:40:05 | 000,006,144 | —- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\NTIDrvr.sys – (NTIDrvr)
DRV - [2007/07/03 03:05:20 | 000,015,392 | —- | M] (Acer, Inc.) [Kernel | Auto | Running] – C:\Acer\Empowering Technology\eRecovery\int15.sys – (int15)
DRV - [2007/06/22 10:34:12 | 001,788,056 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\RTKVHDA.sys – (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007/04/26 00:34:44 | 000,016,680 | —- | M] (HiTRUST) [Kernel | Boot | Running] – C:\Windows\system32\drivers\PSDNServ.sys – (PSDNServ)
DRV - [2007/04/26 00:34:40 | 000,060,712 | —- | M] (HiTRUST) [Kernel | Boot | Running] – C:\Windows\system32\drivers\psdvdisk.sys – (psdvdisk)
DRV - [2007/04/26 00:34:38 | 000,020,776 | —- | M] (HiTRUST) [File_System | Boot | Running] – C:\Windows\system32\DRIVERS\psdfilter.sys – (PSDFilter)
DRV - [2007/04/25 16:25:34 | 000,221,184 | —- | M] (YUAN High-Tech Development Co. Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\OmniTV.sys – (OmniTV)
DRV - [2007/04/13 06:22:56 | 000,228,224 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\e1e6032.sys – (e1express) Intel®
DRV - [2007/04/06 22:10:40 | 000,014,808 | —- | M] () [File_System | On_Demand | Stopped] – C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.sys – (TSHWMDTCP)
DRV - [2007/02/19 04:34:50 | 000,005,376 | –S- | M] (Gteko Ltd.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\nmsunidr.sys – (nmsunidr)
DRV - [2006/11/02 10:51:45 | 000,900,712 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql2300.sys – (ql2300)
DRV - [2006/11/02 10:51:38 | 000,420,968 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adp94xx.sys – (adp94xx)
DRV - [2006/11/02 10:51:34 | 000,316,520 | —- | M] (Emulex) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\elxstor.sys – (elxstor)
DRV - [2006/11/02 10:51:32 | 000,297,576 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpahci.sys – (adpahci)
DRV - [2006/11/02 10:51:25 | 000,235,112 | —- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\uliahci.sys – (uliahci)
DRV - [2006/11/02 10:51:25 | 000,232,040 | —- | M] (Intel Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iastorv.sys – (iaStorV)
DRV - [2006/11/02 10:51:12 | 000,167,528 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\pcmcia.sys – (pcmcia)
DRV - [2006/11/02 10:51:00 | 000,147,048 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu320.sys – (adpu320)
DRV - [2006/11/02 10:50:45 | 000,115,816 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata2.sys – (ulsata2)
DRV - [2006/11/02 10:50:41 | 000,112,232 | —- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\vsmraid.sys – (vsmraid)
DRV - [2006/11/02 10:50:40 | 000,106,600 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\nv_agp.sys – (nv_agp)
DRV - [2006/11/02 10:50:35 | 000,106,088 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql40xx.sys – (ql40xx)
DRV - [2006/11/02 10:50:35 | 000,098,408 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata.sys – (UlSata)
DRV - [2006/11/02 10:50:35 | 000,098,408 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu160m.sys – (adpu160m)
DRV - [2006/11/02 10:50:24 | 000,088,680 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvraid.sys – (nvraid)
DRV - [2006/11/02 10:50:24 | 000,047,208 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\isapnp.sys – (isapnp)
DRV - [2006/11/02 10:50:19 | 000,045,160 | —- | M] (IBM Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nfrd960.sys – (nfrd960)
DRV - [2006/11/02 10:50:17 | 000,080,488 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\msdsm.sys – (msdsm)
DRV - [2006/11/02 10:50:17 | 000,041,576 | —- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iirsp.sys – (iirsp)
DRV - [2006/11/02 10:50:16 | 000,078,952 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\mpio.sys – (mpio)
DRV - [2006/11/02 10:50:16 | 000,076,392 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sbp2port.sys – (sbp2port)
DRV - [2006/11/02 10:50:16 | 000,071,784 | —- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sisraid4.sys – (SiSRaid4)
DRV - [2006/11/02 10:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvstor.sys – (nvstor)
DRV - [2006/11/02 10:50:11 | 000,071,272 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\djsvs.sys – (aic78xx)
DRV - [2006/11/02 10:50:10 | 000,067,688 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arcsas.sys – (arcsas)
DRV - [2006/11/02 10:50:10 | 000,065,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_scsi.sys – (LSI_SCSI)
DRV - [2006/11/02 10:50:10 | 000,038,504 | —- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sisraid2.sys – (SiSRaid2)
DRV - [2006/11/02 10:50:10 | 000,037,480 | —- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\hpcisss.sys – (HpCISSs)
DRV - [2006/11/02 10:50:09 | 000,067,688 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arc.sys – (arc)
DRV - [2006/11/02 10:50:09 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteraid.sys – (iteraid)
DRV - [2006/11/02 10:50:07 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteatapi.sys – (iteatapi)
DRV - [2006/11/02 10:50:05 | 000,065,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_sas.sys – (LSI_SAS)
DRV - [2006/11/02 10:50:05 | 000,035,944 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\symc8xx.sys – (Symc8xx)
DRV - [2006/11/02 10:50:04 | 000,065,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_fc.sys – (LSI_FC)
DRV - [2006/11/02 10:50:04 | 000,058,984 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\gagp30kx.sys – (gagp30kx)
DRV - [2006/11/02 10:50:04 | 000,058,472 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\uliagpkx.sys – (uliagpkx)
DRV - [2006/11/02 10:50:03 | 000,034,920 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_u3.sys – (Sym_u3)
DRV - [2006/11/02 10:49:59 | 000,056,936 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\uagp35.sys – (uagp35)
DRV - [2006/11/02 10:49:59 | 000,054,888 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\amdagp.sys – (amdagp)
DRV - [2006/11/02 10:49:59 | 000,033,384 | —- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\mraid35x.sys – (Mraid35x)
DRV - [2006/11/02 10:49:56 | 000,031,848 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_hi.sys – (Sym_hi)
DRV - [2006/11/02 10:49:53 | 000,028,776 | —- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\megasas.sys – (megasas)
DRV - [2006/11/02 10:49:52 | 000,054,376 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\viaagp.sys – (viaagp)
DRV - [2006/11/02 10:49:52 | 000,053,864 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\agp440.sys – (agp440)
DRV - [2006/11/02 10:49:51 | 000,053,352 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\sisagp.sys – (sisagp)
DRV - [2006/11/02 10:49:49 | 000,027,752 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\i2omp.sys – (i2omp)
DRV - [2006/11/02 10:49:44 | 000,023,144 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\msahci.sys – (msahci)
DRV - [2006/11/02 10:49:43 | 000,022,632 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\crcdisk.sys – (crcdisk)
DRV - [2006/11/02 10:49:38 | 000,019,560 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\wd.sys – (Wd)
DRV - [2006/11/02 10:49:32 | 000,018,280 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\compbatt.sys – (Compbatt)
DRV - [2006/11/02 10:49:30 | 000,017,512 | —- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\viaide.sys – (viaide)
DRV - [2006/11/02 10:49:28 | 000,016,488 | —- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\cmdide.sys – (cmdide)
DRV - [2006/11/02 10:49:26 | 000,015,464 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\amdide.sys – (amdide)
DRV - [2006/11/02 10:49:20 | 000,014,952 | —- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\aliide.sys – (aliide)
DRV - [2006/11/02 10:49:20 | 000,013,416 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\pciide.sys – (pciide)
DRV - [2006/11/02 10:04:35 | 000,878,080 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\Windows\System32\drivers\PEAuth.sys – (PEAUTH)
DRV - [2006/11/02 10:03:00 | 000,242,688 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\rdpdr.sys – (rdpdr)
DRV - [2006/11/02 09:55:23 | 000,039,936 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\bthmodem.sys – (BTHMODEM)
DRV - [2006/11/02 09:55:22 | 000,029,184 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\hidbth.sys – (HidBth)
DRV - [2006/11/02 09:55:09 | 000,068,608 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\usbcir.sys – (usbcir) eHome Infrared Receiver (USBCIR)
DRV - [2006/11/02 09:55:08 | 000,035,328 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\circlass.sys – (circlass)
DRV - [2006/11/02 09:55:05 | 000,019,456 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\usbohci.sys – (usbohci)
DRV - [2006/11/02 09:55:01 | 000,021,504 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\hidir.sys – (HidIr)
DRV - [2006/11/02 09:53:56 | 000,026,112 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\vgapnp.sys – (vga)
DRV - [2006/11/02 09:52:52 | 000,020,608 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\wacompen.sys – (WacomPen)
DRV - [2006/11/02 09:51:40 | 000,013,312 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sfloppy.sys – (sfloppy)
DRV - [2006/11/02 09:51:40 | 000,012,800 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\sffp_sd.sys – (sffp_sd)
DRV - [2006/11/02 09:51:40 | 000,012,800 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\sffp_mmc.sys – (sffp_mmc)
DRV - [2006/11/02 09:51:38 | 000,013,312 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sffdisk.sys – (sffdisk)
DRV - [2006/11/02 09:51:33 | 000,025,088 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\System32\drivers\fdc.sys – (fdc)
DRV - [2006/11/02 09:51:32 | 000,020,480 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\System32\drivers\flpydisk.sys – (flpydisk)
DRV - [2006/11/02 09:51:30 | 000,083,456 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\serial.sys – (Serial)
DRV - [2006/11/02 09:51:30 | 000,079,360 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\parport.sys – (Parport)
DRV - [2006/11/02 09:51:25 | 000,017,920 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\serenum.sys – (Serenum)
DRV - [2006/11/02 09:51:23 | 000,008,704 | —- | M] (Microsoft Corporation) [Kernel | Auto | Stopped] – C:\Windows\system32\drivers\parvdm.sys – (Parvdm)
DRV - [2006/11/02 09:42:03 | 000,065,536 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ipmidrv.sys – (IPMIDRV)
DRV - [2006/11/02 09:35:03 | 000,011,264 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\wmiacpi.sys – (WmiAcpi)
DRV - [2006/11/02 09:30:19 | 000,039,424 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\viac7.sys – (ViaC7)
DRV - [2006/11/02 09:30:18 | 000,040,960 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\amdk8.sys – (AmdK8)
DRV - [2006/11/02 09:30:18 | 000,038,912 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\crusoe.sys – (Crusoe)
DRV - [2006/11/02 09:30:18 | 000,038,912 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\amdk7.sys – (AmdK7)
DRV - [2006/11/02 09:30:18 | 000,038,400 | —- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\processr.sys – (Processor)
DRV - [2006/11/02 09:25:24 | 000,071,808 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserid.sys – (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 09:24:47 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brusbser.sys – (BrUsbSer)
DRV - [2006/11/02 09:24:46 | 000,005,248 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltup.sys – (BrFiltUp)
DRV - [2006/11/02 09:24:45 | 000,013,568 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltlo.sys – (BrFiltLo)
DRV - [2006/11/02 09:24:44 | 000,062,336 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserwdm.sys – (BrSerWdm)
DRV - [2006/11/02 09:24:44 | 000,012,160 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brusbmdm.sys – (BrUsbMdm)
DRV - [2006/11/02 08:36:50 | 000,020,608 | —- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ntrigdigi.sys – (ntrigdigi)
DRV - [2006/11/02 08:36:49 | 000,235,520 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\HdAudio.sys – (HdAudAddService)
DRV - [2006/11/02 08:30:54 | 000,117,760 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\E1G60I32.sys – (E1G60) Intel®
DRV - [2006/11/02 07:37:21 | 000,020,480 | —- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\secdrv.sys – (secdrv)
DRV - [2006/08/03 07:30:48 | 000,856,832 | —- | M] (AVerMedia TECHNOLOGIES, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\AVerM115S.sys – (AVerM115S)
DRV - [2005/02/23 14:58:56 | 000,011,776 | —- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\afc.sys – (Afc)


========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 68 11 3E 01 8A FE 3A 40 98 05 55 13 32 61 80 52 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
IE - HKCU\..\URLSearchHook: {fa887e92-8f5f-4ec9-99ca-09be0e4120d6} - C:\Program Files\AddThis Toolbar\Helper.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========


FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\ [2010/09/20 18:26:17 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{000a9d1c-beef-4f90-9363-039d445309b8}: C:\Program Files\Google\Google Gears\Firefox\ [2010/03/06 13:59:28 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/07/15 12:57:08 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/15 16:52:51 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/15 16:52:51 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\BitDefender\BitDefender 2009\tbextension\

[2010/03/29 19:01:56 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Extensions
[2009/11/03 22:48:24 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/11/15 22:27:36 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Extensions\[removed]
[2010/03/29 19:01:56 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Extensions\[removed]
[2011/04/21 20:21:10 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions
[2010/11/21 19:07:55 | 000,000,000 | —D | M] (ErrorZilla Plus) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{03651b2d-eb7d-4be7-af1b-dc0cd162dd54}
[2010/09/05 20:41:51 | 000,000,000 | —D | M] (Auto Copy) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{0FED7D55-65D4-47b6-A6DE-9A4ADB55355F}
[2011/03/21 23:33:59 | 000,000,000 | —D | M] (Session Manager) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}
[2011/03/25 20:07:08 | 000,000,000 | —D | M] (ShareThis) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{1b8cc170-8c85-11db-b606-0800200c9a66}
[2010/07/02 20:39:51 | 000,000,000 | —D | M] (Site Launcher) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{20291fcc-1471-46c8-8213-5911f5ce6d67}
[2010/02/23 13:58:48 | 000,000,000 | —D | M] (XUL Cache) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{22459fcd-6248-4643-9877-5e7cab227d76}
[2010/12/30 23:05:05 | 000,000,000 | —D | M] ("Submit'em Now") – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{27ACE843-F2CF-4284-8501-C9306CE44D4A}
[2011/04/15 17:19:02 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011/03/21 23:33:49 | 000,000,000 | —D | M] (SeoQuake) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74}
[2010/07/27 20:43:50 | 000,000,000 | —D | M] (PopupMaster) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{35106bca-6c78-48c7-ac28-56df30b51d2d}
[2011/01/13 22:42:34 | 000,000,000 | —D | M] (AddThis) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{3e0e7d2a-070f-4a47-b019-91fe5385ba79}
[2011/01/31 00:38:29 | 000,000,000 | —D | M] (InFormEnter) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{5546F97E-11A5-46b0-9082-32AD74AAA920}
[2011/03/21 23:33:44 | 000,000,000 | —D | M] (Google Shortcuts) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{5C46D283-ABDE-4dce-B83C-08881401921C}
[2011/02/12 02:43:16 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/03/03 23:18:48 | 000,000,000 | —D | M] ("S3 Firefox Organizer(S3Fox)") – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{7CEA821D-3DAB-4238-B424-BF7324531750}
[2010/03/28 19:59:26 | 000,000,000 | —D | M] (Live PageRank) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{8061ddcf-3632-4287-8d8a-133e219ae838}
[2011/03/03 23:18:47 | 000,000,000 | —D | M] ("StumbleUpon") – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}
[2011/04/08 20:44:18 | 000,000,000 | —D | M] (Power Twitter) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{b2509cd4-17cd-45ed-8146-a82af038f493}
[2011/04/08 20:44:18 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/04/08 20:44:18 | 000,000,000 | —D | M] (Easy Youtube Video Downloader) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}
[2010/07/21 04:05:15 | 000,000,000 | —D | M] (Classic Compact) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{D46E8522-6E86-44b1-A622-58C0668AD78E}
[2011/03/05 14:23:35 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2011/04/08 20:44:12 | 000,000,000 | —D | M] (BitDefender QuickScan) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2010/11/30 17:39:21 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2011/01/21 21:47:45 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}
[2011/03/25 20:06:26 | 000,000,000 | —D | M] (SearchElf 1.2 Community Toolbar) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{f4e6547e-325b-403c-a3bb-ad29ed37a92f}
[2011/01/31 00:38:28 | 000,000,000 | —D | M] (ScribeFire) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{F807FACD-E46A-4793-B345-D58CB177673C}
[2010/08/05 21:54:52 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]
[2011/03/25 20:07:19 | 000,000,000 | —D | M] (Conduit Engine) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]
[2010/07/10 22:31:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]
[2011/04/09 20:53:34 | 000,000,000 | —D | M] (feedly) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\feedly@devhd
[2011/02/12 02:44:29 | 000,000,000 | —D | M] (Firebug) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]
[2011/01/21 00:46:24 | 000,000,000 | —D | M] (Shareaholic) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]
[2010/06/26 22:12:49 | 000,000,000 | —D | M] (Multifox) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\multifox@hultmann
[2011/03/21 23:34:09 | 000,000,000 | —D | M] (ScribeFire Next) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]
[2011/02/12 02:43:53 | 000,000,000 | —D | M] (Amazon Prime/Free Super Saver/Discount Search) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\primefreediscount@veekay
[2011/02/07 20:25:46 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]
[2010/07/10 20:43:13 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\staged
[2011/04/15 17:19:02 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\staged-xpis
[2011/03/03 23:18:49 | 000,000,000 | —D | M] (LastPass) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]
[2011/03/24 17:48:28 | 000,000,000 | —D | M] ("Alexa Toolbar") – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]
[2011/01/21 00:46:22 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]\chrome
[2011/01/21 00:46:22 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\[removed]\defaults
[2010/07/21 04:05:14 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{D46E8522-6E86-44b1-A622-58C0668AD78E}\chrome\mozapps\extensions
[2011/03/05 14:23:34 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\{dc572301-7619-498c-a57d-39143191b318}\modules\extensions
[2011/04/09 20:53:34 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\feedly@devhd\content\app\extension
[2010/07/10 19:17:05 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\staged\[removed]
[2010/07/10 19:17:09 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\staged\[removed]\chrome
[2010/07/10 20:43:12 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\bnsc95ha.Echoes\extensions\staged\feedly@devhd\content\app\extension
[2011/04/01 20:01:29 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions
[2010/02/02 20:47:22 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{0fc85f5d-6207-4515-a490-45a549d285c0}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{1b8cc170-8c85-11db-b606-0800200c9a66}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/02/23 13:58:48 | 000,000,000 | —D | M] (XUL Cache) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{22459fcd-6248-4643-9877-5e7cab227d76}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{2fa4ed95-0317-4c6a-a74c-5f3e3912c1f9}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{3e0e7d2a-070f-4a47-b019-91fe5385ba79}
[2010/01/29 22:41:14 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{7C9AE782-DB21-4e40-81FB-AD8A53A6233A}
[2011/04/01 20:01:31 | 000,000,000 | —D | M] (PriceGong) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}
[2010/02/01 22:52:11 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010/02/01 22:44:27 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{d9284e50-81fc-11da-a72b-0800200c9a66}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\{fae5bcbc-dd73-439a-a15e-5b9ff39c0e9b}
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\[removed]
[2010/02/02 20:47:22 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\staged-xpis
[2010/03/27 21:24:03 | 000,000,000 | —D | M] (LastPass) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\[removed]
[2010/02/02 20:53:57 | 000,000,000 | —D | M] (No name found) – C:\Users\Jai\AppData\Roaming\Mozilla\Firefox\Profiles\l33a87yd.default\extensions\[removed]
[2011/04/15 16:46:44 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/04/06 18:43:25 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}
[2011/04/15 16:46:44 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/10/11 22:35:25 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
[2009/10/21 20:00:37 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
[2009/11/23 20:34:05 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
[2010/07/15 12:35:11 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
[2010/06/12 21:31:16 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/13 20:13:47 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/10/24 00:26:42 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/12/19 21:23:29 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/03/20 00:41:54 | 000,025,048 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll
[2011/03/20 00:41:54 | 000,140,248 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll
[2007/04/10 17:21:08 | 000,163,256 | —- | M] (Microsoft Corporation) – C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
[2009/11/06 16:37:19 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2010/11/12 19:53:06 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2009/07/31 14:06:48 | 001,654,784 | —- | M] (LizardTech) – C:\Program Files\Mozilla Firefox\plugins\npdjvu.dll
[2009/11/06 16:37:20 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
[2011/03/20 00:41:54 | 000,066,520 | —- | M] (mozilla.org) – C:\Program Files\Mozilla Firefox\plugins\npnul32.dll
[2011/01/30 16:45:12 | 000,135,568 | —- | M] (Adobe Systems Inc.) – C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll
[2010/12/11 22:52:09 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
[2010/12/11 22:52:10 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
[2010/12/11 22:52:10 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
[2010/12/11 22:52:10 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
[2010/12/11 22:52:10 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
[2010/12/11 22:52:10 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
[2010/12/11 22:52:10 | 000,159,744 | —- | M] (Apple Inc.) – C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
[2011/03/19 23:38:28 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2011/03/19 23:38:28 | 000,002,193 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\answers.xml
[2011/03/19 23:38:28 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2011/03/19 23:38:28 | 000,001,534 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml
[2011/03/19 23:38:28 | 000,000,769 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2011/03/19 23:38:28 | 000,002,371 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\google.xml
[2011/03/19 23:38:28 | 000,001,178 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml
[2011/03/19 23:38:28 | 000,001,135 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/10/03 14:27:13 | 000,000,782 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.paulponna.com localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (StumbleUpon Launcher) - {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll (stumbleupon.com)
O2 - BHO: (PriceGong Plugin) - {1631550F-191D-4826-B069-D9439253D926} - C:\Program Files\PriceGong\2.2.0\PriceGongIE.dll (PriceGong)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\System32\ActiveToolBand.dll (HiTRUST)
O2 - BHO: (LastPass Browser Helper Object) - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O2 - BHO: (Freecause Toolbar BHO) - {9EBF8AAF-0A31-4786-909A-97A0EF101743} - C:\Program Files\AddThis Toolbar\Toolbar.dll ()
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.)
O2 - BHO: (Nuclear Games Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Gears Helper) - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O2 - BHO: (Simppull Toolbar) - {E4E6BF2A-1667-11DF-A01F-1F9655D89593} - C:\Program Files\simppulltoolbar\simppulltoolbar.dll ()
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll (Yahoo! Inc)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (BitDefender Toolbar) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2010\ietoolbar.dll (BitDefender S.R.L.)
O3 - HKLM\..\Toolbar: (StumbleUpon Toolbar) - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll (stumbleupon.com)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (LastPass Toolbar) - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O3 - HKLM\..\Toolbar: (AddThis Toolbar) - {B43176CC-4D9E-493B-A636-D9CBFE39C6DA} - C:\Program Files\AddThis Toolbar\Toolbar.dll ()
O3 - HKLM\..\Toolbar: (Nuclear Games Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Simppull Toolbar) - {E4E6BF2A-1667-11DF-A01F-1F9655D89593} - C:\Program Files\simppulltoolbar\simppulltoolbar.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (AddThis Toolbar) - {B43176CC-4D9E-493B-A636-D9CBFE39C6DA} - C:\Program Files\AddThis Toolbar\Toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Nuclear Games Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe ()
O4 - HKLM..\Run: [Acer Tour] File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [BDAgent] C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe (BitDefender S.R.L.)
O4 - HKLM..\Run: [BitDefender Antiphishing Helper] C:\Program Files\BitDefender\BitDefender 2010\IEShow.exe (BitDefender S.R.L.)
O4 - HKLM..\Run: [eRecoveryService] File not found
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NMSSupport] C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe (Intel Corporation)
O4 - HKLM..\Run: [NPSStartup] File not found
O4 - HKLM..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe ()
O4 - HKLM..\Run: [Persistence] C:\Windows\System32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Google Update] C:\Users\Jai\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
O4 - HKCU..\Run: [InstallIQUpdater] C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
O4 - HKCU..\Run: [SacReminder] C:\ProgramData\OfficeGuardian\reminder\SacReminder.exe (SAC)
O4 - HKCU..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Jai\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BindDirectlyToPropertySetStorage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : &Gears; Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files\LastPass\LPBar.dll (LastPass)
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\nlaapi.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Program Files\Soluto\soluto.exe /userinit) - C:\Program Files\Soluto\soluto.exe (Soluto)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\Windows\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\Windows\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - igfxdev.dll (Intel Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\Windows\System32\browseui.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Jai\Pictures\Picasa\800px-Nick_mason_goodwood.jpg
O24 - Desktop BackupWallPaper: C:\Users\Jai\Pictures\Picasa\800px-Nick_mason_goodwood.jpg
O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\TSpkg.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2011/04/21 18:01:06 | 000,000,000 | —D | C] – C:\Program Files\W3i
[2011/04/21 18:01:06 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InstallIQ Updater
[2011/04/17 07:28:59 | 000,000,000 | —D | C] – C:\Users\Jai\Desktop\back up
[2011/04/17 07:26:50 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\www
[2011/04/17 07:26:50 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\.trash
[2011/04/17 07:26:49 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\tmp
[2011/04/17 07:26:49 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\public_ftp
[2011/04/17 07:26:49 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\.sqmaildata
[2011/04/17 07:26:49 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\.cpanel
[2011/04/17 07:26:48 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\etc
[2011/04/17 07:26:48 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\.sqmailattach
[2011/04/17 07:26:48 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\.htpasswds
[2011/04/17 07:26:48 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\.fantasticodata
[2011/04/17 07:26:48 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\.autorespond
[2011/04/17 07:26:47 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\mail
[2011/04/17 07:26:46 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\.gem
[2011/04/17 07:26:29 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\public_html
[2011/04/17 07:26:29 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\.gnome2
[2011/04/16 22:18:23 | 000,000,000 | —D | C] – C:\Users\Jai\Desktop\autoblogbuddy
[2011/04/16 22:13:38 | 000,000,000 | —D | C] – C:\Users\Jai\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011/04/16 22:13:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2011/04/15 15:31:38 | 000,292,864 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2011/04/15 15:31:35 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2011/04/15 15:31:23 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/04/15 15:31:23 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/04/15 15:31:23 | 000,602,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/04/15 15:31:22 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/04/15 15:31:22 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/04/15 15:31:22 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/04/15 15:31:22 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/04/15 15:31:21 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/04/15 15:31:21 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/04/15 15:31:21 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2011/04/15 15:31:21 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/04/15 15:31:20 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/04/15 15:31:20 | 000,173,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/04/15 15:31:20 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2011/04/15 15:31:20 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/04/15 15:31:20 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/04/15 15:31:20 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/04/15 15:31:10 | 001,162,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42u.dll
[2011/04/15 15:31:08 | 001,136,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42.dll
[2011/04/15 15:30:59 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dnscacheugc.exe
[2011/04/15 15:30:55 | 002,041,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/04/15 15:30:46 | 000,726,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[2011/04/15 15:30:45 | 000,420,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vbscript.dll
[2011/04/12 22:51:12 | 000,000,000 | —D | C] – C:\Users\Jai\Desktop\downloads
[2011/04/12 22:50:33 | 000,000,000 | —D | C] – C:\Users\Jai\Desktop\Toolkit
[2011/04/12 22:50:07 | 000,000,000 | —D | C] – C:\Users\Jai\Desktop\Marketing
[2011/04/12 22:49:48 | 000,000,000 | —D | C] – C:\Users\Jai\Desktop\Marketing Graphics Toolkit
[2011/04/09 14:15:23 | 000,000,000 | —D | C] – C:\Windows\pss
[2011/04/08 00:00:49 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\wpcommissionsrr
[2011/04/06 18:43:01 | 000,000,000 | —D | C] – C:\Windows\System32\InstantArticleSuite
[2011/04/06 18:43:00 | 000,000,000 | —D | C] – C:\Program Files\InstantArticleSuite
[2011/04/05 16:02:27 | 000,000,000 | —D | C] – C:\Users\Jai\AppData\Roaming\DriverCure
[2011/04/05 16:02:01 | 000,000,000 | —D | C] – C:\Users\Jai\AppData\Roaming\ParetoLogic
[2011/04/01 22:08:42 | 000,000,000 | —D | C] – C:\Users\Jai\.gimp-2.6
[2011/04/01 22:08:13 | 000,000,000 | —D | C] – C:\Users\Jai\.gegl-0.0
[2011/04/01 20:08:27 | 000,000,000 | —D | C] – C:\Program Files\Uniblue
[2011/04/01 20:05:46 | 000,000,000 | —D | C] – C:\Program Files\KwiClick LLC
[2011/04/01 20:04:16 | 000,000,000 | —D | C] – C:\Users\Jai\AppData\Local\PackageAware
[2011/04/01 20:04:02 | 000,000,000 | —D | C] – C:\ProgramData\W3i
[2011/04/01 20:02:47 | 000,000,000 | —D | C] – C:\Program Files\Free Offers from Freeze.com
[2011/04/01 20:01:15 | 000,000,000 | —D | C] – C:\Program Files\PriceGong
[2011/04/01 20:01:14 | 000,000,000 | —D | C] – C:\Program Files\simppulltoolbar
[2011/03/23 13:41:23 | 001,068,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DWrite.dll
[2011/03/23 13:41:16 | 000,288,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsGdiConverter.dll
[2011/03/20 22:56:27 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/03/20 22:53:48 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/03/15 17:09:31 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\Your Own Ebook How to Create PdF for FREE
[2011/03/09 16:27:55 | 000,429,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\EncDec.dll
[2011/03/09 16:27:55 | 000,322,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sbe.dll
[2011/03/09 16:27:54 | 000,177,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mpg2splt.ax
[2011/03/09 16:27:54 | 000,153,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sbeio.dll
[2011/03/02 20:53:53 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\Downloads 1
[2011/03/02 20:51:19 | 000,000,000 | —D | C] – C:\Twitter Tool
[2011/03/02 20:50:50 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\Twitter-Tool-Setup.exe
[2011/02/26 04:04:13 | 000,000,000 | —D | C] – C:\Windows\System32\WindowsPowerShell
[2011/02/26 04:01:45 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrsmgr.dll
[2011/02/26 04:01:23 | 000,040,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrs.exe
[2011/02/26 04:01:23 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrshost.exe
[2011/02/26 04:01:23 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wsmprovhost.exe
[2011/02/26 04:01:19 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wsmplpxy.dll
[2011/02/26 04:01:19 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrssrv.dll
[2011/02/26 04:01:16 | 000,081,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wevtfwd.dll
[2011/02/26 04:01:16 | 000,079,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wecutil.exe
[2011/02/26 04:01:16 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wecapi.dll
[2011/02/26 04:01:16 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WsmRes.dll
[2011/02/26 04:01:14 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pwrshplugin.dll
[2011/02/26 04:01:02 | 000,214,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WsmWmiPl.dll
[2011/02/26 04:01:02 | 000,145,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WsmAuto.dll
[2011/02/26 04:01:01 | 000,252,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WSManMigrationPlugin.dll
[2011/02/26 04:01:01 | 000,246,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WSManHTTPConfig.exe
[2011/02/26 04:01:01 | 000,241,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winrscmd.dll
[2011/02/24 16:54:12 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\DriveSentry Secured
[2011/02/24 16:53:59 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\PRETEC_UG_1.1
[2011/02/24 16:47:04 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\Amazon
[2011/02/10 20:47:14 | 000,000,000 | —D | C] – C:\Users\Jai\AppData\Local\xheader-data
[2011/02/10 20:46:06 | 000,000,000 | —D | C] – C:\Users\Jai\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\XHeader
[2011/02/10 20:45:39 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Thraex Software
[2011/02/10 20:45:38 | 000,000,000 | —D | C] – C:\Program Files\XHeader
[2011/02/09 22:34:23 | 003,602,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2011/02/09 22:34:21 | 003,550,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2011/02/09 22:33:59 | 001,172,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10warp.dll
[2011/02/09 22:33:58 | 000,979,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MFH264Dec.dll
[2011/02/09 22:33:58 | 000,683,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d2d1.dll
[2011/02/09 22:33:58 | 000,135,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsRasterService.dll
[2011/02/09 22:33:57 | 001,554,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xpsservices.dll
[2011/02/09 22:33:57 | 000,876,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsPrint.dll
[2011/02/09 22:33:57 | 000,357,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MFHEAACdec.dll
[2011/02/09 22:33:56 | 000,847,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\OpcServices.dll
[2011/02/09 22:33:56 | 000,302,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfmp4src.dll
[2011/02/09 22:33:56 | 000,261,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfreadwrite.dll
[2011/02/09 22:33:55 | 002,873,344 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mf.dll
[2011/02/09 22:33:55 | 000,478,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxgi.dll
[2011/02/09 22:33:55 | 000,219,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1core.dll
[2011/02/09 22:33:55 | 000,160,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1.dll
[2011/02/09 22:33:54 | 001,029,120 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10.dll
[2011/02/09 22:33:53 | 000,667,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\printfilterpipelinesvc.exe
[2011/02/09 22:33:53 | 000,189,952 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10core.dll
[2011/02/09 22:33:52 | 000,486,400 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10level9.dll
[2011/02/09 22:33:51 | 000,209,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfplat.dll
[2011/02/09 22:33:45 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cdd.dll
[2011/02/09 22:33:42 | 000,098,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfps.dll
[2011/02/09 22:33:40 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\printfilterpipelineprxy.dll
[2011/02/04 13:13:05 | 000,000,000 | —D | C] – C:\Users\Jai\AppData\Roaming\ViralSubmitter
[2011/02/04 13:12:52 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Traffic Predator PRO by Clayne Keegan
[2011/02/04 13:12:50 | 000,000,000 | —D | C] – C:\Program Files\Traffic Predator PRO by Clayne Keegan
[2011/02/01 02:39:14 | 000,000,000 | —D | C] – C:\Windows\System32\Soluto
[2011/01/30 18:02:33 | 000,000,000 | —D | C] – C:\Users\Jai\AppData\Roaming\Soluto
[2011/01/30 17:21:06 | 000,181,704 | —- | C] (Soluto LTD.) – C:\Windows\System32\drivers\PCGenFAM.sys
[2011/01/30 17:20:19 | 000,000,000 | —D | C] – C:\Program Files\Soluto
[2011/01/30 17:19:47 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Soluto
[2011/01/30 17:11:15 | 000,000,000 | —D | C] – C:\ProgramData\Soluto
[2011/01/30 00:43:18 | 000,000,000 | —D | C] – C:\Users\Jai\Documents\Auto Blog Samuri
[2011/01/27 17:16:12 | 000,000,000 | —D | C] – C:\Users\Jai\AppData\Roaming\eBookPro6
[2011/01/24 22:50:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SEOLinkVine Ranker App
[2011/01/24 22:50:16 | 000,000,000 | —D | C] – C:\Program Files\SEOLinkVine
[2010/03/27 21:24:00 | 007,377,096 | —- | C] (LastPass) – C:\Program Files\Common Files\lpuninstall.exe
[2009/12/18 00:31:08 | 000,086,683 | —- | C] (Open Source Software community project) – C:\ProgramData\pthreadgc2.dll
[2009/07/29 19:46:47 | 000,016,384 | —- | C] ( ) – C:\Windows\System32\ClearEvent.exe
[2007/08/16 02:50:06 | 000,053,248 | —- | C] ( ) – C:\Windows\System32\Interop.Shell32.dll

========== Files - Modified Within 90 Days ==========

[2011/04/22 13:02:41 | 000,000,418 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{310B1EC3-96B3-4296-BBA8-E5CF53237D0B}.job
[2011/04/22 12:40:08 | 000,000,900 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3945554959-725833480-59139298-1001UA.job
[2011/04/22 12:24:11 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2011/04/22 12:12:06 | 000,000,878 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/22 11:59:15 | 000,003,168 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/04/22 11:59:15 | 000,003,168 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/04/22 11:10:36 | 003,273,788 | —- | M] () – C:\Users\Jai\Desktop\01-FastAttackSEO-MainGuide.pdf
[2011/04/22 09:55:22 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/04/21 21:40:07 | 000,000,848 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3945554959-725833480-59139298-1001Core.job
[2011/04/21 20:12:12 | 000,644,576 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/04/21 20:12:12 | 000,124,378 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/04/21 20:04:25 | 000,000,328 | —- | M] () – C:\Windows\tasks\RegistryBooster.job
[2011/04/21 20:04:04 | 1063,575,552 | -HS- | M] () – C:\hiberfil.sys
[2011/04/21 11:25:11 | 000,000,372 | —- | M] () – C:\Windows\tasks\PC Health Advisor Defrag.job
[2011/04/17 21:22:53 | 000,000,680 | —- | M] () – C:\Users\Jai\AppData\Local\d3d9caps.dat
[2011/04/17 07:26:50 | 000,000,000 | —- | M] () – C:\Users\Jai\Documents\access-logs
[2011/04/16 22:13:38 | 000,000,818 | —- | M] () – C:\Users\Public\Desktop\WinRAR.lnk
[2011/04/16 20:49:05 | 086,259,433 | —- | M] () – C:\Users\Jai\Desktop\jai1985_wp1_wp_20110329_958.sql
[2011/04/16 20:49:05 | 006,133,976 | R— | M] () – C:\Users\Jai\Desktop\jai1985_wp1_wp_20110329_958.sql.gz
[2011/04/16 20:02:40 | 000,001,789 | —- | M] () – C:\Users\Public\Desktop\FileZilla Client.lnk
[2011/04/16 16:36:07 | 000,326,528 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/04/16 16:34:38 | 000,000,052 | —- | M] () – C:\Windows\System32\ashttpstats.csv
[2011/04/16 16:27:58 | 007,291,017 | —- | M] () – C:\Users\Jai\Desktop\quickstartguide.pdf
[2011/04/16 02:16:31 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2011/04/16 02:16:31 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2011/04/16 00:41:34 | 000,000,269 | —- | M] () – C:\Users\Jai\Desktop\rss_button.php.png
[2011/04/15 16:47:20 | 000,001,728 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/04/14 09:42:04 | 001,961,913 | —- | M] () – C:\Users\Jai\Desktop\im_biggest_secret_new.pdf
[2011/04/14 09:37:27 | 001,967,100 | —- | M] () – C:\Users\Jai\Desktop\internet_marketings_biggest_secret.pdf
[2011/04/13 09:09:40 | 000,477,003 | —- | M] () – C:\Users\Jai\Documents\wpcommissions (2).zip
[2011/04/13 09:05:15 | 000,089,868 | —- | M] () – C:\Users\Jai\Documents\MarketingRiches.zip
[2011/04/13 09:05:05 | 000,391,254 | —- | M] () – C:\Users\Jai\Documents\newbiessoftware.zip
[2011/04/13 09:04:17 | 038,624,459 | —- | M] () – C:\Users\Jai\Documents\websitefire.zip
[2011/04/11 16:31:30 | 000,074,240 | —- | M] () – C:\Users\Jai\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/10 12:20:42 | 000,123,556 | —- | M] () – C:\Users\Jai\Desktop\02-NicheKeywordGoldmine-vol2-Bonus.ods
[2011/04/10 12:20:06 | 000,550,574 | —- | M] () – C:\Users\Jai\Desktop\01-NicheKeywordGoldmine-vol2.ods
[2011/04/09 15:00:24 | 000,001,002 | —- | M] () – C:\Users\Jai\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2011/04/08 19:17:45 | 002,293,136 | —- | M] () – C:\Users\Jai\Documents\TrafficInflux2.0.pdf
[2011/04/08 00:00:30 | 000,015,078 | —- | M] () – C:\Users\Jai\Desktop\wpcommissions.zip
[2011/04/07 01:13:52 | 000,348,950 | —- | M] () – C:\Users\Jai\Desktop\HowToTransferAWordpressBlog.pdf
[2011/04/06 23:42:08 | 001,961,913 | —- | M] () – C:\Users\Jai\Desktop\internet_marketings_biggest_secret_new.pdf
[2011/04/06 23:33:32 | 000,262,923 | —- | M] () – C:\Users\Jai\Desktop\ProductReviewReportX_ku53z4liz8.pdf
[2011/04/06 18:43:02 | 000,001,839 | —- | M] () – C:\Users\Jai\Application Data\Microsoft\Internet Explorer\Quick Launch\Instant Article Submitter.lnk
[2011/04/06 18:43:02 | 000,001,832 | —- | M] () – C:\Users\Jai\Application Data\Microsoft\Internet Explorer\Quick Launch\Instant Article Shuffler.lnk
[2011/04/06 18:43:02 | 000,001,825 | —- | M] () – C:\Users\Jai\Application Data\Microsoft\Internet Explorer\Quick Launch\Instant Article Spinner.lnk
[2011/04/06 18:43:02 | 000,001,815 | —- | M] () – C:\Users\Public\Desktop\Instant Article Submitter.lnk
[2011/04/06 18:43:02 | 000,001,808 | —- | M] () – C:\Users\Public\Desktop\Instant Article Shuffler.lnk
[2011/04/06 18:43:02 | 000,001,801 | —- | M] () – C:\Users\Public\Desktop\Instant Article Spinner.lnk
[2011/04/06 00:35:50 | 000,075,410 | —- | M] () – C:\Users\Jai\Desktop\WP-Simplicity-Add-Posts.zip
[2011/04/06 00:35:40 | 000,047,254 | —- | M] () – C:\Users\Jai\Desktop\WP-Simplicity.zip
[2011/04/03 03:24:00 | 000,000,454 | —- | M] () – C:\Windows\tasks\Driver Robot.job
[2011/03/26 21:41:04 | 000,032,471 | —- | M] () – C:\Users\Jai\Documents\90secondwebsitebuilder-AN-125x125.gif
[2011/03/25 01:54:28 | 001,980,668 | —- | M] () – C:\Users\Jai\Desktop\TrafficEruption.pdf
[2011/03/24 01:46:48 | 000,001,728 | —- | M] () – C:\Users\Jai\Documents\Mozilla Firefox (2).lnk
[2011/03/20 22:56:30 | 000,001,668 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/03/18 12:14:21 | 001,156,603 | —- | M] () – C:\Users\Jai\Desktop\SECockpit_Quickstart_Guide_1.0.pdf
[2011/03/10 18:03:51 | 001,162,240 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mfc42u.dll
[2011/03/10 18:03:51 | 001,136,640 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mfc42.dll
[2011/03/10 00:05:36 | 001,445,768 | —- | M] () – C:\Users\Jai\Documents\FreeReport (2).pdf
[2011/03/09 19:24:30 | 001,402,179 | —- | M] () – C:\Users\Jai\Documents\Bank_Blood_Suckers.pdf
[2011/03/09 19:20:57 | 000,395,797 | —- | M] () – C:\Users\Jai\Documents\million_pound_key.pdf
[2011/03/09 19:18:56 | 000,501,647 | —- | M] () – C:\Users\Jai\Desktop\Revenge_on_rip_offs.pdf
[2011/03/04 22:36:28 | 000,739,580 | —- | M] () – C:\Users\Jai\Documents\abbsetup.pdf
[2011/03/03 14:25:11 | 002,041,856 | —- | M] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/03/02 00:19:15 | 000,000,910 | —- | M] () – C:\Users\Public\Desktop\eLertGadget.lnk
[2011/03/01 17:52:26 | 003,887,187 | —- | M] () – C:\Users\Jai\Desktop\Twitter-Tool-Setup.exe.zip
[2011/03/01 17:48:51 | 010,731,650 | —- | M] () – C:\Users\Jai\Desktop\TubeSamurai_ZedShah.zip
[2011/02/24 16:51:13 | 000,000,286 | —- | M] () – C:\Users\Jai\Documents\PRETEC_UG_1.1 - Shortcut.lnk
[2011/02/24 16:51:07 | 000,000,302 | —- | M] () – C:\Users\Jai\Documents\DriveSentry Secured - Shortcut.lnk
[2011/02/22 15:13:01 | 000,288,768 | —- | M] (Microsoft Corporation) – C:\Windows\System32\XpsGdiConverter.dll
[2011/02/22 14:33:12 | 001,068,544 | —- | M] (Microsoft Corporation) – C:\Windows\System32\DWrite.dll
[2011/02/22 07:18:05 | 000,611,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/02/22 07:17:37 | 000,602,112 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/02/22 07:17:37 | 000,055,296 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/02/22 07:17:08 | 000,043,520 | —- | M] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/02/22 07:16:58 | 000,025,600 | —- | M] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/02/22 07:16:53 | 001,469,440 | —- | M] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/02/22 07:16:40 | 000,164,352 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/02/22 07:16:40 | 000,109,056 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/02/22 07:16:40 | 000,071,680 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2011/02/22 07:16:39 | 000,184,320 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/02/22 07:16:39 | 000,055,808 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2011/02/22 07:16:34 | 000,387,584 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/02/22 06:20:39 | 000,385,024 | —- | M] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/02/22 05:43:54 | 000,133,632 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/02/22 05:43:42 | 000,173,568 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/02/22 05:43:04 | 000,013,312 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/02/22 05:42:38 | 001,638,912 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/02/22 01:11:23 | 000,206,133 | —- | M] () – C:\Users\Jai\Documents\OutsourcingMastery.pdf
[2011/02/19 21:45:00 | 000,001,752 | —- | M] () – C:\Users\Jai\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/02/17 07:23:50 | 000,420,864 | —- | M] (Microsoft Corporation) – C:\Windows\System32\vbscript.dll
[2011/02/17 07:19:43 | 000,726,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[2011/02/16 17:16:37 | 000,034,304 | —- | M] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2011/02/16 15:02:23 | 000,292,864 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2011/02/11 12:09:19 | 000,001,896 | —- | M] () – C:\Users\Jai\Documents\Adobe Reader X (2).lnk
[2011/02/10 21:49:12 | 000,685,298 | —- | M] () – C:\Users\Jai\Documents\userguide.pdf jvpress.pdf
[2011/02/10 20:46:07 | 000,202,121 | —- | M] () – C:\Windows\XHeader Uninstaller.exe
[2011/02/10 20:46:06 | 000,000,792 | —- | M] () – C:\Users\Jai\Desktop\XHeader.lnk
[2011/02/09 15:57:03 | 001,877,379 | —- | M] () – C:\Users\Jai\Documents\vfteaser2.mp4
[2011/02/04 23:28:10 | 000,000,324 | —- | M] () – C:\Users\Jai\Documents\HP Printer Diagnostic Tools.url
[2011/02/04 13:12:52 | 000,001,996 | —- | M] () – C:\Users\Jai\Application Data\Microsoft\Internet Explorer\Quick Launch\Traffic Predator PRO by Clayne Keegan.lnk
[2011/02/04 13:12:52 | 000,001,972 | —- | M] () – C:\Users\Jai\Documents\Traffic Predator PRO by Clayne Keegan.lnk
[2011/02/04 13:06:19 | 002,661,541 | —- | M] () – C:\Users\Jai\Documents\become_super_affiliate.pdf
[2011/02/02 18:11:20 | 000,222,080 | —- | M] (Microsoft Corporation) – C:\Windows\System32\MpSigStub.exe
[2011/02/01 02:39:15 | 000,001,036 | —- | M] () – C:\Windows\System32\Dropbox.lnk
[2011/01/30 19:27:11 | 000,000,874 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/01/30 17:33:04 | 000,000,098 | —- | M] () – C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2011/01/24 20:56:52 | 000,190,977 | —- | M] () – C:\Users\Jai\Documents\7WaystoPromoteAffiliateLinksFree.pdf

========== Files Created - No Company Name ==========

[2011/04/22 11:10:35 | 003,273,788 | —- | C] () – C:\Users\Jai\Desktop\01-FastAttackSEO-MainGuide.pdf
[2011/04/19 12:44:54 | 1063,575,552 | -HS- | C] () – C:\hiberfil.sys
[2011/04/17 07:26:50 | 000,000,125 | —- | C] () – C:\Users\Jai\Documents\.gemrc
[2011/04/17 07:26:50 | 000,000,000 | —- | C] () – C:\Users\Jai\Documents\access-logs
[2011/04/17 07:26:49 | 000,000,049 | —- | C] () – C:\Users\Jai\Documents\.[removed]
[2011/04/17 07:26:49 | 000,000,020 | —- | C] () – C:\Users\Jai\Documents\.contactemail
[2011/04/17 07:26:49 | 000,000,001 | —- | C] () – C:\Users\Jai\Documents\cpbackup-exclude.conf
[2011/04/17 07:26:48 | 000,000,047 | —- | C] () – C:\Users\Jai\Documents\.my.cnf
[2011/04/17 07:26:48 | 000,000,014 | —- | C] () – C:\Users\Jai\Documents\.ftpquota
[2011/04/17 07:26:48 | 000,000,011 | —- | C] () – C:\Users\Jai\Documents\.lastlogin
[2011/04/17 07:26:46 | 010,505,379 | —- | C] () – C:\Users\Jai\Documents\backup-6.17.2010_15-58-27_jai1985.tar.gz
[2011/04/16 22:50:15 | 006,133,976 | R— | C] () – C:\Users\Jai\Desktop\jai1985_wp1_wp_20110329_958.sql.gz
[2011/04/16 22:18:41 | 000,550,574 | —- | C] () – C:\Users\Jai\Desktop\01-NicheKeywordGoldmine-vol2.ods
[2011/04/16 22:18:41 | 000,123,556 | —- | C] () – C:\Users\Jai\Desktop\02-NicheKeywordGoldmine-vol2-Bonus.ods
[2011/04/16 22:18:08 | 001,961,913 | —- | C] () – C:\Users\Jai\Desktop\internet_marketings_biggest_secret_new.pdf
[2011/04/16 22:16:03 | 086,259,433 | —- | C] () – C:\Users\Jai\Desktop\jai1985_wp1_wp_20110329_958.sql
[2011/04/16 22:13:38 | 000,000,818 | —- | C] () – C:\Users\Public\Desktop\WinRAR.lnk
[2011/04/16 16:27:56 | 007,291,017 | —- | C] () – C:\Users\Jai\Desktop\quickstartguide.pdf
[2011/04/16 02:16:31 | 000,000,000 | RHS- | C] () – C:\MSDOS.SYS
[2011/04/16 02:16:31 | 000,000,000 | RHS- | C] () – C:\IO.SYS
[2011/04/16 00:41:04 | 000,000,269 | —- | C] () – C:\Users\Jai\Desktop\rss_button.php.png
[2011/04/15 19:08:17 | 000,001,002 | —- | C] () – C:\Users\Jai\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2011/04/15 16:47:20 | 000,001,728 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/04/14 10:53:21 | 000,348,950 | —- | C] () – C:\Users\Jai\Desktop\HowToTransferAWordpressBlog.pdf
[2011/04/14 09:42:39 | 000,262,923 | —- | C] () – C:\Users\Jai\Desktop\ProductReviewReportX_ku53z4liz8.pdf
[2011/04/14 09:42:04 | 001,961,913 | —- | C] () – C:\Users\Jai\Desktop\im_biggest_secret_new.pdf
[2011/04/14 09:37:27 | 001,967,100 | —- | C] () – C:\Users\Jai\Desktop\internet_marketings_biggest_secret.pdf
[2011/04/13 09:46:01 | 082,610,235 | —- | C] () – C:\Users\Jai\Desktop\UsingBannerAds(2).zip
[2011/04/13 09:45:55 | 073,521,080 | —- | C] () – C:\Users\Jai\Desktop\UsingAdsensePlugin(2).zip
[2011/04/13 09:45:21 | 000,296,814 | —- | C] () – C:\Users\Jai\Desktop\SSP1.0.4.0.rar
[2011/04/13 09:44:41 | 001,680,021 | —- | C] () – C:\Users\Jai\Desktop\PowerEffectsV2.zip
[2011/04/13 09:43:21 | 052,307,803 | —- | C] () – C:\Users\Jai\Desktop\MoneyMakingReviewBlogVids5-6.zip
[2011/04/13 09:42:21 | 000,006,226 | —- | C] () – C:\Users\Jai\Desktop\jvpress-gopages(3).zip
[2011/04/13 09:41:56 | 000,129,412 | —- | C] () – C:\Users\Jai\Desktop\guide.pdf
[2011/04/13 09:41:38 | 103,567,232 | —- | C] () – C:\Users\Jai\Desktop\free-traffic-webinar.zip
[2011/04/08 19:17:42 | 002,293,136 | —- | C] () – C:\Users\Jai\Documents\TrafficInflux2.0.pdf
[2011/04/06 18:43:02 | 000,001,839 | —- | C] () – C:\Users\Jai\Application Data\Microsoft\Internet Explorer\Quick Launch\Instant Article Submitter.lnk
[2011/04/06 18:43:02 | 000,001,832 | —- | C] () – C:\Users\Jai\Application Data\Microsoft\Internet Explorer\Quick Launch\Instant Article Shuffler.lnk
[2011/04/06 18:43:02 | 000,001,825 | —- | C] () – C:\Users\Jai\Application Data\Microsoft\Internet Explorer\Quick Launch\Instant Article Spinner.lnk
[2011/04/06 18:43:02 | 000,001,815 | —- | C] () – C:\Users\Public\Desktop\Instant Article Submitter.lnk
[2011/04/06 18:43:02 | 000,001,808 | —- | C] () – C:\Users\Public\Desktop\Instant Article Shuffler.lnk
[2011/04/06 18:43:02 | 000,001,801 | —- | C] () – C:\Users\Public\Desktop\Instant Article Spinner.lnk
[2011/04/06 18:34:53 | 000,000,680 | —- | C] () – C:\Users\Jai\AppData\Local\d3d9caps.dat
[2011/04/06 00:35:50 | 000,075,410 | —- | C] () – C:\Users\Jai\Desktop\WP-Simplicity-Add-Posts.zip
[2011/04/06 00:35:40 | 000,047,254 | —- | C] () – C:\Users\Jai\Desktop\WP-Simplicity.zip
[2011/04/05 16:01:11 | 000,000,372 | —- | C] () – C:\Windows\tasks\PC Health Advisor Defrag.job
[2011/04/01 20:10:25 | 000,000,328 | —- | C] () – C:\Windows\tasks\RegistryBooster.job
[2011/03/31 23:28:06 | 000,477,003 | —- | C] () – C:\Users\Jai\Documents\wpcommissions (2).zip
[2011/03/31 23:28:06 | 000,015,078 | —- | C] () – C:\Users\Jai\Desktop\wpcommissions.zip
[2011/03/26 21:40:52 | 000,032,471 | —- | C] () – C:\Users\Jai\Documents\90secondwebsitebuilder-AN-125x125.gif
[2011/03/25 01:54:28 | 001,980,668 | —- | C] () – C:\Users\Jai\Desktop\TrafficEruption.pdf
[2011/03/24 23:55:01 | 000,001,789 | —- | C] () – C:\Users\Public\Desktop\FileZilla Client.lnk
[2011/03/24 01:46:48 | 000,001,728 | —- | C] () – C:\Users\Jai\Documents\Mozilla Firefox (2).lnk
[2011/03/20 22:56:30 | 000,001,668 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/03/18 12:14:21 | 001,156,603 | —- | C] () – C:\Users\Jai\Desktop\SECockpit_Quickstart_Guide_1.0.pdf
[2011/03/15 17:11:58 | 005,231,802 | —- | C] () – C:\Users\Jai\Desktop\affpayloadFINALversion.pdf
[2011/03/10 00:05:36 | 001,445,768 | —- | C] () – C:\Users\Jai\Documents\FreeReport (2).pdf
[2011/03/09 19:24:30 | 001,402,179 | —- | C] () – C:\Users\Jai\Documents\Bank_Blood_Suckers.pdf
[2011/03/09 19:20:57 | 000,395,797 | —- | C] () – C:\Users\Jai\Documents\million_pound_key.pdf
[2011/03/09 19:18:55 | 000,501,647 | —- | C] () – C:\Users\Jai\Desktop\Revenge_on_rip_offs.pdf
[2011/03/04 22:36:27 | 000,739,580 | —- | C] () – C:\Users\Jai\Documents\abbsetup.pdf
[2011/03/02 00:19:15 | 000,000,922 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eLertGadget.lnk
[2011/03/02 00:19:15 | 000,000,910 | —- | C] () – C:\Users\Public\Desktop\eLertGadget.lnk
[2011/03/01 17:49:41 | 003,887,187 | —- | C] () – C:\Users\Jai\Desktop\Twitter-Tool-Setup.exe.zip
[2011/03/01 17:41:14 | 010,731,650 | —- | C] () – C:\Users\Jai\Desktop\TubeSamurai_ZedShah.zip
[2011/02/26 04:01:07 | 000,201,184 | —- | C] () – C:\Windows\System32\winrm.vbs
[2011/02/26 04:01:07 | 000,004,675 | —- | C] () – C:\Windows\System32\wsmanconfig_schema.xml
[2011/02/26 04:01:07 | 000,002,426 | —- | C] () – C:\Windows\System32\WsmTxt.xsl
[2011/02/24 16:51:13 | 000,000,286 | —- | C] () – C:\Users\Jai\Documents\PRETEC_UG_1.1 - Shortcut.lnk
[2011/02/24 16:51:07 | 000,000,302 | —- | C] () – C:\Users\Jai\Documents\DriveSentry Secured - Shortcut.lnk
[2011/02/22 01:11:23 | 000,206,133 | —- | C] () – C:\Users\Jai\Documents\OutsourcingMastery.pdf
[2011/02/11 12:09:19 | 000,001,896 | —- | C] () – C:\Users\Jai\Documents\Adobe Reader X (2).lnk
[2011/02/10 21:49:12 | 000,685,298 | —- | C] () – C:\Users\Jai\Documents\userguide.pdf jvpress.pdf
[2011/02/10 20:46:06 | 000,202,121 | —- | C] () – C:\Windows\XHeader Uninstaller.exe
[2011/02/10 20:46:06 | 000,000,792 | —- | C] () – C:\Users\Jai\Desktop\XHeader.lnk
[2011/02/04 23:28:10 | 000,000,324 | —- | C] () – C:\Users\Jai\Documents\HP Printer Diagnostic Tools.url
[2011/02/04 13:12:52 | 000,001,996 | —- | C] () – C:\Users\Jai\Application Data\Microsoft\Internet Explorer\Quick Launch\Traffic Predator PRO by Clayne Keegan.lnk
[2011/02/04 13:12:52 | 000,001,972 | —- | C] () – C:\Users\Jai\Documents\Traffic Predator PRO by Clayne Keegan.lnk
[2011/02/04 13:06:19 | 002,661,541 | —- | C] () – C:\Users\Jai\Documents\become_super_affiliate.pdf
[2011/02/01 02:39:15 | 000,001,036 | —- | C] () – C:\Windows\System32\Dropbox.lnk
[2011/01/30 17:33:04 | 000,000,098 | —- | C] () – C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2011/01/24 20:56:52 | 000,190,977 | —- | C] () – C:\Users\Jai\Documents\7WaystoPromoteAffiliateLinksFree.pdf
[2010/10/23 00:11:03 | 000,028,642 | —- | C] () – C:\Users\Jai\AppData\Roaming\UserTile.png
[2010/08/24 13:22:38 | 000,016,968 | —- | C] () – C:\Windows\System32\drivers\hitmanpro35.sys
[2010/08/12 20:10:37 | 000,000,132 | —- | C] () – C:\Windows\System32\rezumatenoi.dat
[2010/07/19 23:36:01 | 000,120,200 | —- | C] () – C:\Windows\System32\DLLDEV32i.dll
[2010/07/19 23:35:28 | 000,006,211 | —- | C] () – C:\Windows\mgxoschk.ini
[2010/07/18 15:38:59 | 000,000,918 | —- | C] () – C:\Windows\hpomdl40.dat.temp
[2010/07/15 12:25:26 | 000,208,236 | —- | C] () – C:\Windows\hpoins40.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\wsbl.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\phar_unmip.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\phar_histprot.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\ph_white.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\ph_summ.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\ph_black.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pcwords2.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pcwords.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_webproxy.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_video.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_tabloids.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_socialnetworks.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_searchengines.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_regionaltlds.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_pornography.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_onlineshop.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_onlinepay.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_onlinedating.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_news.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_im.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_illegal.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_hate.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_games.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_gambling.dat
[2010/04/15 12:47:09 | 000,000,000 | —- | C] () – C:\Windows\System32\pc_drugs.dat
[2010/04/13 14:50:40 | 000,000,025 | —- | C] () – C:\Users\Jai\AppData\Roaming\bdfvconp.ini
[2010/04/13 13:58:15 | 000,000,016 | —- | C] () – C:\Windows\System32\asdict.dat
[2010/04/13 13:58:15 | 000,000,004 | —- | C] () – C:\Windows\System32\aspdict-en.dat
[2010/04/13 12:52:43 | 000,176,128 | —- | C] () – C:\Windows\System32\msiscan.exe
[2010/02/19 21:23:20 | 000,203,776 | -HS- | C] () – C:\Windows\System32\unrar.exe
[2010/02/02 23:07:17 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\eYe6r.vbs
[2010/02/02 20:33:53 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\Pg4QCyX.vbs
[2010/02/02 16:33:56 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\5R1NaEfBc9oNqAH.vbs
[2010/02/01 20:45:55 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\fBC66.vbs
[2010/02/01 17:37:24 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\udDIEVFtuYtqRY9.vbs
[2010/01/30 21:14:46 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\yWPYBdZMgMqqMjL.vbs
[2010/01/30 14:59:38 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\BsmPF.vbs
[2010/01/30 00:59:46 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\oWjHYUFx7tolNAl.vbs
[2010/01/29 21:17:13 | 000,000,918 | —- | C] () – C:\Windows\hpomdl40.dat
[2010/01/29 20:57:54 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\M7CeIO6TtFtLh.vbs
[2010/01/29 20:40:13 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\iLQd5Ebv2mba41F.vbs
[2010/01/29 16:23:52 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\IGZVJ01xLJpg1.vbs
[2010/01/29 15:51:39 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\m7tnMRFXtrMl1.vbs
[2010/01/28 22:34:48 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\Q4tGw1O.vbs
[2010/01/28 18:05:07 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\deQAGjPZwkitJr1.vbs
[2010/01/27 16:05:11 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\ByJvu.vbs
[2010/01/26 22:36:34 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\s9iZT.vbs
[2010/01/26 21:02:55 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\VzWH5kctq2GyGcL.vbs
[2010/01/26 19:46:46 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\wKGQ2.vbs
[2010/01/25 16:07:35 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\2s4eE.vbs
[2010/01/24 18:55:53 | 000,000,191 | —- | C] () – C:\Users\Jai\AppData\Roaming\44050abe
[2010/01/24 14:02:46 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\5rdPE.vbs
[2010/01/24 00:39:39 | 000,001,372 | —- | C] () – C:\Users\Jai\AppData\Roaming\pGMoov8UIqHbH.vbs
[2009/12/20 02:11:16 | 000,000,020 | —- | C] () – C:\Windows\prefs_zb.dll
[2009/12/18 01:25:18 | 000,110,592 | —- | C] () – C:\Windows\System32\FsUsbExDevice.Dll
[2009/12/18 01:25:18 | 000,036,608 | —- | C] () – C:\Windows\System32\FsUsbExDisk.Sys
[2009/12/18 00:31:07 | 000,203,264 | —- | C] () – C:\ProgramData\swscale-0.dll
[2009/12/18 00:31:07 | 000,028,672 | —- | C] () – C:\ProgramData\avutil-49.dll
[2009/12/18 00:30:56 | 007,876,608 | —- | C] () – C:\ProgramData\avcodec-51.dll
[2009/12/18 00:30:55 | 000,555,520 | —- | C] () – C:\ProgramData\avformat-51.dll
[2009/11/09 03:08:10 | 000,974,848 | —- | C] () – C:\Windows\System32\cis-2.4.dll
[2009/11/09 03:08:10 | 000,081,920 | —- | C] () – C:\Windows\System32\issacapi_bs-2.3.dll
[2009/11/09 03:08:10 | 000,065,536 | —- | C] () – C:\Windows\System32\issacapi_pe-2.3.dll
[2009/11/09 03:08:10 | 000,057,344 | —- | C] () – C:\Windows\System32\issacapi_se-2.3.dll
[2009/09/04 18:02:47 | 000,000,097 | —- | C] () – C:\Windows\System32\PICSDK.ini
[2009/09/04 18:02:46 | 000,111,932 | —- | C] () – C:\Windows\System32\EPPICPrinterDB.dat
[2009/09/04 18:02:46 | 000,031,053 | —- | C] () – C:\Windows\System32\EPPICPattern131.dat
[2009/09/04 18:02:46 | 000,027,417 | —- | C] () – C:\Windows\System32\EPPICPattern121.dat
[2009/09/04 18:02:46 | 000,026,154 | —- | C] () – C:\Windows\System32\EPPICPattern1.dat
[2009/09/04 18:02:46 | 000,024,903 | —- | C] () – C:\Windows\System32\EPPICPattern3.dat
[2009/09/04 18:02:46 | 000,021,390 | —- | C] () – C:\Windows\System32\EPPICPattern5.dat
[2009/09/04 18:02:46 | 000,020,148 | —- | C] () – C:\Windows\System32\EPPICPattern2.dat
[2009/09/04 18:02:46 | 000,011,811 | —- | C] () – C:\Windows\System32\EPPICPattern4.dat
[2009/09/04 18:02:46 | 000,004,943 | —- | C] () – C:\Windows\System32\EPPICPattern6.dat
[2009/09/04 18:02:46 | 000,001,146 | —- | C] () – C:\Windows\System32\EPPICPresetData_DU.dat
[2009/09/04 18:02:46 | 000,001,139 | —- | C] () – C:\Windows\System32\EPPICPresetData_PT.dat
[2009/09/04 18:02:46 | 000,001,139 | —- | C] () – C:\Windows\System32\EPPICPresetData_BP.dat
[2009/09/04 18:02:46 | 000,001,136 | —- | C] () – C:\Windows\System32\EPPICPresetData_ES.dat
[2009/09/04 18:02:46 | 000,001,129 | —- | C] () – C:\Windows\System32\EPPICPresetData_FR.dat
[2009/09/04 18:02:46 | 000,001,129 | —- | C] () – C:\Windows\System32\EPPICPresetData_CF.dat
[2009/09/04 18:02:46 | 000,001,120 | —- | C] () – C:\Windows\System32\EPPICPresetData_IT.dat
[2009/09/04 18:02:46 | 000,001,107 | —- | C] () – C:\Windows\System32\EPPICPresetData_GE.dat
[2009/09/04 18:02:46 | 000,001,104 | —- | C] () – C:\Windows\System32\EPPICPresetData_EN.dat
[2009/08/26 18:04:44 | 000,000,000 | —- | C] () – C:\Users\Jai\AppData\Roaming\wklnhst.dat
[2009/08/11 08:22:31 | 000,000,121 | —- | C] () – C:\Windows\bdagent.INI
[2009/08/11 02:43:55 | 000,081,984 | —- | C] () – C:\Windows\System32\bdod.bin
[2009/08/11 00:43:32 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/08/11 00:43:31 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/08/06 11:03:50 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/07/31 21:17:55 | 000,074,240 | —- | C] () – C:\Users\Jai\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/07/29 20:14:06 | 000,000,044 | —- | C] () – C:\Windows\Acer(Normal).ini
[2009/07/29 20:14:06 | 000,000,042 | —- | C] () – C:\Windows\Acer(Wide).ini
[2009/07/29 19:46:47 | 000,016,384 | —- | C] () – C:\Windows\System32\LauncheRyAgentUser.exe
[2009/07/20 21:17:58 | 000,122,880 | —- | C] () – C:\Windows\System32\AitVirtualComInstall.exe
[2009/07/20 21:10:48 | 000,307,200 | —- | C] () – C:\Windows\System32\InstallVCOM.exe
[2009/01/15 13:45:34 | 000,181,248 | —- | C] () – C:\Windows\System32\txmlutil.dll
[2008/05/04 18:39:34 | 000,002,560 | —- | C] () – C:\Windows\System32\ViaClassCoInstaller.dll
[2008/02/12 03:55:18 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1437.dll
[2008/02/12 03:34:48 | 002,215,364 | —- | C] () – C:\Windows\System32\igklg400.bin
[2008/02/12 03:34:48 | 001,971,732 | —- | C] () – C:\Windows\System32\igklg450.bin
[2008/02/12 03:34:48 | 000,029,932 | —- | C] () – C:\Windows\System32\igmedcompkrn.bin
[2007/12/27 13:14:25 | 000,020,480 | —- | C] () – C:\Windows\System32\PosTickerLib.dll
[2007/10/25 18:26:10 | 000,005,632 | —- | C] () – C:\Windows\System32\drivers\StarOpen.sys
[2007/08/16 03:39:17 | 000,001,024 | RH– | C] () – C:\Windows\System32\NTIBUN4.dll
[2007/08/16 02:50:04 | 000,331,776 | —- | C] () – C:\Windows\System32\ScrollBarLib.dll
[2007/08/16 01:53:36 | 000,000,707 | —- | C] () – C:\Windows\generic.ini
[2007/08/16 01:53:36 | 000,000,107 | —- | C] () – C:\Windows\Alaunch.ini
[2007/08/16 01:53:35 | 000,910,464 | —- | C] () – C:\Windows\System32\igmedkrn.dll
[2007/08/16 01:53:35 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v1283.dll
[2007/08/16 01:53:34 | 000,003,072 | —- | C] () – C:\Windows\System32\34CoInstaller.dll
[2007/04/26 00:33:22 | 000,266,240 | —- | C] () – C:\Windows\System32\NotesExtmngr.dll
[2007/04/26 00:32:50 | 000,204,800 | —- | C] () – C:\Windows\System32\NotesActnMenu.dll
[2007/04/26 00:32:46 | 000,086,016 | —- | C] () – C:\Windows\System32\MSNSpook.dll
[2007/04/26 00:31:00 | 000,028,672 | —- | C] () – C:\Windows\System32\BatchCrypto.dll
[2007/04/26 00:30:52 | 000,073,728 | —- | C] () – C:\Windows\System32\APISlice.dll
[2007/04/26 00:30:44 | 000,063,488 | —- | C] () – C:\Windows\System32\ShowErrMsg.dll
[2007/01/31 14:50:32 | 000,913,408 | —- | C] () – C:\Windows\System32\xreglib.dll
[2006/12/25 23:44:48 | 000,022,016 | —- | C] () – C:\Windows\System32\MailFormat_U.dll
[2006/11/13 13:50:06 | 000,071,680 | —- | C] () – C:\Windows\System32\HTCA_SelfExtract.bin
[2006/11/02 13:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 13:47:37 | 000,326,528 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:33:01 | 000,644,576 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 11:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 11:33:01 | 000,124,378 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 11:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 11:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 09:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 09:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 08:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/06/23 18:09:34 | 000,019,968 | R— | C] () – C:\Windows\System32\cpuinf32.dll
[2001/12/27 00:12:30 | 000,065,536 | —- | C] () – C:\Windows\System32\multiplex_vcd.dll
[2001/09/04 07:46:38 | 000,110,592 | —- | C] () – C:\Windows\System32\Hmpg12.dll
[2001/07/31 00:33:56 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC.dll
[2001/07/24 06:04:36 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC_MMX.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:D1B5B4F1

< End of report >
Post #5
Hi hear is the OTL Extras File Age 90 Days - Scan Results ::: OTL Extras logfile created on: 22/04/2011 12:57:11 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Jai\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19048)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,014.00 Mb Total Physical Memory | 218.00 Mb Available Physical Memory | 21.00% Memory free
3.00 Gb Paging File | 1.00 Gb Available in Paging File | 43.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111.69 Gb Total Space | 35.14 Gb Free Space | 31.47% Space Free | Partition Type: NTFS
Drive D: | 111.43 Gb Total Space | 94.05 Gb Free Space | 84.40% Space Free | Partition Type: NTFS

Computer Name: MEDIA-PC | User Name: Jai | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 90 Days

========== Extra Registry (All) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.chm [@ = chm.file] – C:\Windows\hh.exe (Microsoft Corporation)
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.hta [@ = htafile] – C:\Windows\System32\mshta.exe (Microsoft Corporation)
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.inf [@ = inffile] – C:\Windows\System32\NOTEPAD.EXE (Microsoft Corporation)
.ini [@ = inifile] – C:\Windows\System32\NOTEPAD.EXE (Microsoft Corporation)
.url [@ = InternetShortcut] – C:\Windows\System32\rundll32.exe (Microsoft Corporation)
.js [@ = JSFile] – C:\Windows\System32\WScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] – C:\Windows\System32\WScript.exe (Microsoft Corporation)
.reg [@ = regfile] – C:\Windows\regedit.exe (Microsoft Corporation)
.txt [@ = txtfile] – C:\Windows\System32\NOTEPAD.EXE (Microsoft Corporation)
.vbe [@ = VBEFile] – C:\Windows\System32\WScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] – C:\Windows\System32\WScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] – C:\Windows\System32\WScript.exe (Microsoft Corporation)
.wsh [@ = WSHFile] – C:\Windows\System32\WScript.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
batfile [open] – "%1" %*
batfile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
chm.file [open] – "%SystemRoot%\hh.exe" %1 (Microsoft Corporation)
cmdfile – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
cmdfile [open] – "%1" %*
cmdfile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] – C:\Windows\system32\mshta.exe "%1" %* (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
inffile [open] – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
inffile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
inifile [open] – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
inifile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsfile – C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)
jsfile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsfile [print] – C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)
jsefile – C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)
jsefile [open] – C:\Windows\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsefile [print] – C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile – %SystemRoot%\system32\notepad.exe "%1" (Microsoft Corporation)
regfile [open] – regedit.exe "%1" (Microsoft Corporation)
regfile [merge] – Reg Error: Key error.
regfile [print] – %SystemRoot%\system32\notepad.exe /p "%1" (Microsoft Corporation)
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
txtfile [open] – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
txtfile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
txtfile [printto] – %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" (Microsoft Corporation)
vbefile – "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
vbefile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
vbefile [print] – "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
vbsfile – "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
vbsfile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
vbsfile [print] – "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
wsffile – "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
wsffile [open] – "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
wsffile [print] – "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
wshfile [open] – "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
Unknown [openas] – C:\Program Files\ParetoLogic\FileCure\FileCure_noapp.exe %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3945554959-725833480-59139298-1001]
"EnableNotifications" = 1
"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02F77B27-561C-47A3-A4C4-58A576763C71}" = lport=2869 | protocol=6 | dir=in | app=system |
"{0D1E6E0F-D7D7-4E9D-A0D2-65EC27C4A9CF}" = rport=137 | protocol=17 | dir=out | app=system |
"{165110FB-C553-4859-94BF-D2BC6A921AAA}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{16DABF78-628C-416F-A055-4D1BCD85C2ED}" = rport=10243 | protocol=6 | dir=out | app=system |
"{3A5A1814-27C0-4274-8967-E9106BAB71C3}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3F0D7F46-E859-48BE-BB03-3DAE50176F0B}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{405A839A-F379-42B7-B3F6-605C5311BAA4}" = rport=138 | protocol=17 | dir=out | app=system |
"{657FD5DC-C4A0-49F9-B6BC-59D86CB71057}" = lport=137 | protocol=17 | dir=in | app=system |
"{68838CD4-A344-46D7-A522-BF598EC0044C}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7D85750A-8D0D-42CC-B772-9534C598A64E}" = rport=139 | protocol=6 | dir=out | app=system |
"{84E94D36-DC27-498E-BE6C-15A61CCD6E1B}" = lport=1900 | protocol=17 | dir=in | name=intel® viiv™ media server upnp discovery |
"{85BD9B6F-C8E4-49EF-AA2E-7C8BC69E743C}" = lport=138 | protocol=17 | dir=in | app=system |
"{8903B4C6-4E19-4598-BA43-2EB5D6AFFF18}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8A21F3F7-A1BE-4FCA-8DBE-9736C32D4301}" = lport=10243 | protocol=6 | dir=in | app=system |
"{8A56F176-38E3-43DC-8FBF-4CBA3E2F8853}" = lport=9442 | protocol=17 | dir=in | name=intel® viiv™ media server discovery |
"{9555951F-DF52-42A8-B3DA-8AE1A690E34A}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{97D86FA3-D770-41A1-B464-EB0FF397DCA8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{C8B1C73B-63F9-4302-962F-9B6363B84DD9}" = rport=427 | protocol=17 | dir=in | svc=hpslpsvc | app=c:\windows\system32\svchost.exe |
"{D0285658-0947-40A4-8AE6-02B82A4465D1}" = rport=445 | protocol=6 | dir=out | app=system |
"{E9C53840-FA40-4A5B-9C95-BB6F7C151CC0}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EF2B067A-678C-4541-9007-64ADE7FF66ED}" = lport=139 | protocol=6 | dir=in | app=system |
"{F5900EB5-2DBC-4911-9A21-476871A6AEAB}" = lport=445 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05DD27C3-5B7E-4F87-ABB4-448D939EE769}" = dir=in | app=c:\program files\acer arcade live\acer homemedia connect\kernel\dms\clmsserver.exe |
"{06CFA052-F9E8-4B4E-988F-E67F2D593FAD}" = protocol=6 | dir=out | app=system |
"{0B4BA3C1-6C57-49CD-8790-D4A76B980860}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{112A5505-0E3E-4A00-8E74-FDDCBAFC18E4}" = protocol=17 | dir=in | app=c:\users\jai\appdata\roaming\dropbox\bin\dropbox.exe |
"{1ADCEF70-CBFF-466D-AFBB-75E0661B1C37}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1BAEBA4A-FB3D-415F-BC9E-FF84B3A6097C}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{2218BE1B-DE9D-44CB-95AF-D7C069173A58}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe |
"{22D7EB11-4C39-44AF-A86E-30F41E946200}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{23198EDC-2F54-4FE2-946F-4CD41E9886EA}" = protocol=6 | dir=in | app=c:\program files\addthis toolbar\toolbarupdate.exe |
"{2E343D87-94A9-417B-A236-66FF86164E43}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe |
"{2FF604D5-65E3-4FC2-9C54-C94B7C25CBE3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{32C7DF5E-AC7E-448F-ACCE-92CFEC231BCF}" = protocol=6 | dir=in | app=c:\program files\addthis toolbar\troubleshooter.exe |
"{382FF1FF-74B1-4A20-B000-7A7B8B3D554F}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe |
"{3AC4FB62-2A88-46B2-A7AC-9612A7F12A5A}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\tshwmdtcp.exe |
"{3BD40E90-7A4B-45C6-A9B4-76A7466DA10D}" = dir=in | app=c:\program files\acer arcade live\acer slideshow dvd\acer slideshow dvd.exe |
"{3D824A4E-918B-47EA-BA66-0792109EC03F}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe |
"{3DD840E8-DA16-4C9E-B20F-9908161934E4}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\tshwmdtcp.exe |
"{446CF1CE-D71A-4E45-88DB-01DC302944A1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{477EF352-7C0B-4856-AC69-E0F2A6C2C738}" = protocol=17 | dir=in | app=c:\program files\addthis toolbar\troubleshooter.exe |
"{47BD0288-03DD-43A9-BC27-56703B372131}" = protocol=6 | dir=in | app=c:\users\jai\appdata\roaming\dropbox\bin\dropbox.exe |
"{4FA36BFE-F450-4CE3-AA7A-C4B725F98F7E}" = protocol=6 | dir=in | app=c:\program files\soluto\soluto.exe |
"{52924DDB-6F32-4EC1-8C78-798A9B10DE14}" = protocol=17 | dir=in | app=c:\program files\addthis toolbar\toolbarupdate.exe |
"{53388AF0-9CC7-4515-BBCF-F7F1680D79D0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{57163650-79C3-4701-A5B2-B6AE51A2B2E5}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe |
"{5753C735-F9DE-482F-99BC-FAB82CE22CC9}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe |
"{58507D20-4A8F-448C-80D0-5FA52FF05EBD}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe |
"{5990801C-73F0-44CC-B530-B831BB3C7206}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe |
"{5CEBC44C-FC92-4776-81FA-FDE953ABFC1D}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe |
"{5F31478C-A1B6-4ACC-9525-F910897320F0}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe |
"{5FEF965A-6A50-48D2-8541-D680B0D1416B}" = dir=in | app=e:\setup\hpznui01.exe |
"{609A3F1C-23CD-44DD-B599-0DFE836C4093}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6A9BA957-E207-4DE4-BB7F-69E62FAF9286}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe |
"{6FF3199A-36E0-484E-ACED-8E562F25A8D4}" = dir=in | app=c:\program files\acer arcade live\acer dv magician\acer dv magician.exe |
"{7177F581-4614-4E77-98DC-74BFC13EC06B}" = protocol=6 | dir=in | app=c:\users\jai\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{72883586-F614-420F-BE13-01D840A2E175}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{72AC1439-9558-4834-83F3-B1220AEAEE54}" = dir=in | app=c:\program files\acer arcade live\acer arcade live main page\acer arcade live.exe |
"{78E7717C-C12E-474A-93D9-3431FBC2EB5C}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe |
"{792C3911-B196-4936-8B08-BC5B425944D8}" = protocol=6 | dir=in | app=c:\program files\soluto\solutoconsole.exe |
"{7D9A6EAC-0CD9-4C7C-B7DE-CAAD3BF8E224}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{828F8D2E-D959-40F3-907D-D846C458CA56}" = dir=in | app=c:\program files\acer arcade live\acer tv share\acer tv share.exe |
"{85BE130B-69B9-434F-977B-D2E3F311BD73}" = protocol=6 | dir=in | app=%systemroot%\explorer.exe |
"{863F90E0-6C83-42AD-A2BD-77CDBD2FFC66}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe |
"{8751DEA0-27B4-4992-BF24-2F0A8CD50E11}" = dir=in | app=c:\program files\acer arcade live\acer dvdivine\acer dvdivine.exe |
"{897ECBB4-11ED-4673-BFC5-F3C0ADBF717B}" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"{8C1FB117-656A-4A9E-8254-0BD723200AB0}" = dir=in | app=c:\program files\acer arcade live\acer homemedia\acer homemedia.exe |
"{8F34E120-CC73-45BF-8349-94F29315F1A2}" = dir=in | app=c:\program files\acer arcade live\acer homemedia connect\acer homemedia connect.exe |
"{908EF462-AB9D-4E13-9259-82FBEE7A7BC8}" = dir=in | app=c:\program files\acer arcade live\acer tv share\kernel\dmstv\clmsserver.exe |
"{91C4A579-7ACB-4D80-8A37-071FBFCD2FC2}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\mediaserver.exe |
"{9867BA57-B1CA-4920-AD34-89E424C3CF29}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe |
"{9CD1ECDF-B01B-46D4-BC7A-F920A7437737}" = protocol=17 | dir=in | app=c:\program files\soluto\soluto.exe |
"{9EEB8C8B-99C7-4F54-AEF6-380EE6A6651D}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A0A3532E-A889-4938-ABBF-59D25B628B05}" = protocol=17 | dir=in | app=c:\program files\soluto\solutoservice.exe |
"{A0A48F34-E306-41FB-92A1-7E8C23494231}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A19FBC56-1E8F-4731-BA3C-68B5D7C1BE56}" = protocol=17 | dir=in | app=c:\program files\soluto\solutoupdateservice.exe |
"{A2C1F9BF-F231-4A00-85A9-D4339E06D247}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A741EF68-F30B-4572-A76F-DFF3F19BD25B}" = dir=in | app=c:\program files\acer arcade live\acer videomagician\acer videomagician.exe |
"{A86E6AAE-1230-45F5-8B06-40EBCB0D0BDE}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{B01847D7-401B-4886-B611-7970B4DC1260}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\mediaserver.exe |
"{B508D169-CA84-481B-AE55-9A341DF50BA0}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe |
"{B62165D7-7A34-4E59-8D59-E602D85F2B97}" = protocol=17 | dir=in | app=c:\program files\soluto\solutoconsole.exe |
"{BA2DA54F-6CF2-4D25-9666-5B01FA2B5B16}" = protocol=17 | dir=in | app=c:\users\jai\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{BA62D781-CC26-4550-8ADC-6BC694C411C5}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{C6E0235B-0639-41D6-A6C0-9FC67EE60175}" = protocol=6 | dir=in | app=c:\program files\soluto\solutoservice.exe |
"{CD8CCE93-A107-408E-9424-C60930DE5598}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\shells\remote ui service.exe |
"{D0C539DC-B2D6-4694-8A40-063016B41FA3}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{D592EB49-BEE1-4A45-8CFB-F1BB3D514C5F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D734E208-CBBD-4886-8D12-BF617C67EB68}" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"{D87A8BC1-E029-479F-9507-4B63CE992B68}" = protocol=6 | dir=out | app=%systemroot%\explorer.exe |
"{DA1F1E3C-9376-4BC7-83BD-535D290804E6}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{E2C187DB-5884-4DE8-9467-3A677DFE42BB}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{E60B0A51-04CD-4C25-8A2E-029439F88CE5}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe |
"{ED681D70-E3CF-4F11-9B3D-7604EE048F07}" = protocol=6 | dir=in | app=c:\program files\soluto\solutoupdateservice.exe |
"{ED904386-CB8D-4CE3-806C-64B3C2D89CB6}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe |
"{F66D12E7-0F19-4673-B028-6E2265D16FBC}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe |
"{FAC199C3-16BC-4158-B18A-FB3E74C2E8B5}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\shells\remote ui service.exe |
"{FAE9A7ED-CD02-494D-ABBC-23FB53222D6F}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe |
"{FDC24876-C6D2-408F-BACE-8B46B2191306}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"TCP Query User{052C7A76-99D2-4366-8032-6DF2404D12E6}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{90873209-8FA0-4577-B929-2E5E68CFB0AA}C:\program files\mobiledit!\webvideodownloader.exe" = protocol=6 | dir=in | app=c:\program files\mobiledit!\webvideodownloader.exe |
"TCP Query User{9BC10677-61A1-48C1-8A4D-0E639A6CD39A}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{F179B4B6-8E61-4097-9B1F-80C923CA4139}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{294276FD-8B7B-48A9-9639-18409F561D28}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{62328EC2-3915-447B-B222-459BE6B77CFB}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{80B9CD6C-5285-4256-8E7A-3E2B04133207}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{8940288B-C14E-4029-A7CC-F68E704650C6}C:\program files\mobiledit!\webvideodownloader.exe" = protocol=17 | dir=in | app=c:\program files\mobiledit!\webvideodownloader.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{005F78AF-110D-398A-8430-BE98950A1E22}" = Google Talk Plugin
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{097CDB1E-07C9-40F1-9972-F0F9F3A287E4}" = Network
"{0C297A75-3111-4B3F-9264-84D61FF79F0D}" = Acer TV Share
"{0DAA5653-60D4-44C1-AD10-EC7D4FA4D820}" = Intel® Viiv™ Software
"{105CFC7C-6992-11D5-BD9D-000102C10FD8}" = LizardTech DjVu Control
"{132888AE-EF67-41C5-BCA2-7D5D2488AB63}" = Acer HomeMedia Connect
"{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery
"{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{1598034D-7147-432C-8CA8-888E0632D124}" = NTI Backup NOW! 4.7
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1943A043-5C85-4A16-A0D0-D687B2C1A40F}" = VirtualCom driver
"{1BB744F5-793A-4F94-A019-4EFD792370B8}" = BlogBot
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 23
"{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox
"{2A697B53-0DE3-42DA-B41D-C3F804B1C538}" = iTunes
"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support
"{2FA41EBB-3F5A-35C3-85D6-51EC72A11FBD}" = Google Gears
"{2FB9EA69-51D4-4913-9AD5-762C034DE811}" = Status
"{34095DCB-8356-2DC3-0AF0-133EAB7CEB93}" = eLert Gadget
"{3515DF4C-3529-407E-A1E1-E2C0EDB36FF0}" = KwiClick
"{3B9D1BC9-B8FE-4CD8-945F-A72897E904B6}" = Soluto
"{3DA3F35E-32DB-47D2-9AF7-926460A05E30}" = MagicListBot
"{41581EF5-45A7-11DA-9D78-000129760D75}" = Acer SlideShow DVD
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{497A1721-088F-41EF-8876-B43C9DA5528B}" = ArcSoft Software Suite
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5DCF0E4B-F8EA-4229-A0BD-5CA6D4AFB749}" = SolutionCenter
"{60FFB3E0-6D5B-4D73-AE5B-07E58B83AF0C}" = 32 Bit HP CIO Components Installer
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{710EF1B0-0052-4628-87ED-57FA78CAC6BB}" = SoftwareSubmitterPro
"{7184F382-8A6C-4B85-A3AC-B63734B1E241}" = SAMSUNG Mobile USB Driver
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74DC0593-6BC6-4001-AD5F-D810AFB68D86}" = HP Update
"{7655E113-C306-11D9-A373-0050BAE317E1}" = MCE Software Encoder 1.1
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11029123}" = Bricks of Egypt
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111263673}" = Treasures of the Deep
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111271497}" = Mystery Case Files - Prime Suspects
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}" = Galapago
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111473353}" = Dynasty
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11170417}" = Luxor 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111771833}" = Jewel Quest Solitaire
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112179547}" = MCF Ravenhearst
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{85E563C7-E45B-47AA-BF6D-34983C2BEEF8}" = BitDefender Total Security 2010
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8E0E6383-9754-4471-939E-E4ABE02E3440}" = InstallIQ Updater
"{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90024193-9F13-4877-89D5-A1CDF0CBBF28}" = Feedback Tool
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{94389919-B0AA-4882-9BE8-9F0B004ECA35}" = Acer Tour
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A9DBEBC-C800-4776-A970-D76D6AA405B1}" = PHOTOfunSTUDIO -viewer-
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA4BF92B-2AAF-11DA-9D78-000129760D75}" = Acer HomeMedia
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}" = HPSSupply
"{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X (10.0.1)
"{AEEAE013-92F1-4515-B278-139F1A692A36}" = Acer eDataSecurity Management
"{B145EC69-66F5-11D8-9D75-000129760D75}" = Acer DVDivine
"{B2DAB009-8236-48A0-AD7F-E940F5AB1578}" = HP Photosmart Plus B209a-m All-in-One Driver Software 14.0 Rel. 6
"{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C619A1DC-8EE4-4BD2-82AB-D9424A23E42A}" = Auto Blog Samurai
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp
"{CDC8DBA8-37FF-4C82-84FF-DEBEDF93BEC4}" = PS_AIO_06_B209a-m_SW_Min
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D360FA88-17C8-4F14-B67F-13AAF9607B12}" = MarketResearch
"{D462BF9E-0C35-4705-BF9B-3DF9F3816643}" = Acer ePerformance Management
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"{D8CE69B0-9274-4b8c-BA49-0FF6A20A3C65}" = SAMSUNG SYMBIAN USB Download Driver
"{DDD2DBF1-CB97-481E-9589-41D9EE92B259}_is1" = Hard Cash Hijack Traffic Control 1.0
"{DEB38E1A-F4E5-4DF0-96F4-4050567A9D09}" = AV Input Selection
"{E517094C-06B6-419F-8FFD-EF4F57972130}" = QuickTransfer
"{E617721F-B66C-4D5A-AA2A-B2D60820CDC3}" = B209a-m
"{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}" = Acer Arcade Live Main Page
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F6EFFB76-4A07-11DA-9D78-000129760D75}" = Acer DV Magician
"{F79A208D-D929-11D9-9D77-000129760D75}" = Acer VideoMagician
"{F8131A35-47FD-27AD-116D-0E79AF5DE5EE}" = Acrobat.com
"{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm
"90_Second_Website_Builder" = 90 Second Website Builder 5.5
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"AddThis Toolbar" = AddThis Toolbar
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.9
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"E24870CB6AA1C3511635FF9020A3E9471287FBE7" = Windows Driver Package - MobileTop (sshpmdm) Modem (01/26/2008 2.6.0.0)
"eLertGadget.4E424E86CF86EBE29924D0FD908DE0A0B24C8950.1" = eLert Gadget
"FeedReader_is1" = FeedReader
"FileZilla Client" = FileZilla Client 3.4.0
"Flickr Uploadr" = Flickr Uploadr 3.2.1
"Google Updater" = Google Updater
"HDMI" = Intel® Graphics Media Accelerator Driver
"Heri's RSS Feed Buzz_is1" = Heri's RSS Feed Buzz v2.01
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Imaging Device Functions" = HP Imaging Device Functions 14.0
"HP Photo Creations" = HP Photo Creations
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0
"HPExtendedCapabilities" = HP Customer Participation Program 14.0
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"InstallShield_{1598034D-7147-432C-8CA8-888E0632D124}" = NTI Backup NOW! 4.7
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"Instant Article Suite_is1" = Instant Article Suite v1.10
"Intel® Configuration Center" = Intel® Viiv™ Software
"Kernel for Exchange Server Evaluation ver_is1" = Kernel for Exchange Server Evaluation ver 10.08.01
"LastFM_is1" = Last.fm 1.5.4.24567
"Magic Pop-Up" = Magic Pop-Up 1.0
"MAGIX Slideshow Maker US" = MAGIX Slideshow Maker 1.0.1.3 (US)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"MozBackup" = MozBackup 1.4.10
"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)
"Picasa 3" = Picasa 3
"PriceGong" = PriceGong 2.2.0
"PROSet" = Intel® PRO Network Connections Drivers
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Download Driver" = SAMSUNG Mobile USB Download Driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"Shop for HP Supplies" = Shop for HP Supplies
"StumbleUponIEToolbar" = StumbleUpon IE Toolbar
"Traffic Predator PRO by Clayne Keegan_is1" = Traffic Predator PRO by Clayne Keegan
"Tube Fool" = Tube Fool
"UltraISO_is1" = UltraISO Premium V9.33
"WinRAR archiver" = WinRAR 4.00 (32-bit)
"WinX DVD Ripper Platinum_is1" = WinX DVD Ripper Platinum 5.1.1
"XHeader" = XHeader
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Software Update" = Yahoo! Software Update
"YInstHelper" = Yahoo! Install Manager

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"GoToMeeting" = GoToMeeting 4.5.0.457
"LastPass" = LastPass (uninstall only)

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 21/04/2011 19:01:29 | Computer Name = MEDIA-PC | Source = MySQL | ID = 100
Description = Can't find messagefile 'c:\wamp\bin\mysql\mysql5.1.36\share\english\errmsg.sys'

For
more information, see Help and Support Center at http://www.mysql.com.

Error - 21/04/2011 19:01:33 | Computer Name = MEDIA-PC | Source = MySQL | ID = 100
Description = Can't open the mysql.plugin table. Please run mysql_upgrade to create
it. For more information, see Help and Support Center at http://www.mysql.com.

Error - 21/04/2011 19:01:36 | Computer Name = MEDIA-PC | Source = MySQL | ID = 100
Description = Aborting For more information, see Help and Support Center at http://www.mysql.com.



Error - 21/04/2011 19:02:41 | Computer Name = MEDIA-PC | Source = MySQL | ID = 100
Description = Can't find messagefile 'c:\wamp\bin\mysql\mysql5.1.36\share\english\errmsg.sys'

For
more information, see Help and Support Center at http://www.mysql.com.

Error - 21/04/2011 19:02:48 | Computer Name = MEDIA-PC | Source = MySQL | ID = 100
Description = Can't open the mysql.plugin table. Please run mysql_upgrade to create
it. For more information, see Help and Support Center at http://www.mysql.com.

Error - 21/04/2011 19:02:52 | Computer Name = MEDIA-PC | Source = MySQL | ID = 100
Description = Aborting For more information, see Help and Support Center at http://www.mysql.com.



Error - 22/04/2011 05:08:50 | Computer Name = MEDIA-PC | Source = Application Error | ID = 1000
Description = Faulting application Explorer.EXE, version 6.0.6002.18005, time stamp
0x49e01da5, faulting module simppulltoolbar.dll, version 5.0.8.112, time stamp
0x4b5eb5ce, exception code 0xc0000005, fault offset 0x0001b725, process id 0x8d4,
application start time 0x01cc0056ee621913.

Error - 22/04/2011 05:33:33 | Computer Name = MEDIA-PC | Source = Application Hang | ID = 1002
Description = The program firefox.exe version 1.9.2.4095 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 5e8 Start Time: 01cc0057d33060b3 Termination Time: 28797

Error - 22/04/2011 05:33:37 | Computer Name = MEDIA-PC | Source = Application Error | ID = 1000
Description = Faulting application plugin-container.exe, version 1.9.2.4095, time
stamp 0x4d852c62, faulting module ntdll.dll, version 6.0.6002.18327, time stamp
0x4cb73436, exception code 0xc0000005, fault offset 0x00048822, process id 0x14f0,
application start time 0x01cc00581e70dfa3.

Error - 22/04/2011 07:09:55 | Computer Name = MEDIA-PC | Source = Application Hang | ID = 1002
Description = The program firefox.exe version 1.9.2.4095 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 1788 Start Time: 01cc00d07412b390 Termination Time: 60000

[ IntelDH Events ]
Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

Error - 27/08/2009 12:27:40 | Computer Name = MEDIA-PC | Source = AlertService | ID = 15
Description = A CCU internal function detected an error: XMLDoc::LoadXML failed
with reason: XML document must have a top level element.

[ Media Center Events ]
Error - 24/01/2011 10:27:43 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 01/24/2011 14:27:42. You may need to reschedule your recordings.

Error - 25/01/2011 10:13:42 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 01/25/2011 14:13:40. You may need to reschedule your recordings.

Error - 27/01/2011 10:40:56 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 01/27/2011 14:40:52. You may need to reschedule your recordings.

Error - 29/01/2011 15:18:04 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 01/29/2011 19:18:02. You may need to reschedule your recordings.

Error - 30/01/2011 14:30:43 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 01/30/2011 18:30:43. You may need to reschedule your recordings.

Error - 30/01/2011 14:30:46 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 01/30/2011 18:30:46. You may need to reschedule your recordings.

Error - 30/01/2011 19:18:05 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 01/30/2011 23:18:05. You may need to reschedule your recordings.

Error - 13/02/2011 17:36:41 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 02/13/2011 21:36:41. You may need to reschedule your recordings.

Error - 14/02/2011 21:58:15 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 02/15/2011 01:58:15. You may need to reschedule your recordings.

Error - 08/04/2011 06:49:17 | Computer Name = MEDIA-PC | Source = Recording | ID = 19
Description = The recording schedule has been corrupted and was automatically deleted
on 04/08/2011 11:49:16. You may need to reschedule your recordings.

[ System Events ]
Error - 21/04/2011 18:53:59 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 21/04/2011 18:55:15 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 21/04/2011 18:56:29 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 21/04/2011 18:57:43 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 21/04/2011 18:59:01 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 21/04/2011 19:00:25 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 21/04/2011 19:01:38 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 21/04/2011 19:02:59 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 22/04/2011 04:55:46 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7009
Description =

Error - 22/04/2011 04:55:46 | Computer Name = MEDIA-PC | Source = Service Control Manager | ID = 7000
Description =


< End of report >
Post #7
Hello echoes and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:
• Please follow all instructions in the order posted
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• If you don't understand something, please don't hesitate to ask for clarification before proceeding
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Sorry about the wait but we have more people with problems than we have helpers.

===================================================

Let’s see if we can get this problem sorted.

Run RogueKiller

Note: Do not reboot your computer if at all possible otherwise the malware will reactivate and you will have to run roguekiller again

Download RogueKiller to your desktop.
  • close all running programs
  • for Windows Vista/Seven, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
  • when prompted, type 1 and press Enter
  • the RKreport.txt will be generated next to the executable, (on the desktop).
    If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe
Please post the contents of the RKreport.txt in your next Reply.

Remember: Do not reboot your computer if at all possible otherwise the malware will reactivate and you will have to run roguekiller again


Run ExeHelper

Please download exeHelper by Raktor to your desktop.
Double-click on exeHelper.com to run the fix.
A black window should pop up; press any key to close it once the fix is completed.
Post the contents of exehelperlog.txt (Will be created in the directory where you ran exeHelper.com, and should open at the end of the scan)


Download the GMER Rootkit Scanner

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • All drives/partitions except C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Logs to include with next post:

RKreport.txt
exehelperlog.txt
Gmer.txt

Thanks

Satchfan
Post #8 last edited
Hi Satchfan Thank You for the Reply Hear are the Logs you Requested i may have to Post them a couple of Times as to avoid any Errorrs Thanks Satchfan RK REPORT;:::RogueKiller V4.3.11 [04/25/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRKgmailcom
Feedback: http://www.sur-la-toile.com/discussion-193…-Remontees.html

Operating System: Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Normal mode
User: Jai [Admin rights]
Mode: Scan – Date : 04/26/2011 23:38:40

Bad processes: 0

Registry Entries: 3
[APPDT/TMP/DESKTOP] HKCU\[…]\Run : SacReminder (C:\ProgramData\OfficeGuardian\reminder\SacReminder.exe) -> FOUND
[APPDT/TMP/DESKTOP] HKUS\S-1-5-21-3945554959-725833480-59139298-1001[…]\Run : SacReminder (C:\ProgramData\OfficeGuardian\reminder\SacReminder.exe) -> FOUND
[HJ] HKLM\[…]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

HOSTS File:
127.0.0.1 localhost
127.0.0.1 www.paulponna.com localhost


Finished : << RKreport[1].txt >>
RKreport[1].txt



RogueKiller V4.3.11 [04/25/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRKgmailcom
Feedback: http://www.sur-la-toile.com/discussion-193…-Remontees.html

Operating System: Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Normal mode
User: Jai [Admin rights]
Mode: Remove – Date : 04/26/2011 23:45:11

Bad processes: 0

Registry Entries: 2
[APPDT/TMP/DESKTOP] HKCU\[…]\Run : SacReminder (C:\ProgramData\OfficeGuardian\reminder\SacReminder.exe) -> DELETED
[HJ] HKLM\[…]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)

HOSTS File:
127.0.0.1 localhost
127.0.0.1 www.paulponna.com localhost


Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt



RogueKiller V4.3.11 [04/25/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRKgmailcom
Feedback: http://www.sur-la-toile.com/discussion-193…-Remontees.html

Operating System: Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Normal mode
User: Jai [Admin rights]
Mode: Remove – Date : 04/27/2011 16:21:55

Bad processes: 0

Registry Entries: 0

HOSTS File:
127.0.0.1 localhost
127.0.0.1 www.paulponna.com localhost


Finished : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt



RogueKiller V4.3.11 [04/25/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRKgmailcom
Feedback: http://www.sur-la-toile.com/discussion-193…-Remontees.html

Operating System: Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Normal mode
User: Jai [Admin rights]
Mode: HOSTSFix – Date : 04/27/2011 16:22:55

Bad processes: 0

HOSTS File:
127.0.0.1 localhost
127.0.0.1 www.paulponna.com localhost


Resetted HOSTS:
127.0.0.1 localhost

Finished : << RKreport[4].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt



RogueKiller V4.3.11 [04/25/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRKgmailcom
Feedback: http://www.sur-la-toile.com/discussion-193…-Remontees.html

Operating System: Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Normal mode
User: Jai [Admin rights]
Mode: ProxyFix – Date : 04/27/2011 16:23:24

Bad processes: 0

Registry Entries: 0

Finished : << RKreport[5].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt



RogueKiller V4.3.11 [04/25/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRKgmailcom
Feedback: http://www.sur-la-toile.com/discussion-193…-Remontees.html

Operating System: Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Normal mode
User: Jai [Admin rights]
Mode: DNSFix – Date : 04/27/2011 16:23:55

Bad processes: 0

Registry Entries: 0

Finished : << RKreport[6].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt ;
RKreport[6].txt


RogueKiller V4.3.11 [04/25/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRKgmailcom
Feedback: http://www.sur-la-toile.com/discussion-193…-Remontees.html

Operating System: Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Normal mode
User: Jai [Admin rights]
Mode: Shortcuts HJfix – Date : 04/27/2011 16:25:23

Bad processes: 0

File attributes restored:
Desktop: Success 0 / Fail 0
Quick launch: Success 0 / Fail 0
Programs: Success 0 / Fail 0
Start menu: Success 0 / Fail 0
User folder: Success 17 / Fail 0
My documents: Success 6 / Fail 0
My favorites: Success 0 / Fail 0
My pictures: Success 0 / Fail 0
My music: Success 0 / Fail 0
My videos: Success 0 / Fail 0
Local drives: Success 143 / Fail 1

Finished : << RKreport[7].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt ;
RKreport[6].txt ; RKreport[7].txt



RogueKiller V4.3.11 [04/25/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRKgmailcom
Feedback: http://www.sur-la-toile.com/discussion-193…-Remontees.html

Operating System: Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Normal mode
User: Jai [Admin rights]
Mode: Scan – Date : 04/27/2011 16:26:01

Bad processes: 0

Registry Entries: 0

HOSTS File:
127.0.0.1 localhost


Finished : << RKreport[8].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt ;
RKreport[6].txt ; RKreport[7].txt ; RKreport[8].txt Hi Satchfan Thank You for the Reply Hear is the exeHelper;::: exeHelper by Raktor
Build 20100414
Run at 15:46:54 on 04/27/11
Now searching…
Checking for numerical processes…
Checking for sysguard processes…
Checking for bad processes…
Checking for bad files…
Checking for bad registry entries…
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values…
Resetting policies…
–Finished–
Post #9
Hi Satchfan hear is more >>> GMER Hi Satchfan Thank You Hear is the GMER;::: GMER 1.0.15.15570 - http://www.gmer.net
Rootkit scan 2011-04-27 10:10:55
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 ST3250310AS rev.3.AAD
Running: gmer.exe; Driver: C:\Users\Jai\AppData\Local\Temp\kwdoypod.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0x83256CDC]
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0x83256ECE]
SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS ZwTerminateProcess [0x8D87D620]
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateUserProcess [0x832570D6]

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!KeSetEvent + 209 826B898C 8 Bytes [DC, 6C, 25, 83, CE, 6E, 25, …]
.text ntkrnlpa.exe!KeSetEvent + 621 826B8DA4 4 Bytes [20, D6, 87, 8D]
.text ntkrnlpa.exe!KeSetEvent + 6E5 826B8E68 4 Bytes [D6, 70, 25, 83]
? \ArcName\multi(0)disk(0)rdisk(0)partition(2)\Windows\system32\drivers\PctWfpFilter.sys The system cannot find the path specified. !

—- User code sections - GMER 1.0.15 —-

.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F3E0F5A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F370F5A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [3C, 5F] {CMP AL, 0x5f}
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F410F5A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\System32\igfxpers.exe[252] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\System32\igfxpers.exe[252] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\System32\igfxpers.exe[252] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\System32\igfxpers.exe[252] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\System32\igfxpers.exe[252] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\System32\igfxpers.exe[252] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [93, 70]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [D6, 70]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 7015000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!MoveFileW 776DA2F2 6 Bytes JMP 6F97000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CopyFileW 776E0299 6 Bytes JMP 6FF8000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 6FAD000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 6FB0000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!MoveFileExW 776F10C8 6 Bytes JMP 6F91000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!OpenMutexA 776F33F7 6 Bytes JMP 6FC5000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateMutexA 776F9431 6 Bytes JMP 6FCB000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7074000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7097000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!TerminateThread 777141F7 6 Bytes JMP 70D4000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!OpenProcess 77717267 6 Bytes JMP 6F8E000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!GetProcAddress 7771903B 6 Bytes JMP 707B000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!OpenMutexW 7771AA85 6 Bytes JMP 6FC2000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 7018000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateFileW 7771AECB 6 Bytes JMP 7025000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateThread 7771C90E 6 Bytes JMP 701B000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 6F9D000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 6FBF000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateFileA 7771CE5F 6 Bytes JMP 7022000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 6FE1000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateMutexW 7771D555 6 Bytes JMP 6FC8000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!MoveFileExA 77720F0A 6 Bytes JMP 6F94000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CopyFileA 77722433 6 Bytes JMP 6FFB000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 6FE4000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 70D1000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!MoveFileA 7775F641 6 Bytes JMP 6F9A000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CopyFileExA 777619F9 6 Bytes JMP 6FF5000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!SetThreadContext 7776794A 6 Bytes JMP 6FDA000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 6FAA000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7071000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 705A000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 7054000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 6FCE000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 6FD1000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 7057000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 6FD4000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 706E000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 704E000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 7051000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 704B000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 6FD7000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [7D, 70] {JGE 0x72}
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F3E0F5A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 70C7000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7081000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F370F5A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [C3, 70]
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [01, 70]
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 6FB6000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 6FB3000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [3C, 5F] {CMP AL, 0x5f}
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 70CE000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 6FB9000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 6FA0000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 6FBC000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 6FA3000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 709A000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F410F5A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\Soluto\soluto.exe[388] shell32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\Soluto\soluto.exe[388] shell32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 6FEB000A
.text C:\Program Files\Soluto\soluto.exe[388] shell32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\Soluto\soluto.exe[388] shell32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\Soluto\soluto.exe[388] shell32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\Soluto\soluto.exe[388] shell32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 6FEE000A
.text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtClose
Post #10
Hi Satchfan Thank You Hear is the GMER;::: GMER 1.0.15.15570 - http://www.gmer.net
Rootkit scan 2011-04-27 10:10:55
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 ST3250310AS rev.3.AAD
Running: gmer.exe; Driver: C:\Users\Jai\AppData\Local\Temp\kwdoypod.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0x83256CDC]
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0x83256ECE]
SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS ZwTerminateProcess [0x8D87D620]
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateUserProcess [0x832570D6]

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!KeSetEvent + 209 826B898C 8 Bytes [DC, 6C, 25, 83, CE, 6E, 25, …]
.text ntkrnlpa.exe!KeSetEvent + 621 826B8DA4 4 Bytes [20, D6, 87, 8D]
.text ntkrnlpa.exe!KeSetEvent + 6E5 826B8E68 4 Bytes [D6, 70, 25, 83]
? \ArcName\multi(0)disk(0)rdisk(0)partition(2)\Windows\system32\drivers\PctWfpFilter.sys The system cannot find the path specified. !

—- User code sections - GMER 1.0.15 —-

.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\System32\igfxpers.exe[252] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F3E0F5A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F370F5A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [3C, 5F] {CMP AL, 0x5f}
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F410F5A
.text C:\Windows\System32\igfxpers.exe[252] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\System32\igfxpers.exe[252] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\System32\igfxpers.exe[252] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\System32\igfxpers.exe[252] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\System32\igfxpers.exe[252] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\System32\igfxpers.exe[252] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\System32\igfxpers.exe[252] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\System32\igfxpers.exe[252] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [93, 70]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [D6, 70]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 7015000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!MoveFileW 776DA2F2 6 Bytes JMP 6F97000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CopyFileW 776E0299 6 Bytes JMP 6FF8000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 6FAD000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 6FB0000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!MoveFileExW 776F10C8 6 Bytes JMP 6F91000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!OpenMutexA 776F33F7 6 Bytes JMP 6FC5000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateMutexA 776F9431 6 Bytes JMP 6FCB000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7074000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7097000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!TerminateThread 777141F7 6 Bytes JMP 70D4000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!OpenProcess 77717267 6 Bytes JMP 6F8E000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!GetProcAddress 7771903B 6 Bytes JMP 707B000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!OpenMutexW 7771AA85 6 Bytes JMP 6FC2000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 7018000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateFileW 7771AECB 6 Bytes JMP 7025000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateThread 7771C90E 6 Bytes JMP 701B000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 6F9D000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 6FBF000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateFileA 7771CE5F 6 Bytes JMP 7022000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 6FE1000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateMutexW 7771D555 6 Bytes JMP 6FC8000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!MoveFileExA 77720F0A 6 Bytes JMP 6F94000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CopyFileA 77722433 6 Bytes JMP 6FFB000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 6FE4000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 70D1000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!MoveFileA 7775F641 6 Bytes JMP 6F9A000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!CopyFileExA 777619F9 6 Bytes JMP 6FF5000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\Soluto\soluto.exe[388] KERNEL32.dll!SetThreadContext 7776794A 6 Bytes JMP 6FDA000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 6FAA000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7071000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 705A000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 7054000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 6FCE000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 6FD1000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 7057000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 6FD4000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 706E000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 704E000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 7051000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 704B000A
.text C:\Program Files\Soluto\soluto.exe[388] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 6FD7000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [7D, 70] {JGE 0x72}
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F3E0F5A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 70C7000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7081000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F370F5A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [C3, 70]
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [01, 70]
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 6FB6000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 6FB3000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [3C, 5F] {CMP AL, 0x5f}
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 70CE000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 6FB9000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 6FA0000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 6FBC000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 6FA3000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 709A000A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F410F5A
.text C:\Program Files\Soluto\soluto.exe[388] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\Soluto\soluto.exe[388] shell32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\Soluto\soluto.exe[388] shell32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 6FEB000A
.text C:\Program Files\Soluto\soluto.exe[388] shell32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\Soluto\soluto.exe[388] shell32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\Soluto\soluto.exe[388] shell32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\Soluto\soluto.exe[388] shell32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 6FEE000A
.text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtClose
Post #11
Hi Satchfan hear is more >>> GMER 77C74164 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI} .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f} .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f} .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI} .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI} .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F] .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71] .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A .text C:\Windows\system32\Dwm.exe[464] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A .text C:\Windows\system32\Dwm.exe[464] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A .text C:\Windows\system32\Dwm.exe[464] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A .text C:\Windows\system32\Dwm.exe[464] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A .text C:\Windows\system32\Dwm.exe[464] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A .text C:\Windows\system32\Dwm.exe[464] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A .text C:\Windows\system32\Dwm.exe[464] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A .text C:\Windows\system32\Dwm.exe[464] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A .text C:\Windows\system32\Dwm.exe[464] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A .text C:\Windows\system32\Dwm.exe[464] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A .text C:\Windows\system32\Dwm.exe[464] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A .text C:\Windows\system32\Dwm.exe[464] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A .text C:\Windows\system32\Dwm.exe[464] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A .text C:\Windows\system32\Dwm.exe[464] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A .text C:\Windows\system32\Dwm.exe[464] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71] .text C:\Windows\system32\Dwm.exe[464] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A .text C:\Windows\system32\Dwm.exe[464] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A .text C:\Windows\system32\Dwm.exe[464] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A .text C:\Windows\system32\Dwm.exe[464] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A .text C:\Windows\system32\Dwm.exe[464] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71] .text C:\Windows\system32\Dwm.exe[464] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\Dwm.exe[464] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70} .text C:\Windows\system32\Dwm.exe[464] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A .text C:\Windows\system32\Dwm.exe[464] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A .text C:\Windows\system32\Dwm.exe[464] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A .text C:\Windows\system32\Dwm.exe[464] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A .text C:\Windows\system32\Dwm.exe[464] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A .text C:\Windows\system32\Dwm.exe[464] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A .text C:\Windows\system32\Dwm.exe[464] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A .text C:\Windows\system32\Dwm.exe[464] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A .text C:\Windows\system32\Dwm.exe[464] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A .text C:\Windows\system32\Dwm.exe[464] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A .text C:\Windows\system32\Dwm.exe[464] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A .text C:\Windows\system32\Dwm.exe[464] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A .text C:\Windows\system32\Dwm.exe[464] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A .text C:\Windows\system32\Dwm.exe[464] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A .text C:\Windows\system32\Dwm.exe[464] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI} .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f} .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f} .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI} .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI} .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7042000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 7058000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 705B000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 703C000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7070000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 7076000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 7039000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 706D000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 7048000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 706A000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 708C000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7073000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 703F000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 708F000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 7045000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 7085000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F3E0F5A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F370F5A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70} .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7061000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 705E000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [3C, 5F] {CMP AL, 0x5f} .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 7064000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 704B000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 7067000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 704E000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F410F5A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 7055000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 7079000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 707C000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 707F000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7082000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] WININET.dll!InternetOpenUrlA 7760F3A4 6 Bytes JMP 7095000A .text C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe[556] WININET.dll!InternetOpenUrlW 77656D5F 6 Bytes JMP 7092000A .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI} .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f} .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f} .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI} .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI} .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F] .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71] .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A .text C:\Windows\system32\taskeng.exe[572] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A .text C:\Windows\system32\taskeng.exe[572] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A .text C:\Windows\system32\taskeng.exe[572] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A .text C:\Windows\system32\taskeng.exe[572] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A .text C:\Windows\system32\taskeng.exe[572] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A .text C:\Windows\system32\taskeng.exe[572] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A .text C:\Windows\system32\taskeng.exe[572] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A .text C:\Windows\system32\taskeng.exe[572] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A .text C:\Windows\system32\taskeng.exe[572] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A .text C:\Windows\system32\taskeng.exe[572] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A .text C:\Windows\system32\taskeng.exe[572] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A .text C:\Windows\system32\taskeng.exe[572] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A .text C:\Windows\system32\taskeng.exe[572] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A .text C:\Windows\system32\taskeng.exe[572] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A .text C:\Windows\system32\taskeng.exe[572] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71] .text C:\Windows\system32\taskeng.exe[572] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A .text C:\Windows\system32\taskeng.exe[572] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F3E0F5A .text C:\Windows\system32\taskeng.exe[572] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A .text C:\Windows\system32\taskeng.exe[572] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A .text C:\Windows\system32\taskeng.exe[572] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A .text C:\Windows\system32\taskeng.exe[572] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F370F5A .text C:\Windows\system32\taskeng.exe[572] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71] .text C:\Windows\system32\taskeng.exe[572] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70} .text C:\Windows\system32\taskeng.exe[572] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A .text C:\Windows\system32\taskeng.exe[572] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A .text C:\Windows\system32\taskeng.exe[572] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[572] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [3C, 5F] {CMP AL, 0x5f} .text C:\Windows\system32\taskeng.exe[572] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A .text C:\Windows\system32\taskeng.exe[572] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A .text C:\Windows\system32\taskeng.exe[572] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A .text C:\Windows\system32\taskeng.exe[572] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A .text C:\Windows\system32\taskeng.exe[572] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A .text C:\Windows\system32\taskeng.exe[572] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A .text C:\Windows\system32\taskeng.exe[572] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F410F5A .text C:\Windows\system32\taskeng.exe[572] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A .text C:\Windows\system32\taskeng.exe[572] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A .text C:\Windows\system32\taskeng.exe[572] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A .text C:\Windows\system32\taskeng.exe[572] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A .text C:\Windows\system32\taskeng.exe[572] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A .text C:\Windows\system32\taskeng.exe[572] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A .text C:\Windows\system32\taskeng.exe[572] SHELL32.dll!Shell_NotifyIcon
Post #12
Hi Satchfan hear is more >>> GMER 764CBAED 6 Bytes JMP 709F000A .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI} .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f} .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f} .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI} .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI} .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[592] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F] .text C:\Windows\system32\csrss.exe[592] KERNEL32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI} .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f} .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f} .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI} .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI} .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F] .text C:\Windows\Explorer.EXE[628] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70B2000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 6EE7000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 708D000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 6EFD000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 6F00000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 6EE1000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7033000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A .text C:\Windows\Explorer.EXE[628] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 703E000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 6EDE000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7030000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70B5000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70CA000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70B8000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71] .text C:\Windows\Explorer.EXE[628] kernel32.dll!WideCharToMultiByte 7771CBF8 4 Bytes [FF, 25, 1E, 00] .text C:\Windows\Explorer.EXE[628] kernel32.dll!WideCharToMultiByte + 5 7771CBFD 1 Byte [6E] .text C:\Windows\Explorer.EXE[628] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 6F0F000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70BF000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7054000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7036000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 6EE4000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 7090000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7057000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 6EEA000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 7089000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A .text C:\Windows\Explorer.EXE[628] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 704D000A .text C:\Windows\Explorer.EXE[628] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 6EFA000A .text C:\Windows\Explorer.EXE[628] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A .text C:\Windows\Explorer.EXE[628] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A .text C:\Windows\Explorer.EXE[628] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A .text C:\Windows\Explorer.EXE[628] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 7041000A .text C:\Windows\Explorer.EXE[628] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7044000A .text C:\Windows\Explorer.EXE[628] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A .text C:\Windows\Explorer.EXE[628] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7047000A .text C:\Windows\Explorer.EXE[628] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A .text C:\Windows\Explorer.EXE[628] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A .text C:\Windows\Explorer.EXE[628] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A .text C:\Windows\Explorer.EXE[628] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A .text C:\Windows\Explorer.EXE[628] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 704A000A .text C:\Windows\Explorer.EXE[628] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71] .text C:\Windows\Explorer.EXE[628] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A .text C:\Windows\Explorer.EXE[628] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A .text C:\Windows\Explorer.EXE[628] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A .text C:\Windows\Explorer.EXE[628] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A .text C:\Windows\Explorer.EXE[628] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71] .text C:\Windows\Explorer.EXE[628] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E] .text C:\Windows\Explorer.EXE[628] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [9E, 70] .text C:\Windows\Explorer.EXE[628] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 6F06000A .text C:\Windows\Explorer.EXE[628] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 6F03000A .text C:\Windows\Explorer.EXE[628] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A .text C:\Windows\Explorer.EXE[628] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 6F09000A .text C:\Windows\Explorer.EXE[628] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 6EF0000A .text C:\Windows\Explorer.EXE[628] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 6F0C000A .text C:\Windows\Explorer.EXE[628] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 6EF3000A .text C:\Windows\Explorer.EXE[628] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A .text C:\Windows\Explorer.EXE[628] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A .text C:\Windows\Explorer.EXE[628] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A .text C:\Windows\Explorer.EXE[628] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 7065000A .text C:\Windows\Explorer.EXE[628] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A .text C:\Windows\Explorer.EXE[628] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A .text C:\Windows\Explorer.EXE[628] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A .text C:\Windows\Explorer.EXE[628] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 7068000A .text C:\Windows\Explorer.EXE[628] WININET.dll!InternetOpenUrlA 7760F3A4 6 Bytes JMP 705E000A .text C:\Windows\Explorer.EXE[628] WININET.dll!InternetOpenUrlW 77656D5F 6 Bytes JMP 705A000A .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI} .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f} .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f} .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI} .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI} .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F] .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7042000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 7058000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 705B000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 703C000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7070000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 7076000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 7039000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 706D000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71] .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 7048000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 706A000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 708C000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7073000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 703F000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 708F000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 7045000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A .text C:\Windows\system32\taskeng.exe[632] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 7085000A .text C:\Windows\system32\taskeng.exe[632] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 7055000A .text C:\Windows\system32\taskeng.exe[632] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A .text C:\Windows\system32\taskeng.exe[632] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A .text C:\Windows\system32\taskeng.exe[632] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A .text C:\Windows\system32\taskeng.exe[632] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 7079000A .text C:\Windows\system32\taskeng.exe[632] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 707C000A .text C:\Windows\system32\taskeng.exe[632] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A .text C:\Windows\system32\taskeng.exe[632] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 707F000A .text C:\Windows\system32\taskeng.exe[632] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A .text C:\Windows\system32\taskeng.exe[632] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A .text C:\Windows\system32\taskeng.exe[632] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A .text C:\Windows\system32\taskeng.exe[632] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A .text C:\Windows\system32\taskeng.exe[632] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7082000A .text C:\Windows\system32\taskeng.exe[632] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71] .text C:\Windows\system32\taskeng.exe[632] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A .text C:\Windows\system32\taskeng.exe[632] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A .text C:\Windows\system32\taskeng.exe[632] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A .text C:\Windows\system32\taskeng.exe[632] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A .text C:\Windows\system32\taskeng.exe[632] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71] .text C:\Windows\system32\taskeng.exe[632] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[632] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70} .text C:\Windows\system32\taskeng.exe[632] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7061000A .text C:\Windows\system32\taskeng.exe[632] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 705E000A .text C:\Windows\system32\taskeng.exe[632] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A .text C:\Windows\system32\taskeng.exe[632] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 7064000A .text C:\Windows\system32\taskeng.exe[632] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 704B000A .text C:\Windows\system32\taskeng.exe[632] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 7067000A .text C:\Windows\system32\taskeng.exe[632] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 704E000A .text C:\Windows\system32\taskeng.exe[632] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A .text C:\Windows\system32\taskeng.exe[632] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A .text C:\Windows\system32\taskeng.exe[632] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A .text C:\Windows\system32\taskeng.exe[632] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A .text C:\Windows\system32\taskeng.exe[632] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A .text C:\Windows\system32\taskeng.exe[632] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A .text C:\Windows\system32\taskeng.exe[632] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A .text C:\Windows\system32\taskeng.exe[632] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A .text C:\Windows\system32\taskeng.exe[632] WININET.dll!InternetOpenUrlA 7760F3A4 6 Bytes JMP 7095000A .text C:\Windows\system32\taskeng.exe[632] WININET.dll!InternetOpenUrlW 77656D5F 6 Bytes JMP 7092000A .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI} .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f} .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f} .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI} .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI} .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F] .text C:\Windows\system32\wininit.exe[636] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71] .text C:\Windows\system32\wininit.exe[636] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A .text C:\Windows\system32\wininit.exe[636] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A .text C:\Windows\system32\wininit.exe[636] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A .text C:\Windows\system32\wininit.exe[636] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A .text C:\Windows\system32\wininit.exe[636] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A .text C:\Windows\system32\wininit.exe[636] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A .text C:\Windows\system32\wininit.exe[636] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A .text C:\Windows\system32\wininit.exe[636] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A .text C:\Windows\system32\wininit.exe[636] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A .text C:\Windows\system32\wininit.exe[636] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A .text C:\Windows\system32\wininit.exe[636] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A .text C:\Windows\system32\wininit.exe[636] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A .text C:\Windows\system32\wininit.exe[636] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A .text C:\Windows\system32\wininit.exe[636] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A .text C:\Windows\system32\wininit.exe[636] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A .text C:\Windows\system32\wininit.exe[636] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71] .text C:\Windows\system32\wininit.exe[636] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A .text C:\Windows\system32\wininit.exe[636] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A .text C:\Windows\system32\wininit.exe[636] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A .text C:\Windows\system32\wininit.exe[636] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A .text C:\Windows\system32\wininit.exe[636] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71] .text C:\Windows\system32\wininit.exe[636] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wininit.exe[636] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70} .text C:\Windows\system32\wininit.exe[636] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A .text C:\Windows\system32\wininit.exe[636] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A .text C:\Windows\system32\wininit.exe[636] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A .text C:\Windows\system32\wininit.exe[636] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A .text C:\Windows\system32\wininit.exe[636] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A .text C:\Windows\system32\wininit.exe[636] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A .text C:\Windows\system32\wininit.exe[636] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A .text C:\Windows\system32\wininit.exe[636] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A .text C:\Windows\system32\wininit.exe[636] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A .text C:\Windows\system32\wininit.exe[636] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A .text C:\Windows\system32\wininit.exe[636] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A .text C:\Windows\system32\wininit.exe[636] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A .text C:\Windows\system32\wininit.exe[636] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A .text C:\Windows\system32\wininit.exe[636] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A .text C:\Windows\system32\wininit.exe[636] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI} .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f} .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f} .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI} .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI} .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\csrss.exe[648] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F] .text C:\Windows\system32\csrss.exe[648] KERNEL32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A .text C:\Windows\system32\services.exe[680] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI} .text C:\Windows\system32\services.exe[680] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f} .text C:\Windows\system32\services.exe[680] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f} .text C:\Windows\system32\services.exe[680] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI} .text C:\Windows\system32\services.exe[680] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI} .text C:\Windows\system32\services.exe[680] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F] .text C:\Windows\system32\services.exe[680] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
Post #13
Hi Satchfan hear is more >>> GMER .text C:\Windows\system32\services.exe[680] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A .text C:\Windows\system32\services.exe[680] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A .text C:\Windows\system32\services.exe[680] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A .text C:\Windows\system32\services.exe[680] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A .text C:\Windows\system32\services.exe[680] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A .text C:\Windows\system32\services.exe[680] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A .text C:\Windows\system32\services.exe[680] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A .text C:\Windows\system32\services.exe[680] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A .text C:\Windows\system32\services.exe[680] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A .text C:\Windows\system32\services.exe[680] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A .text C:\Windows\system32\services.exe[680] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A .text C:\Windows\system32\services.exe[680] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A .text C:\Windows\system32\services.exe[680] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A .text C:\Windows\system32\services.exe[680] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A .text C:\Windows\system32\services.exe[680] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A .text C:\Windows\system32\services.exe[680] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A .text C:\Windows\system32\services.exe[680] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A .text C:\Windows\system32\services.exe[680] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A .text C:\Windows\system32\services.exe[680] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A .text C:\Windows\system32\services.exe[680] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A .text C:\Windows\system32\services.exe[680] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A .text C:\Windows\system32\services.exe[680] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A .text C:\Windows\system32\services.exe[680] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A .text C:\Windows\system32\services.exe[680] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71] .text C:\Windows\system32\services.exe[680] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A .text C:\Windows\system32\services.exe[680] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A .text C:\Windows\system32\services.exe[680] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A .text C:\Windows\system32\services.exe[680] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A .text C:\Windows\system32\services.exe[680] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A .text C:\Windows\system32\services.exe[680] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A .text C:\Windows\system32\services.exe[680] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A .text C:\Windows\system32\services.exe[680] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A .text C:\Windows\system32\services.exe[680] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A .text C:\Windows\system32\services.exe[680] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A .text C:\Windows\system32\services.exe[680] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A .text C:\Windows\system32\services.exe[680] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A .text C:\Windows\system32\services.exe[680] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A .text C:\Windows\system32\services.exe[680] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A .text C:\Windows\system32\services.exe[680] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A .text C:\Windows\system32\services.exe[680] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A .text C:\Windows\system32\services.exe[680] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A .text C:\Windows\system32\services.exe[680] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A .text C:\Windows\system32\services.exe[680] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A .text C:\Windows\system32\services.exe[680] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A .text C:\Windows\system32\services.exe[680] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A .text C:\Windows\system32\services.exe[680] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A .text C:\Windows\system32\services.exe[680] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A .text C:\Windows\system32\services.exe[680] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A .text C:\Windows\system32\services.exe[680] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A .text C:\Windows\system32\services.exe[680] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A .text C:\Windows\system32\services.exe[680] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71] .text C:\Windows\system32\services.exe[680] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A .text C:\Windows\system32\services.exe[680] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A .text C:\Windows\system32\services.exe[680] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A .text C:\Windows\system32\services.exe[680] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A .text C:\Windows\system32\services.exe[680] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71] .text C:\Windows\system32\services.exe[680] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\services.exe[680] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70} .text C:\Windows\system32\services.exe[680] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A .text C:\Windows\system32\services.exe[680] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A .text C:\Windows\system32\services.exe[680] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A .text C:\Windows\system32\services.exe[680] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A .text C:\Windows\system32\services.exe[680] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A .text C:\Windows\system32\services.exe[680] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A .text C:\Windows\system32\services.exe[680] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A .text C:\Windows\system32\services.exe[680] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A .text C:\Windows\system32\services.exe[680] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A .text C:\Windows\system32\services.exe[680] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A .text C:\Windows\system32\services.exe[680] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A .text C:\Windows\system32\services.exe[680] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A .text C:\Windows\system32\services.exe[680] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A .text C:\Windows\system32\services.exe[680] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A .text C:\Windows\system32\services.exe[680] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI} .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f} .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f} .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI} .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI} .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F] .text C:\Windows\system32\lsass.exe[692] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71] .text C:\Windows\system32\lsass.exe[692] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A .text C:\Windows\system32\lsass.exe[692] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A .text C:\Windows\system32\lsass.exe[692] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A .text C:\Windows\system32\lsass.exe[692] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A .text C:\Windows\system32\lsass.exe[692] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A .text C:\Windows\system32\lsass.exe[692] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A .text C:\Windows\system32\lsass.exe[692] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A .text C:\Windows\system32\lsass.exe[692] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A .text C:\Windows\system32\lsass.exe[692] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A .text C:\Windows\system32\lsass.exe[692] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A .text C:\Windows\system32\lsass.exe[692] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A .text C:\Windows\system32\lsass.exe[692] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A .text C:\Windows\system32\lsass.exe[692] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A .text C:\Windows\system32\lsass.exe[692] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A .text C:\Windows\system32\lsass.exe[692] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A .text C:\Windows\system32\lsass.exe[692] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71] .text C:\Windows\system32\lsass.exe[692] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A .text C:\Windows\system32\lsass.exe[692] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A .text C:\Windows\system32\lsass.exe[692] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A .text C:\Windows\system32\lsass.exe[692] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A .text C:\Windows\system32\lsass.exe[692] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71] .text C:\Windows\system32\lsass.exe[692] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsass.exe[692] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70} .text C:\Windows\system32\lsass.exe[692] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A .text C:\Windows\system32\lsass.exe[692] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A .text C:\Windows\system32\lsass.exe[692] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A .text C:\Windows\system32\lsass.exe[692] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A .text C:\Windows\system32\lsass.exe[692] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A .text C:\Windows\system32\lsass.exe[692] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A .text C:\Windows\system32\lsass.exe[692] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A .text C:\Windows\system32\lsass.exe[692] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A .text C:\Windows\system32\lsass.exe[692] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A .text C:\Windows\system32\lsass.exe[692] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A .text C:\Windows\system32\lsass.exe[692] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A .text C:\Windows\system32\lsass.exe[692] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A .text C:\Windows\system32\lsass.exe[692] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A .text C:\Windows\system32\lsass.exe[692] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A .text C:\Windows\system32\lsass.exe[692] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI} .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f} .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f} .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI} .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI} .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F] .text C:\Windows\system32\lsm.exe[700] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71] .text C:\Windows\system32\lsm.exe[700] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A .text C:\Windows\system32\lsm.exe[700] kernel32.dll!SetThreadContext
Post #14
Hi Satchfan hear is more >>> GMER 7776794A 6 Bytes JMP 708B000A .text C:\Windows\system32\lsm.exe[700] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A .text C:\Windows\system32\lsm.exe[700] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A .text C:\Windows\system32\lsm.exe[700] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A .text C:\Windows\system32\lsm.exe[700] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A .text C:\Windows\system32\lsm.exe[700] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A .text C:\Windows\system32\lsm.exe[700] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A .text C:\Windows\system32\lsm.exe[700] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A .text C:\Windows\system32\lsm.exe[700] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A .text C:\Windows\system32\lsm.exe[700] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A .text C:\Windows\system32\lsm.exe[700] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A .text C:\Windows\system32\lsm.exe[700] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A .text C:\Windows\system32\lsm.exe[700] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A .text C:\Windows\system32\lsm.exe[700] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A .text C:\Windows\system32\lsm.exe[700] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71] .text C:\Windows\system32\lsm.exe[700] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A .text C:\Windows\system32\lsm.exe[700] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A .text C:\Windows\system32\lsm.exe[700] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A .text C:\Windows\system32\lsm.exe[700] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A .text C:\Windows\system32\lsm.exe[700] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71] .text C:\Windows\system32\lsm.exe[700] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\lsm.exe[700] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70} .text C:\Windows\system32\lsm.exe[700] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A .text C:\Windows\system32\lsm.exe[700] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A .text C:\Windows\system32\lsm.exe[700] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A .text C:\Windows\system32\lsm.exe[700] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A .text C:\Windows\system32\lsm.exe[700] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A .text C:\Windows\system32\lsm.exe[700] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A .text C:\Windows\system32\lsm.exe[700] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A .text C:\Windows\system32\lsm.exe[700] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A .text C:\Windows\system32\lsm.exe[700] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A .text C:\Windows\system32\lsm.exe[700] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A .text C:\Windows\system32\lsm.exe[700] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A .text C:\Windows\system32\lsm.exe[700] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A .text C:\Windows\system32\lsm.exe[700] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A .text C:\Windows\system32\lsm.exe[700] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A .text C:\Windows\system32\lsm.exe[700] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI} .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f} .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f} .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI} .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI} .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\winlogon.exe[756] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F] .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 7120000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 70A2000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 7103000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 70B8000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 70BB000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 709C000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 70D0000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 70D6000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7163000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 7099000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 716E000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 70CD000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 7123000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 7130000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 7126000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 70A8000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 70CA000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 712D000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 70EC000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 70D3000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 709F000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 7106000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 70EF000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 70A5000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 7100000A .text C:\Windows\system32\winlogon.exe[756] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 70E5000A .text C:\Windows\system32\winlogon.exe[756] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 70B5000A .text C:\Windows\system32\winlogon.exe[756] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7160000A .text C:\Windows\system32\winlogon.exe[756] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 715A000A .text C:\Windows\system32\winlogon.exe[756] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 7154000A .text C:\Windows\system32\winlogon.exe[756] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 70D9000A .text C:\Windows\system32\winlogon.exe[756] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 70DC000A .text C:\Windows\system32\winlogon.exe[756] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 7157000A .text C:\Windows\system32\winlogon.exe[756] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 70DF000A .text C:\Windows\system32\winlogon.exe[756] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 715D000A .text C:\Windows\system32\winlogon.exe[756] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 714E000A .text C:\Windows\system32\winlogon.exe[756] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 7151000A .text C:\Windows\system32\winlogon.exe[756] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 714B000A .text C:\Windows\system32\winlogon.exe[756] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 70E2000A .text C:\Windows\system32\winlogon.exe[756] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\winlogon.exe[756] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [0C, 71] {OR AL, 0x71} .text C:\Windows\system32\winlogon.exe[756] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 70C1000A .text C:\Windows\system32\winlogon.exe[756] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 70BE000A .text C:\Windows\system32\winlogon.exe[756] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 70C4000A .text C:\Windows\system32\winlogon.exe[756] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 70AB000A .text C:\Windows\system32\winlogon.exe[756] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 70C7000A .text C:\Windows\system32\winlogon.exe[756] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 70AE000A .text C:\Windows\system32\winlogon.exe[756] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 70F6000A .text C:\Windows\system32\winlogon.exe[756] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 70F9000A .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI} .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f} .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f} .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI} .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI} .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F] .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C5000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 701B000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A8000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 7031000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7034000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7015000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 705D000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 7063000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 7012000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7046000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71] .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 7021000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7043000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7084000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7060000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7018000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AB000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7089000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 701E000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A5000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A .text C:\Windows\system32\taskeng.exe[816] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 707D000A .text C:\Windows\system32\taskeng.exe[816] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 702E000A .text C:\Windows\system32\taskeng.exe[816] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A .text C:\Windows\system32\taskeng.exe[816] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A .text C:\Windows\system32\taskeng.exe[816] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A .text C:\Windows\system32\taskeng.exe[816] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 7066000A .text C:\Windows\system32\taskeng.exe[816] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7069000A .text C:\Windows\system32\taskeng.exe[816] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A .text C:\Windows\system32\taskeng.exe[816] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 706C000A .text C:\Windows\system32\taskeng.exe[816] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A .text C:\Windows\system32\taskeng.exe[816] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A .text C:\Windows\system32\taskeng.exe[816] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A .text C:\Windows\system32\taskeng.exe[816] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A .text C:\Windows\system32\taskeng.exe[816] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 707A000A .text C:\Windows\system32\taskeng.exe[816] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71] .text C:\Windows\system32\taskeng.exe[816] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A .text C:\Windows\system32\taskeng.exe[816] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F3E0F5A .text C:\Windows\system32\taskeng.exe[816] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A .text C:\Windows\system32\taskeng.exe[816] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A .text C:\Windows\system32\taskeng.exe[816] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A .text C:\Windows\system32\taskeng.exe[816] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F370F5A .text C:\Windows\system32\taskeng.exe[816] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71] .text C:\Windows\system32\taskeng.exe[816] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B1, 70] {MOV CL, 0x70} .text C:\Windows\system32\taskeng.exe[816] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 703A000A .text C:\Windows\system32\taskeng.exe[816] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7037000A .text C:\Windows\system32\taskeng.exe[816] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[816] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [3C, 5F] {CMP AL, 0x5f} .text C:\Windows\system32\taskeng.exe[816] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A .text C:\Windows\system32\taskeng.exe[816] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 703D000A .text C:\Windows\system32\taskeng.exe[816] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7024000A .text C:\Windows\system32\taskeng.exe[816] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 7040000A .text C:\Windows\system32\taskeng.exe[816] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7027000A .text C:\Windows\system32\taskeng.exe[816] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A .text C:\Windows\system32\taskeng.exe[816] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F410F5A .text C:\Windows\system32\taskeng.exe[816] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A .text C:\Windows\system32\taskeng.exe[816] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A .text C:\Windows\system32\taskeng.exe[816] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709B000A .text C:\Windows\system32\taskeng.exe[816] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A .text C:\Windows\system32\taskeng.exe[816] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A .text C:\Windows\system32\taskeng.exe[816] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A .text C:\Windows\system32\taskeng.exe[816] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709E000A
Post #15
Hi Satchfan hear is more >>> GMER .text C:\Windows\system32\taskeng.exe[816] WININET.dll!InternetOpenUrlA 7760F3A4 6 Bytes JMP 7091000A .text C:\Windows\system32\taskeng.exe[816] WININET.dll!InternetOpenUrlW 77656D5F 6 Bytes JMP 708E000A .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI} .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f} .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f} .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI} .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI} .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F] .text C:\Windows\system32\svchost.exe[880] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71] .text C:\Windows\system32\svchost.exe[880] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A .text C:\Windows\system32\svchost.exe[880] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A .text C:\Windows\system32\svchost.exe[880] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A .text C:\Windows\system32\svchost.exe[880] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A .text C:\Windows\system32\svchost.exe[880] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A .text C:\Windows\system32\svchost.exe[880] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A .text C:\Windows\system32\svchost.exe[880] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A .text C:\Windows\system32\svchost.exe[880] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A .text C:\Windows\system32\svchost.exe[880] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A .text C:\Windows\system32\svchost.exe[880] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A .text C:\Windows\system32\svchost.exe[880] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A .text C:\Windows\system32\svchost.exe[880] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A .text C:\Windows\system32\svchost.exe[880] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A .text C:\Windows\system32\svchost.exe[880] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A .text C:\Windows\system32\svchost.exe[880] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71] .text C:\Windows\system32\svchost.exe[880] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A .text C:\Windows\system32\svchost.exe[880] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A .text C:\Windows\system32\svchost.exe[880] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A .text C:\Windows\system32\svchost.exe[880] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A .text C:\Windows\system32\svchost.exe[880] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71] .text C:\Windows\system32\svchost.exe[880] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[880] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70} .text C:\Windows\system32\svchost.exe[880] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A .text C:\Windows\system32\svchost.exe[880] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A .text C:\Windows\system32\svchost.exe[880] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A .text C:\Windows\system32\svchost.exe[880] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A .text C:\Windows\system32\svchost.exe[880] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A .text C:\Windows\system32\svchost.exe[880] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A .text C:\Windows\system32\svchost.exe[880] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A .text C:\Windows\system32\svchost.exe[880] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A .text C:\Windows\system32\svchost.exe[880] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A .text C:\Windows\system32\svchost.exe[880] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A .text C:\Windows\system32\svchost.exe[880] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A .text C:\Windows\system32\svchost.exe[880] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A .text C:\Windows\system32\svchost.exe[880] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A .text C:\Windows\system32\svchost.exe[880] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A .text C:\Windows\system32\svchost.exe[880] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI} .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f} .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f} .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI} .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI} .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] KERNEL32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E] .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70} .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] shell32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] shell32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] shell32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] shell32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] shell32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A .text C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[940] shell32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI} .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f} .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f} .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI} .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI} .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\svchost.exe[968] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F] .text C:\Windows\system32\svchost.exe[968] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A .text C:\Windows\system32\svchost.exe[968] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A .text C:\Windows\system32\svchost.exe[968] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A .text C:\Windows\system32\svchost.exe[968] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A .text C:\Windows\system32\svchost.exe[968] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A .text C:\Windows\system32\svchost.exe[968] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A .text C:\Windows\system32\svchost.exe[968] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A .text C:\Windows\system32\svchost.exe[968] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A .text C:\Windows\system32\svchost.exe[968] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A .text C:\Windows\system32\svchost.exe[968] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A .text C:\Windows\system32\svchost.exe[968] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A .text C:\Windows\system32\svchost.exe[968] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A .text C:\Windows\system32\svchost.exe[968] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A .text C:\Windows\system32\svchost.exe[968] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A .text C:\Windows\system32\svchost.exe[968] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI