What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

www.searchqu.com/406

108 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi

I started Google Chrome to find my home page was set to searchqu. I googled it and found a lot of posts here about getting rid of it so the OTL scans are below.

Thanks

OTL.txt

OTL logfile created on: 28/04/2011 08:02:13 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Andrew\Desktop
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 40.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 66.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 297.99 Gb Total Space | 220.09 Gb Free Space | 73.86% Space Free | Partition Type: NTFS
Drive E: | 189.92 Gb Total Space | 142.73 Gb Free Space | 75.15% Space Free | Partition Type: NTFS
Drive F: | 149.05 Gb Total Space | 104.86 Gb Free Space | 70.35% Space Free | Partition Type: NTFS
Drive G: | 74.53 Gb Total Space | 73.88 Gb Free Space | 99.13% Space Free | Partition Type: NTFS
Drive I: | 74.51 Gb Total Space | 57.38 Gb Free Space | 77.00% Space Free | Partition Type: FAT32

Computer Name: ANDREW-PC | User Name: Andrew | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Andrew\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
PRC - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
PRC - C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe (Nokia)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe (Nokia)
PRC - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe (Nokia)
PRC - C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe (Sanford, L.P.)
PRC - C:\Program Files\DYMO\DYMO Label Software\DLSService.exe (Sanford, L.P.)
PRC - C:\Windows\System32\atieclxx.exe (AMD)
PRC - C:\Windows\System32\atiesrxx.exe (AMD)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Users\Andrew\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\guard32.dll (COMODO)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (cmdAgent) – C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (TeamViewer5) – C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (AMD External Events Utility) – C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AcfXAudioService) – C:\Windows\System32\ACFXAU32.dll (Conexant Systems, Inc.)
SRV - (WcesComm) – C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (epmntdrv) – C:\Windows\System32\epmntdrv.sys ()
DRV - (EuGdiDrv) – C:\Windows\System32\EuGdiDrv.sys ()
DRV - (inspect) – C:\Windows\System32\drivers\inspect.sys (COMODO)
DRV - (cmdGuard) – C:\Windows\System32\drivers\cmdGuard.sys (COMODO)
DRV - (cmdHlp) – C:\Windows\System32\drivers\cmdhlp.sys (COMODO)
DRV - (cmderd) – C:\Windows\System32\drivers\cmderd.sys (COMODO)
DRV - (UsbserFilt) – C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) – C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) – C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) – C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (nmwcdnsu) – C:\Windows\System32\drivers\nmwcdnsu.sys (Nokia)
DRV - (nmwcdnsuc) – C:\Windows\System32\drivers\nmwcdnsuc.sys (Nokia)
DRV - (vncmirror) – C:\Windows\System32\drivers\vncmirror.sys (RealVNC Ltd.)
DRV - (FTDIBUS) – C:\Windows\System32\drivers\ftdibus.sys (FTDI Ltd.)
DRV - (FTSER2K) – C:\Windows\System32\drivers\ftser2k.sys (FTDI Ltd.)
DRV - (acfva) – C:\Windows\System32\drivers\ACFVA32.sys (Conexant Systems Inc.)
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (WINUSB) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (dgcfltr) – C:\Windows\System32\drivers\ACFDCP32.sys (Conexant Systems, Inc.)
DRV - (XAudio) – C:\Windows\System32\drivers\ACFXAU32.sys (Conexant Systems, Inc.)
DRV - (pccsmcfd) – C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (mdmxsdk) – C:\Windows\System32\drivers\ACFSDK32.sys (Conexant)
DRV - (Navcar) – C:\Windows\System32\drivers\Navcar.sys (NAVMAN)
DRV - (sscdmdm) – C:\Windows\System32\drivers\sscdmdm.sys (MCCI)
DRV - (sscdmdfl) – C:\Windows\System32\drivers\sscdmdfl.sys (MCCI)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) – C:\Windows\System32\drivers\sscdbus.sys (MCCI)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchqu.com/406
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A1 CD 0D B6 D7 C9 CA 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========


FF - HKLM\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2011/04/04 21:57:55 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011/01/13 09:33:23 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011/04/04 21:57:55 | 000,000,000 | —D | M]

[2011/01/13 09:38:11 | 000,000,000 | —D | M] (No name found) – C:\Users\Andrew\AppData\Roaming\Mozilla\Extensions
[2011/01/13 09:38:11 | 000,000,000 | —D | M] (No name found) – C:\Users\Andrew\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

O1 HOSTS File: ([2009/06/10 22:39:37 | 000,000,824 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {30391296-2569-389F-1086-5D193888614C} - C:\Windows\System32\msls331.dll ()
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [CnxtCoInstallerDefer] C:\Program Files\CONEXANT\SETUP4BAA8672210\SETUP\setup.exe (Conexant Systems, Inc.)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKLM..\Run: [DLSService] C:\Program Files\DYMO\DYMO Label Software\DLSService.exe (Sanford, L.P.)
O4 - HKLM..\Run: [KeePass 2 PreLoad] C:\Program Files\KeePass Password Safe 2\KeePass.exe (Dominik Reichl)
O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [ROUTE66Sync] C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe (ROUTE 66)
O4 - HKCU..\Run: [] File not found
O4 - HKCU..\Run: [DymoQuickPrint] C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe (Sanford, L.P.)
O4 - HKCU..\Run: [ISUSPM] File not found
O4 - HKCU..\Run: [NokiaOviSuite2] C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe (Nokia)
O4 - HKCU..\Run: [Pando Media Booster] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - AppInit_DLLs: (C:\Windows\system32\guard32.dll) - C:\Windows\System32\guard32.dll (COMODO)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: wave2 - C:\Windows\System32\serwvdrv.dll (Microsoft Corporation)


========== Files/Folders - Created Within 30 Days ==========

[2011/04/28 08:01:06 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Users\Andrew\Desktop\OTL.exe
[2011/04/28 00:47:58 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\prevhost.exe
[2011/04/28 00:47:51 | 001,686,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\esent.dll
[2011/04/28 00:47:48 | 000,146,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\storport.sys
[2011/04/28 00:47:45 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fsutil.exe
[2011/04/28 00:47:27 | 000,442,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsPrint.dll
[2011/04/28 00:47:20 | 002,614,784 | —- | C] (Microsoft Corporation) – C:\Windows\explorer.exe
[2011/04/26 09:40:47 | 000,000,000 | —D | C] – C:\Users\Andrew\Desktop\GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}
[2011/04/21 09:59:28 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Local\Ilivid Player
[2011/04/21 09:57:28 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Local\PackageAware
[2011/04/21 09:49:52 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/04/21 09:48:33 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/04/21 09:48:28 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/04/21 09:45:07 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2011/04/21 09:44:19 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2011/04/20 13:15:47 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EASEUS Partition Master 8.0.1 Home Edition
[2011/04/20 13:15:29 | 000,000,000 | —D | C] – C:\Program Files\EASEUS
[2011/04/18 15:24:04 | 000,000,000 | —D | C] – C:\Windows\System32\1087
[2011/04/15 16:20:23 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[2011/04/15 16:20:22 | 000,428,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vbscript.dll
[2011/04/15 16:20:16 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dnscacheugc.exe
[2011/04/15 16:20:14 | 000,294,912 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2011/04/15 16:20:13 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2011/04/15 16:20:02 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/04/15 16:20:02 | 000,381,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/04/15 16:20:01 | 000,606,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/04/15 16:20:01 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/04/15 16:20:00 | 000,185,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/04/15 16:20:00 | 000,064,512 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/04/15 16:19:59 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/04/15 16:19:58 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/04/15 16:19:58 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/04/15 16:19:57 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/04/15 16:19:57 | 000,386,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/04/15 16:19:38 | 002,331,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/04/15 16:19:36 | 000,191,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\FXSCOVER.exe
[2011/04/15 16:19:33 | 000,288,256 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsGdiConverter.dll
[2011/04/15 16:19:28 | 001,137,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42.dll
[2011/04/15 16:19:27 | 001,164,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42u.dll
[2011/04/14 12:35:58 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Roaming\PlaneShift
[2011/04/14 12:35:58 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Roaming\CrystalSpace
[2011/04/14 12:35:58 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Roaming\CrystalApp
[2011/04/14 12:32:39 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlaneShift
[2011/04/14 12:26:03 | 000,000,000 | —D | C] – C:\Program Files\PlaneShift
[2011/04/14 08:36:28 | 000,000,000 | —D | C] – C:\Program Files\uTorrent
[2011/04/14 08:35:46 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Roaming\uTorrent
[2011/04/06 16:20:16 | 000,197,920 | —- | C] (Apple Inc.) – C:\Windows\System32\dnssdX.dll
[2011/04/06 16:20:16 | 000,107,808 | —- | C] (Apple Inc.) – C:\Windows\System32\dns-sd.exe
[2011/04/06 16:20:16 | 000,091,424 | —- | C] (Apple Inc.) – C:\Windows\System32\dnssd.dll
[2011/04/06 16:20:16 | 000,075,040 | —- | C] (Apple Inc.) – C:\Windows\System32\jdns_sd.dll
[2011/04/04 22:21:37 | 000,000,000 | —D | C] – C:\Users\Andrew\Documents\Ovi
[2011/04/04 22:09:09 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Roaming\Nokia Ovi Suite
[2011/04/04 22:09:07 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Roaming\Nokia
[2011/04/04 22:08:41 | 000,000,000 | —D | C] – C:\ProgramData\Nokia
[2011/04/04 22:04:42 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Local\NokiaAccount
[2011/04/04 22:01:17 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Local\Nokia
[2011/04/04 22:00:51 | 000,000,000 | —D | C] – C:\ProgramData\PC Suite
[2011/04/04 22:00:47 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Roaming\PC Suite
[2011/04/04 22:00:13 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nokia
[2011/04/04 21:58:27 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Nokia
[2011/04/04 21:57:50 | 000,000,000 | —D | C] – C:\Program Files\DIFX
[2011/04/04 21:57:48 | 000,018,816 | —- | C] (Nokia) – C:\Windows\System32\drivers\pccsmcfd.sys
[2011/04/04 21:57:29 | 000,000,000 | —D | C] – C:\Program Files\PC Connectivity Solution
[2011/04/04 21:56:20 | 000,075,264 | —- | C] (Nokia) – C:\Windows\System32\nmwcdcls.dll
[2011/04/04 21:53:55 | 000,000,000 | —D | C] – C:\ProgramData\NokiaInstallerCache
[2011/04/04 21:53:55 | 000,000,000 | —D | C] – C:\Program Files\Nokia
[2011/03/31 07:55:25 | 000,000,000 | —D | C] – C:\Users\Andrew\Documents\The Lord of the Rings Online
[2011/03/31 07:55:25 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Local\The Lord of the Rings Online
[2011/03/30 19:47:38 | 001,974,616 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_42.dll
[2011/03/30 19:45:09 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Local\Turbine
[2011/03/30 19:40:02 | 001,892,184 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DX9_42.dll
[2011/03/30 19:40:01 | 003,495,784 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_33.dll
[2011/03/30 19:39:19 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Local\ApplicationHistory
[2011/03/30 19:36:30 | 000,000,000 | —D | C] – C:\Windows\System32\URTTEMP
[2011/03/30 19:35:41 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Codemasters
[2011/03/30 18:52:45 | 000,000,000 | —D | C] – C:\Program Files\Codemasters
[2011/03/30 15:04:33 | 000,000,000 | —D | C] – C:\Users\Andrew\Desktop\LOTROEU_Enedwaith_EN_GB_Installer
[2011/03/30 15:04:01 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Local\PMB Files
[2011/03/30 15:03:52 | 000,000,000 | —D | C] – C:\ProgramData\PMB Files
[2011/03/30 15:03:15 | 000,000,000 | —D | C] – C:\Program Files\Pando Networks
[2011/03/30 12:10:09 | 000,000,000 | —D | C] – C:\Windows\Minidump
[2008/12/23 09:32:46 | 000,184,320 | R— | C] ( ) – C:\Windows\System32\SgE.interop.MSXML2.dll
[2006/12/12 11:59:08 | 000,184,320 | —- | C] ( ) – C:\Windows\System32\Interop.MSXML2.dll

========== Files - Modified Within 30 Days ==========

[2011/04/28 08:00:56 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\Andrew\Desktop\OTL.exe
[2011/04/28 07:59:21 | 000,043,630 | —- | M] () – C:\Users\Public\Documents\NewDatabase.kdbx
[2011/04/28 07:55:55 | 001,474,832 | —- | M] () – C:\Windows\System32\drivers\sfi.dat
[2011/04/28 07:51:03 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2133833747-3894688989-3222378912-1001UA.job
[2011/04/28 03:31:37 | 000,015,008 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/04/28 03:31:37 | 000,015,008 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/04/28 03:26:03 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/04/28 03:25:56 | 1408,737,280 | -HS- | M] () – C:\hiberfil.sys
[2011/04/28 01:51:08 | 000,000,860 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2133833747-3894688989-3222378912-1001Core.job
[2011/04/26 20:47:12 | 000,002,407 | —- | M] () – C:\Users\Andrew\Desktop\Google Chrome.lnk
[2011/04/25 15:24:06 | 000,000,348 | —- | M] () – C:\Windows\tasks\At1.job
[2011/04/23 11:13:26 | 000,636,792 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/04/23 11:13:26 | 000,114,234 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/04/21 09:49:52 | 000,001,753 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/04/20 13:15:47 | 000,001,392 | —- | M] () – C:\Users\Public\Desktop\EASEUS Partition Master 8.0.1 Home Edition.lnk
[2011/04/16 03:40:48 | 000,411,616 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/04/14 08:36:29 | 000,000,941 | —- | M] () – C:\Users\Andrew\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2011/04/14 08:36:29 | 000,000,917 | —- | M] () – C:\Users\Public\Desktop\µTorrent.lnk
[2011/04/06 16:20:16 | 000,197,920 | —- | M] (Apple Inc.) – C:\Windows\System32\dnssdX.dll
[2011/04/06 16:20:16 | 000,107,808 | —- | M] (Apple Inc.) – C:\Windows\System32\dns-sd.exe
[2011/04/06 16:20:16 | 000,091,424 | —- | M] (Apple Inc.) – C:\Windows\System32\dnssd.dll
[2011/04/06 16:20:16 | 000,075,040 | —- | M] (Apple Inc.) – C:\Windows\System32\jdns_sd.dll
[2011/04/04 22:03:51 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2011/04/04 22:00:12 | 000,002,098 | —- | M] () – C:\Users\Public\Desktop\Nokia Ovi Suite.lnk
[2011/03/30 19:45:11 | 000,000,094 | —- | M] () – C:\Users\Andrew\AppData\Local\fusioncache.dat
[2011/03/30 19:35:44 | 000,002,213 | —- | M] () – C:\Users\Andrew\Desktop\The Lord of the Rings Online.lnk
[2011/03/30 15:02:47 | 000,000,117 | —- | M] () – C:\Users\Andrew\jagex_runescape_preferences2.dat
[2011/03/30 15:02:47 | 000,000,046 | —- | M] () – C:\Users\Andrew\jagex_runescape_preferences.dat
[2011/03/30 14:49:42 | 000,032,768 | —- | M] () – C:\Users\Andrew\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/03/30 12:10:05 | 148,307,842 | —- | M] () – C:\Windows\MEMORY.DMP

========== Files Created - No Company Name ==========

[2011/04/21 09:49:52 | 000,001,753 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/04/20 13:15:47 | 002,340,992 | —- | C] () – C:\Windows\System32\BootMan.exe
[2011/04/20 13:15:47 | 000,086,408 | —- | C] () – C:\Windows\System32\setupempdrv03.exe
[2011/04/20 13:15:47 | 000,018,048 | —- | C] () – C:\Windows\System32\EuEpmGdi.dll
[2011/04/20 13:15:47 | 000,014,216 | —- | C] () – C:\Windows\System32\epmntdrv.sys
[2011/04/20 13:15:47 | 000,008,456 | —- | C] () – C:\Windows\System32\EuGdiDrv.sys
[2011/04/20 13:15:47 | 000,001,392 | —- | C] () – C:\Users\Public\Desktop\EASEUS Partition Master 8.0.1 Home Edition.lnk
[2011/04/14 08:36:29 | 000,000,941 | —- | C] () – C:\Users\Andrew\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2011/04/14 08:36:29 | 000,000,917 | —- | C] () – C:\Users\Public\Desktop\µTorrent.lnk
[2011/04/04 22:03:51 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2011/04/04 22:00:12 | 000,002,098 | —- | C] () – C:\Users\Public\Desktop\Nokia Ovi Suite.lnk
[2011/03/30 19:45:11 | 000,000,094 | —- | C] () – C:\Users\Andrew\AppData\Local\fusioncache.dat
[2011/03/30 19:35:44 | 000,002,213 | —- | C] () – C:\Users\Andrew\Desktop\The Lord of the Rings Online.lnk
[2011/03/30 12:10:05 | 148,307,842 | —- | C] () – C:\Windows\MEMORY.DMP
[2011/03/27 09:37:11 | 000,007,599 | —- | C] () – C:\Users\Andrew\AppData\Local\Resmon.ResmonCfg
[2010/12/20 14:12:23 | 000,121,342 | —- | C] () – C:\Windows\File Renamer - Basic Uninstaller.exe
[2010/11/17 10:56:11 | 000,032,768 | —- | C] () – C:\Users\Andrew\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/05 18:12:15 | 000,038,425 | —- | C] () – C:\Users\Andrew\AppData\Roaming\Comma Separated Values (DOS).ADR
[2010/06/21 09:35:44 | 000,004,096 | -H– | C] () – C:\Users\Andrew\AppData\Local\keyfile3.drm
[2010/05/28 15:20:08 | 000,042,496 | —- | C] () – C:\Windows\System32\K8062D.dll
[2010/05/28 15:20:06 | 000,032,768 | —- | C] () – C:\Windows\System32\DMX4ALL.dll
[2010/04/07 19:14:58 | 000,270,848 | —- | C] () – C:\Windows\UNWISE32.EXE
[2010/03/26 15:35:02 | 000,000,037 | —- | C] () – C:\Windows\iltwain.ini
[2010/03/25 18:11:33 | 000,002,560 | —- | C] () – C:\Windows\_MSRSTRT.EXE
[2010/03/25 17:32:35 | 000,200,704 | —- | C] () – C:\Windows\System32\ftssrch.dll
[2010/03/24 23:05:21 | 000,006,656 | —- | C] () – C:\Windows\System32\NT6CDLMU.DLL
[2010/03/24 23:04:46 | 000,405,504 | —- | C] () – C:\Windows\deinscdl.exe
[2010/03/24 22:44:23 | 000,006,656 | —- | C] () – C:\Windows\System32\IMGFX6MU.DLL
[2010/03/24 22:44:20 | 000,319,488 | —- | C] () – C:\Windows\deinst32.exe
[2010/03/24 22:43:03 | 000,144,896 | —- | C] () – C:\Windows\CHT_SUP.DLL
[2010/03/24 17:34:44 | 000,000,179 | —- | C] () – C:\Windows\ODBCINST.INI
[2010/03/23 19:05:20 | 001,474,832 | —- | C] () – C:\Windows\System32\drivers\sfi.dat
[2010/03/22 17:14:32 | 000,000,578 | —- | C] () – C:\Windows\ODBC.INI
[2010/03/22 16:38:09 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2009/08/03 16:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 16:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/07/14 05:57:37 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/14 05:33:53 | 000,411,616 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/14 03:05:48 | 000,636,792 | —- | C] () – C:\Windows\System32\perfh009.dat
[2009/07/14 03:05:48 | 000,291,294 | —- | C] () – C:\Windows\System32\perfi009.dat
[2009/07/14 03:05:48 | 000,114,234 | —- | C] () – C:\Windows\System32\perfc009.dat
[2009/07/14 03:05:48 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd009.dat
[2009/07/14 03:05:05 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2009/07/14 03:04:11 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2009/07/14 00:55:01 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/14 00:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/14 00:42:47 | 000,200,704 | —- | C] () – C:\Windows\System32\addvpack.dll
[2009/07/14 00:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/07/14 00:26:12 | 000,200,704 | —- | C] () – C:\Windows\System32\msls331.dll
[2009/07/14 00:20:02 | 000,017,408 | —- | C] () – C:\Windows\System32\cofirre.exe
[2009/07/10 14:59:26 | 000,282,624 | —- | C] () – C:\Windows\System32\SGList32.dll
[2009/07/10 14:59:20 | 000,278,528 | —- | C] () – C:\Windows\System32\SGTool32.dll
[2009/07/10 14:59:16 | 000,090,112 | —- | C] () – C:\Windows\System32\SGIntl32.dll
[2009/07/10 14:59:14 | 000,073,728 | —- | C] () – C:\Windows\System32\SGDt32.dll
[2009/07/10 14:59:12 | 000,172,032 | —- | C] () – C:\Windows\System32\SGHelp32.dll
[2009/07/10 14:59:08 | 000,253,952 | —- | C] () – C:\Windows\System32\SGSchemeXml.dll
[2009/07/10 14:59:00 | 000,118,784 | —- | C] () – C:\Windows\System32\SGSchemeXP.dll
[2009/07/10 14:58:56 | 000,176,128 | —- | C] () – C:\Windows\System32\SGSchemeDefault.dll
[2009/07/10 14:58:52 | 000,221,184 | —- | C] () – C:\Windows\System32\SGSchemeManager.dll
[2009/07/10 14:58:46 | 000,094,208 | —- | C] () – C:\Windows\System32\SGCom32.dll
[2009/07/10 14:58:02 | 000,237,568 | —- | C] () – C:\Windows\System32\SGWebBrowser.dll
[2009/06/18 20:29:04 | 000,197,654 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2009/06/10 22:26:10 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2009/02/18 18:55:22 | 000,294,912 | —- | C] () – C:\Windows\System32\ATIODE.exe
[2009/02/03 21:52:04 | 000,045,056 | —- | C] () – C:\Windows\System32\ATIODCLI.exe
[2008/12/23 09:33:50 | 000,045,056 | —- | C] () – C:\Windows\System32\SgELauncher.dll
[2008/12/23 09:33:26 | 000,114,688 | —- | C] () – C:\Windows\System32\SgEData.dll
[2008/12/22 10:26:34 | 000,143,360 | —- | C] () – C:\Windows\System32\SGSTDREG.dll
[2008/12/22 10:26:30 | 000,131,072 | —- | C] () – C:\Windows\System32\SGRegister.dll
[2008/12/01 15:36:12 | 000,143,360 | —- | C] () – C:\Windows\System32\SGCtrlEx.dll
[2008/12/01 15:36:06 | 000,200,704 | —- | C] () – C:\Windows\System32\SGTBAR32.DLL
[2008/12/01 15:36:02 | 000,049,152 | —- | C] () – C:\Windows\System32\SGSTAT32.DLL
[2008/12/01 15:36:02 | 000,049,152 | —- | C] () – C:\Windows\System32\SGLOGO32.DLL
[2008/12/01 15:36:00 | 000,180,224 | —- | C] () – C:\Windows\System32\SGJPEG32.dll
[2008/12/01 15:35:56 | 000,249,856 | —- | C] () – C:\Windows\System32\SGCDLG32.DLL
[2008/12/01 15:35:36 | 000,061,440 | —- | C] () – C:\Windows\System32\SGAPPBAR.DLL
[2008/12/01 15:35:34 | 000,061,440 | —- | C] () – C:\Windows\System32\SG3D32.DLL
[2008/05/29 12:17:22 | 000,172,032 | —- | C] () – C:\Windows\System32\SageEventHandler.exe
[2007/12/04 14:22:58 | 000,061,440 | —- | C] () – C:\Windows\System32\SageFolderBrowser.dll
[2006/11/01 16:50:40 | 000,126,976 | R— | C] () – C:\Windows\System32\PDFInstall.exe
[2006/11/01 16:41:24 | 000,233,472 | —- | C] () – C:\Windows\System32\SGLCH32.DLL
[2006/11/01 15:41:16 | 001,712,128 | —- | C] () – C:\Windows\System32\SGRep32.dll
[2005/11/30 12:49:32 | 000,040,960 | —- | C] () – C:\Windows\System32\REPDES32.EXE
[2005/07/11 13:33:12 | 000,208,896 | —- | C] () – C:\Windows\System32\SDOApp.dll
[2005/06/03 08:06:04 | 000,212,992 | —- | C] () – C:\Windows\System32\SGSchemeConfig.dll
[2005/05/16 21:36:56 | 001,798,144 | —- | C] () – C:\Windows\System32\ltmm_n.dll
[2004/06/09 10:57:12 | 000,118,784 | —- | C] () – C:\Windows\System32\Install.exe
[2002/10/16 09:42:02 | 000,114,688 | —- | C] () – C:\Windows\System32\fdi.dll
[2002/10/16 09:40:14 | 000,094,208 | —- | C] () – C:\Windows\System32\fci.dll
[2002/04/16 11:27:54 | 000,000,005 | -HS- | C] () – C:\Windows\System32\CdI5T.drv
[2000/07/27 01:13:02 | 000,053,760 | —- | C] () – C:\Windows\System32\zlib.dll
[1998/03/26 02:12:00 | 000,053,248 | —- | C] () – C:\Windows\System32\SgHmZLib.dll
[1998/03/20 01:00:00 | 000,001,048 | -HS- | C] () – C:\Windows\System32\fnmode.sys

========== LOP Check ==========

[2011/01/15 22:04:31 | 000,000,000 | —D | M] – C:\Users\Andrew\AppData\Roaming\AnvSoft
[2010/08/02 13:07:42 | 000,000,000 | —D | M] – C:\Users\Andrew\AppData\Roaming\Blackberry Desktop
[2011/04/14 12:36:41 | 000,000,000 | —D | M] – C:\Users\Andrew\AppData\Roaming\CrystalApp
[2011/04/14 12:35:58 | 000,000,000 | —D | M] – C:\Users\Andrew\AppData\Roaming\CrystalSpace
[2011/04/28 08:01:19 | 000,000,000 | —D | M] – C:\Users\Andrew\AppData\Roaming\KeePass
[2011/04/04 22:09:07 | 000,000,000 | —D | M] – C:\Users\Andrew\AppData\Roaming\Nokia
[2011/04/04 22:09:09 | 000,000,000 | —D | M] – C:\Users\Andrew\AppData\Roaming\Nokia Ovi Suite
[2011/04/04 22:08:32 | 000,000,000 | —D | M] – C:\Users\Andrew\AppData\Roaming\PC Suite
[2011/04/14 15:35:58 | 000,000,000 | —D | M] – C:\Users\Andrew\AppData\Roaming\PlaneShift
[2010/12/15 19:03:18 | 000,000,000 | —D | M] – C:\Users\Andrew\AppData\Roaming\Publish Providers
[2010/09/08 14:52:41 | 000,000,000 | —D | M] – C:\Users\Andrew\AppData\Roaming\Research In Motion
[2011/01/06 21:03:03 | 000,000,000 | —D | M] – C:\Users\Andrew\AppData\Roaming\ROUTE 66 Sync
[2010/03/24 21:30:16 | 000,000,000 | —D | M] – C:\Users\Andrew\AppData\Roaming\Softland
[2011/03/02 20:06:26 | 000,000,000 | —D | M] – C:\Users\Andrew\AppData\Roaming\Sony
[2010/12/16 19:51:36 | 000,000,000 | —D | M] – C:\Users\Andrew\AppData\Roaming\Sony Creative Software Inc
[2010/05/04 16:12:03 | 000,000,000 | —D | M] – C:\Users\Andrew\AppData\Roaming\TeamViewer
[2011/01/13 09:38:10 | 000,000,000 | —D | M] – C:\Users\Andrew\AppData\Roaming\Thunderbird
[2010/10/21 15:29:11 | 000,000,000 | —D | M] – C:\Users\Andrew\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2011/04/28 07:50:19 | 000,000,000 | —D | M] – C:\Users\Andrew\AppData\Roaming\uTorrent
[2011/04/25 15:24:06 | 000,000,348 | —- | M] () – C:\Windows\Tasks\At1.job
[2011/01/31 11:50:59 | 000,032,610 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/06/10 22:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/06/10 22:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2011/04/28 03:25:56 | 1408,737,280 | -HS- | M] () – C:\hiberfil.sys
[2010/03/24 22:42:57 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/03/24 22:42:57 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2011/04/28 03:26:00 | 1878,319,104 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2009/07/14 05:52:25 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 05:52:25 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 05:52:25 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 05:52:25 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 22:31:19 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/14 02:15:26 | 000,280,064 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\hpzppw71.dll
[2009/07/14 02:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2007/04/09 14:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
[2009/07/14 02:16:19 | 000,029,696 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/11/10 02:28:46 | 000,301,936 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 05:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini
[2010/03/26 15:35:38 | 000,028,416 | RHS- | M] () – C:\Program Files\DLS8Uninstall.log

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/03/22 16:52:32 | 000,000,221 | -HS- | M] () – C:\Users\Andrew\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/04/28 08:00:56 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\Andrew\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-04-28 02:08:08

========== Alternate Data Streams ==========

@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:0CFF5F08

< End of report >



Extras.txt

EOTL Extras logfile created on: 28/04/2011 08:02:13 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Andrew\Desktop
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 40.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 66.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 297.99 Gb Total Space | 220.09 Gb Free Space | 73.86% Space Free | Partition Type: NTFS
Drive E: | 189.92 Gb Total Space | 142.73 Gb Free Space | 75.15% Space Free | Partition Type: NTFS
Drive F: | 149.05 Gb Total Space | 104.86 Gb Free Space | 70.35% Space Free | Partition Type: NTFS
Drive G: | 74.53 Gb Total Space | 73.88 Gb Free Space | 99.13% Space Free | Partition Type: NTFS
Drive I: | 74.51 Gb Total Space | 57.38 Gb Free Space | 77.00% Space Free | Partition Type: FAT32

Computer Name: ANDREW-PC | User Name: Andrew | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{08600005-5228-4BF6-845E-E9A957AFDCB4}" = OviMPlatform
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{17504ED4-DB08-40A8-81C2-27D8C01581DA}" = Windows Live Remote Service Resources
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java™ 6 Update 24
"{28191B83-1D60-44B6-9B08-E854EF6632D5}" = Ovi Desktop Sync Engine
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{294BF709-D758-4363-8D75-01479AD20927}" = Windows Live Family Safety
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{3360D505-B0AA-4284-92DF-F872AF90A448}" = BlackBerry Device Software Updater
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{353FE16B-30FE-469A-BF55-B978F4218003}" = iTunes
"{3553E875-F00E-4031-BDEC-75FB1DFEB093}" = Nokia Ovi Suite Software Updater
"{3B78608F-D09A-11DF-A54E-0013D3D69929}" = Vegas Pro 10.0
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC42713-B6E7-49AA-A553-A224FE9828A8}" = Nokia Ovi Suite
"{40719211-D09A-11DF-BA30-0013D3D69929}" = MSVCRT Redists
"{4216D328-0FE8-48B8-85B8-BD300E6F080F}" = Nokia Connectivity Cable Driver
"{464B3406-A4D0-4914-910F-7CA4380DCC13}" = Windows Live Remote Client Resources
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{598420E8-E9F9-4FAE-9B6C-599FDF2F611A}" = BlackBerry App World Browser Plugin
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84A78614-0E4B-4A4E-BA8C-2B0A05A08E4E}" = BlackBerry Desktop Software 6.0.1
"{853A4763-6643-4604-8D64-28BDD8925F4C}" = Apple Application Support
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8FB53850-246A-3507-8ADE-0060093FFEA6}" = Visual Studio Tools for the Office system 3.0 Runtime
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile Device Center
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-007A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet TV for Windows Media Center
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X (10.0.1)
"{AC76BA86-7AD7-5760-0000-900000000003}" = Japanese Fonts Support For Adobe Reader 9
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B17D51BA-CA44-4308-B4DD-7A58DC5C828E}_is1" = Mark's DVD Bitrate Calculator Version 1.1.0
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B3810AE5-AF70-4F01-BCFB-4D1BBB6A105B}" = AGi32 v2.17
"{BE1A2C04-6F14-4A16-B290-003769418AD9}" = ROUTE 66 Sync
"{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C5E0CB10-C275-11DF-B3A6-0013D3D69929}" = DVD Architect Pro 5.2
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C6E388F5-F0BE-A758-93BE-15758C09C0ED}" = TweetDeck
"{CA5207DE-C275-11DF-AC9F-0013D3D69929}" = MSVCRT Redists
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC6B1BB4-4E06-4A5B-A166-B371B551324B}" = COMODO Internet Security
"{CD232781-26CA-4E18-BC70-4343A2F0D583}" = Microsoft IntelliPoint 8.0
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D4AEC53C-1720-41D9-B6D7-6A60DE62D444}" = PC Connectivity Solution
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F35D3C6B-609A-4090-8531-C9F4FD889045}" = ChamSys MagicQ PC
"{F53D678E-238F-4A71-9742-08BB6774E9DC}" = Windows Live Family Safety
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"4f6dcc3b-179d-4b1b-80f0-b6083a0b3ce6_is1" = The Lord of the Rings Online™ v03.02.04.8010
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Any Video Converter_is1" = Any Video Converter 3.1.7
"BlackBerry_Desktop" = BlackBerry Desktop Software 6.0.1
"CNXT_MODEM_USB_ACF" = USB ACF Modem
"DYMO Label v.8" = DYMO Label v.8
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 8.0.1 Home Edition
"ENTERPRISE" = Microsoft Office Enterprise 2007
"FBackup 4_is1" = FBackup 4
"File Renamer - Basic" = File Renamer - Basic
"InstallShield_{BE1A2C04-6F14-4A16-B290-003769418AD9}" = ROUTE 66 Sync
"KeePassPasswordSafe2_is1" = KeePass Password Safe 2.13
"LD Calculator Lite_is1" = LD Calculator Lite 1.02 b1
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Thunderbird (3.1.7)" = Mozilla Thunderbird (3.1.7)
"NirSoft IE PassView" = NirSoft IE PassView
"Nokia Ovi Suite" = Nokia Ovi Suite
"PENTAX Digital Camera Utility" = PENTAX Digital Camera Utility
"PlaneShift 0.5.6" = PlaneShift
"SimplyPats 6" = SimplyPats 6
"TeamViewer 5" = TeamViewer 5
"TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1" = TweetDeck
"uTorrent" = µTorrent
"Veoh Web Player Beta" = Veoh Web Player
"Visual Studio Tools for the Office system 3.0 Runtime" = Visual Studio Tools for the Office system 3.0 Runtime
"VV_Outloud_50_En_US" = IBM ViaVoice TTS Runtime v5.0 - US English
"WinLiveSuite" = Windows Live Essentials

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 21/04/2011 06:52:05 | Computer Name = Andrew-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Common
Files\Research In Motion\AppLoader\MailServerMAPIProxy64.exe". Dependent Assembly
Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 23/04/2011 04:07:55 | Computer Name = Andrew-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Research
In Motion\BlackBerry Desktop\MailServerMAPIProxy64.exe". Dependent Assembly Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 23/04/2011 04:08:01 | Computer Name = Andrew-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Common
Files\Research In Motion\AppLoader\MailServerMAPIProxy64.exe". Dependent Assembly
Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 24/04/2011 14:25:21 | Computer Name = Andrew-PC | Source = Application Hang | ID = 1002
Description = The program chrome.exe version 0.0.0.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Action Center control panel. Process ID: 1674 Start Time:
01cc02ab44605701 Termination Time: 8 Application Path: C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe

Report
Id: 06c63d9e-6e9f-11e0-8f3b-0030674d5d8d

Error - 24/04/2011 19:34:26 | Computer Name = Andrew-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Research
In Motion\BlackBerry Desktop\MailServerMAPIProxy64.exe". Dependent Assembly Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 24/04/2011 19:34:38 | Computer Name = Andrew-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Common
Files\Research In Motion\AppLoader\MailServerMAPIProxy64.exe". Dependent Assembly
Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 26/04/2011 19:35:53 | Computer Name = Andrew-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Research
In Motion\BlackBerry Desktop\MailServerMAPIProxy64.exe". Dependent Assembly Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 26/04/2011 19:36:06 | Computer Name = Andrew-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Common
Files\Research In Motion\AppLoader\MailServerMAPIProxy64.exe". Dependent Assembly
Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 27/04/2011 22:59:43 | Computer Name = Andrew-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Research
In Motion\BlackBerry Desktop\MailServerMAPIProxy64.exe". Dependent Assembly Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 27/04/2011 22:59:54 | Computer Name = Andrew-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Common
Files\Research In Motion\AppLoader\MailServerMAPIProxy64.exe". Dependent Assembly
Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

[ Media Center Events ]
Error - 15/12/2010 01:02:47 | Computer Name = Andrew-PC | Source = MCUpdate | ID = 0
Description = 05:02:47 - Error connecting to the internet. 05:02:47 - Unable
to contact server..

Error - 15/12/2010 01:03:42 | Computer Name = Andrew-PC | Source = MCUpdate | ID = 0
Description = 05:03:34 - Error connecting to the internet. 05:03:34 - Unable
to contact server..

Error - 15/12/2010 02:07:33 | Computer Name = Andrew-PC | Source = MCUpdate | ID = 0
Description = 06:07:33 - Error connecting to the internet. 06:07:33 - Unable
to contact server..

Error - 15/12/2010 02:08:23 | Computer Name = Andrew-PC | Source = MCUpdate | ID = 0
Description = 06:08:20 - Error connecting to the internet. 06:08:20 - Unable
to contact server..

Error - 15/12/2010 03:12:12 | Computer Name = Andrew-PC | Source = MCUpdate | ID = 0
Description = 07:12:12 - Error connecting to the internet. 07:12:12 - Unable
to contact server..

Error - 15/12/2010 03:13:01 | Computer Name = Andrew-PC | Source = MCUpdate | ID = 0
Description = 07:12:59 - Error connecting to the internet. 07:12:59 - Unable
to contact server..

Error - 15/12/2010 04:21:11 | Computer Name = Andrew-PC | Source = MCUpdate | ID = 0
Description = 08:21:11 - Error connecting to the internet. 08:21:11 - Unable
to contact server..

Error - 15/12/2010 04:22:48 | Computer Name = Andrew-PC | Source = MCUpdate | ID = 0
Description = 08:22:43 - Error connecting to the internet. 08:22:43 - Unable
to contact server..

[ OSession Events ]
Error - 30/09/2010 12:41:12 | Computer Name = Andrew-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6539.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 24331
seconds with 1440 seconds of active time. This session ended with a crash.

Error - 12/10/2010 16:48:00 | Computer Name = Andrew-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6535.5002, Microsoft Office Version: 12.0.6425.1000. This session lasted 63
seconds with 60 seconds of active time. This session ended with a crash.

Error - 13/10/2010 22:22:17 | Computer Name = Andrew-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6541.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 58588
seconds with 240 seconds of active time. This session ended with a crash.

Error - 27/10/2010 13:00:12 | Computer Name = Andrew-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 32218
seconds with 1620 seconds of active time. This session ended with a crash.

Error - 07/11/2010 09:28:23 | Computer Name = Andrew-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3296
seconds with 900 seconds of active time. This session ended with a crash.

Error - 28/11/2010 05:49:53 | Computer Name = Andrew-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 88078
seconds with 0 seconds of active time. This session ended with a crash.

Error - 03/01/2011 07:00:44 | Computer Name = Andrew-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 788
seconds with 300 seconds of active time. This session ended with a crash.

Error - 15/01/2011 12:08:00 | Computer Name = Andrew-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1258
seconds with 540 seconds of active time. This session ended with a crash.

Error - 17/02/2011 10:38:53 | Computer Name = Andrew-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2694
seconds with 180 seconds of active time. This session ended with a crash.

Error - 24/02/2011 23:17:54 | Computer Name = Andrew-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 43204
seconds with 180 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 23/04/2011 02:24:29 | Computer Name = Andrew-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 23/04/2011 02:24:29 | Computer Name = Andrew-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 23/04/2011 06:12:13 | Computer Name = Andrew-PC | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk4\DR22.

Error - 23/04/2011 06:12:14 | Computer Name = Andrew-PC | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk4\DR22.

Error - 26/04/2011 10:48:21 | Computer Name = Andrew-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 26/04/2011 10:48:25 | Computer Name = Andrew-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 27/04/2011 22:26:01 | Computer Name = Andrew-PC | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter

Error - 27/04/2011 22:26:01 | Computer Name = Andrew-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 27/04/2011 22:26:02 | Computer Name = Andrew-PC | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter

Error - 27/04/2011 22:26:02 | Computer Name = Andrew-PC | Source = atikmdag | ID = 43029
Description = Display is not active


< End of report >
Post #2
Hello andyjw1 and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:
• Please follow all instructions in the order posted
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• If you don't understand something, please don't hesitate to ask for clarification before proceeding
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

I am looking at your log now and will reply with instructions shortly

Satchfan
Post #3
Hello again Andy

P2P - I see you have P2P software, (uTorrent, ), installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infection. If your computer is infected, it almost certainly contributed to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are more often than not, infected. The bad guys use P2P file-sharing as a major conduit to spread their wares.

Please see this topic for more information:

Perils of P2P File Sharing.

I would strongly recommend that you uninstall it now. You can do so via Control Panel, Programs, and then Programs and Features.

Should you decide to keep it, please don’t use it until we have finished up here.

===================================================

Run OTL

  • Double click on the icon to run it.
  • Copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:OTL
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchqu.com/406
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [] File not found
[2011/04/25 15:24:06 | 000,000,348 | —- | M] () – C:\Windows\tasks\At1.job

:Reg

:Files

:Commands
[purity]
[emptytemp]
[Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log (don't check the boxes beside LOP Check or Purity this time)
===================================================

Download the GMER Rootkit Scanner

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • All drives/partitions except C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

===================================================

Download Malwarebytes-Anti-Malware

Click here
  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware. and Launch Malwarebytes' Anti-Malware, then click Finish..
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.


Logs to include with next post:

OTL fix log
New OTL log
Gmer.txt
Mbam.txt

Please let me know if there are any changes

Thanks

Satchfan
Post #4
Hi

Thanks for the help, Ive uninstalled the P2P but that is the only change Ive made

OTL fix log

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
C:\Windows\Tasks\At1.job moved successfully.
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Andrew
->Temp folder emptied: 641729922 bytes
->Temporary Internet Files folder emptied: 190422216 bytes
->Java cache emptied: 3281811 bytes
->Google Chrome cache emptied: 385233573 bytes
->Flash cache emptied: 429951 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56502 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 104982710 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 11318891675 bytes

Total Files Cleaned = 12,059.00 mb


OTL by OldTimer - Version 3.2.22.3 log created on 04282011_171002

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…


New OTL log

OTL logfile created on: 28/04/2011 17:21:26 - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Andrew\Desktop
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 41.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 63.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 297.99 Gb Total Space | 221.49 Gb Free Space | 74.33% Space Free | Partition Type: NTFS
Drive E: | 189.92 Gb Total Space | 143.78 Gb Free Space | 75.71% Space Free | Partition Type: NTFS
Drive F: | 149.05 Gb Total Space | 114.29 Gb Free Space | 76.68% Space Free | Partition Type: NTFS
Drive G: | 74.53 Gb Total Space | 73.88 Gb Free Space | 99.13% Space Free | Partition Type: NTFS
Drive I: | 74.51 Gb Total Space | 57.38 Gb Free Space | 77.00% Space Free | Partition Type: FAT32

Computer Name: ANDREW-PC | User Name: Andrew | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Andrew\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe (Nokia)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
PRC - C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe (ROUTE 66)
PRC - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
PRC - C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe (Nokia)
PRC - C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe ()
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe (Nokia)
PRC - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe (Nokia)
PRC - C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe (Sanford, L.P.)
PRC - C:\Program Files\DYMO\DYMO Label Software\DLSService.exe (Sanford, L.P.)
PRC - C:\Windows\System32\atieclxx.exe (AMD)
PRC - C:\Windows\System32\atiesrxx.exe (AMD)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Users\Andrew\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\guard32.dll (COMODO)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (cmdAgent) – C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (TeamViewer5) – C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (AMD External Events Utility) – C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AcfXAudioService) – C:\Windows\System32\ACFXAU32.dll (Conexant Systems, Inc.)
SRV - (WcesComm) – C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (epmntdrv) – C:\Windows\System32\epmntdrv.sys ()
DRV - (EuGdiDrv) – C:\Windows\System32\EuGdiDrv.sys ()
DRV - (inspect) – C:\Windows\System32\drivers\inspect.sys (COMODO)
DRV - (cmdGuard) – C:\Windows\System32\drivers\cmdGuard.sys (COMODO)
DRV - (cmdHlp) – C:\Windows\System32\drivers\cmdhlp.sys (COMODO)
DRV - (cmderd) – C:\Windows\System32\drivers\cmderd.sys (COMODO)
DRV - (UsbserFilt) – C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) – C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) – C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) – C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (nmwcdnsu) – C:\Windows\System32\drivers\nmwcdnsu.sys (Nokia)
DRV - (nmwcdnsuc) – C:\Windows\System32\drivers\nmwcdnsuc.sys (Nokia)
DRV - (vncmirror) – C:\Windows\System32\drivers\vncmirror.sys (RealVNC Ltd.)
DRV - (FTDIBUS) – C:\Windows\System32\drivers\ftdibus.sys (FTDI Ltd.)
DRV - (FTSER2K) – C:\Windows\System32\drivers\ftser2k.sys (FTDI Ltd.)
DRV - (acfva) – C:\Windows\System32\drivers\ACFVA32.sys (Conexant Systems Inc.)
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (WINUSB) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (dgcfltr) – C:\Windows\System32\drivers\ACFDCP32.sys (Conexant Systems, Inc.)
DRV - (XAudio) – C:\Windows\System32\drivers\ACFXAU32.sys (Conexant Systems, Inc.)
DRV - (pccsmcfd) – C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (mdmxsdk) – C:\Windows\System32\drivers\ACFSDK32.sys (Conexant)
DRV - (Navcar) – C:\Windows\System32\drivers\Navcar.sys (NAVMAN)
DRV - (sscdmdm) – C:\Windows\System32\drivers\sscdmdm.sys (MCCI)
DRV - (sscdmdfl) – C:\Windows\System32\drivers\sscdmdfl.sys (MCCI)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) – C:\Windows\System32\drivers\sscdbus.sys (MCCI)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A1 CD 0D B6 D7 C9 CA 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========


FF - HKLM\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2011/04/04 21:57:55 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011/01/13 09:33:23 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011/04/04 21:57:55 | 000,000,000 | —D | M]

[2011/01/13 09:38:11 | 000,000,000 | —D | M] (No name found) – C:\Users\Andrew\AppData\Roaming\Mozilla\Extensions
[2011/01/13 09:38:11 | 000,000,000 | —D | M] (No name found) – C:\Users\Andrew\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

O1 HOSTS File: ([2009/06/10 22:39:37 | 000,000,824 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {30391296-2569-389F-1086-5D193888614C} - C:\Windows\System32\msls331.dll ()
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [CnxtCoInstallerDefer] C:\Program Files\CONEXANT\SETUP4BAA8672210\SETUP\setup.exe (Conexant Systems, Inc.)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKLM..\Run: [DLSService] C:\Program Files\DYMO\DYMO Label Software\DLSService.exe (Sanford, L.P.)
O4 - HKLM..\Run: [KeePass 2 PreLoad] C:\Program Files\KeePass Password Safe 2\KeePass.exe (Dominik Reichl)
O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [ROUTE66Sync] C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe (ROUTE 66)
O4 - HKCU..\Run: [] File not found
O4 - HKCU..\Run: [DymoQuickPrint] C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe (Sanford, L.P.)
O4 - HKCU..\Run: [ISUSPM] File not found
O4 - HKCU..\Run: [NokiaOviSuite2] C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe (Nokia)
O4 - HKCU..\Run: [Pando Media Booster] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - AppInit_DLLs: (C:\Windows\system32\guard32.dll) - C:\Windows\System32\guard32.dll (COMODO)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/28 17:10:02 | 000,000,000 | —D | C] – C:\_OTL
[2011/04/28 08:01:06 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Users\Andrew\Desktop\OTL.exe
[2011/04/28 00:47:58 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\prevhost.exe
[2011/04/28 00:47:51 | 001,686,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\esent.dll
[2011/04/28 00:47:48 | 000,146,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\storport.sys
[2011/04/28 00:47:45 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fsutil.exe
[2011/04/28 00:47:27 | 000,442,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsPrint.dll
[2011/04/28 00:47:20 | 002,614,784 | —- | C] (Microsoft Corporation) – C:\Windows\explorer.exe
[2011/04/26 09:40:47 | 000,000,000 | —D | C] – C:\Users\Andrew\Desktop\GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}
[2011/04/21 09:59:28 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Local\Ilivid Player
[2011/04/21 09:57:28 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Local\PackageAware
[2011/04/21 09:49:52 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/04/21 09:48:33 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/04/21 09:48:28 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/04/21 09:45:07 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2011/04/21 09:44:19 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2011/04/20 13:15:47 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EASEUS Partition Master 8.0.1 Home Edition
[2011/04/20 13:15:29 | 000,000,000 | —D | C] – C:\Program Files\EASEUS
[2011/04/18 15:24:04 | 000,000,000 | —D | C] – C:\Windows\System32\1087
[2011/04/15 16:20:23 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[2011/04/15 16:20:22 | 000,428,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vbscript.dll
[2011/04/15 16:20:16 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dnscacheugc.exe
[2011/04/15 16:20:14 | 000,294,912 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2011/04/15 16:20:13 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2011/04/15 16:20:02 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/04/15 16:20:02 | 000,381,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/04/15 16:20:01 | 000,606,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/04/15 16:20:01 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/04/15 16:20:00 | 000,185,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/04/15 16:20:00 | 000,064,512 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/04/15 16:19:59 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/04/15 16:19:58 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/04/15 16:19:58 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/04/15 16:19:57 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/04/15 16:19:57 | 000,386,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/04/15 16:19:38 | 002,331,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/04/15 16:19:36 | 000,191,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\FXSCOVER.exe
[2011/04/15 16:19:33 | 000,288,256 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsGdiConverter.dll
[2011/04/15 16:19:28 | 001,137,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42.dll
[2011/04/15 16:19:27 | 001,164,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42u.dll
[2011/04/14 12:35:58 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Roaming\PlaneShift
[2011/04/14 12:35:58 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Roaming\CrystalSpace
[2011/04/14 12:35:58 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Roaming\CrystalApp
[2011/04/14 12:32:39 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlaneShift
[2011/04/14 12:26:03 | 000,000,000 | —D | C] – C:\Program Files\PlaneShift
[2011/04/14 08:35:46 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Roaming\uTorrent
[2011/04/06 16:20:16 | 000,197,920 | —- | C] (Apple Inc.) – C:\Windows\System32\dnssdX.dll
[2011/04/06 16:20:16 | 000,107,808 | —- | C] (Apple Inc.) – C:\Windows\System32\dns-sd.exe
[2011/04/06 16:20:16 | 000,091,424 | —- | C] (Apple Inc.) – C:\Windows\System32\dnssd.dll
[2011/04/06 16:20:16 | 000,075,040 | —- | C] (Apple Inc.) – C:\Windows\System32\jdns_sd.dll
[2011/04/04 22:21:37 | 000,000,000 | —D | C] – C:\Users\Andrew\Documents\Ovi
[2011/04/04 22:09:09 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Roaming\Nokia Ovi Suite
[2011/04/04 22:09:07 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Roaming\Nokia
[2011/04/04 22:08:41 | 000,000,000 | —D | C] – C:\ProgramData\Nokia
[2011/04/04 22:04:42 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Local\NokiaAccount
[2011/04/04 22:01:17 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Local\Nokia
[2011/04/04 22:00:51 | 000,000,000 | —D | C] – C:\ProgramData\PC Suite
[2011/04/04 22:00:47 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Roaming\PC Suite
[2011/04/04 22:00:13 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nokia
[2011/04/04 21:58:27 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Nokia
[2011/04/04 21:57:50 | 000,000,000 | —D | C] – C:\Program Files\DIFX
[2011/04/04 21:57:48 | 000,018,816 | —- | C] (Nokia) – C:\Windows\System32\drivers\pccsmcfd.sys
[2011/04/04 21:57:29 | 000,000,000 | —D | C] – C:\Program Files\PC Connectivity Solution
[2011/04/04 21:56:20 | 000,075,264 | —- | C] (Nokia) – C:\Windows\System32\nmwcdcls.dll
[2011/04/04 21:53:55 | 000,000,000 | —D | C] – C:\ProgramData\NokiaInstallerCache
[2011/04/04 21:53:55 | 000,000,000 | —D | C] – C:\Program Files\Nokia
[2011/03/31 07:55:25 | 000,000,000 | —D | C] – C:\Users\Andrew\Documents\The Lord of the Rings Online
[2011/03/31 07:55:25 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Local\The Lord of the Rings Online
[2011/03/30 19:47:38 | 001,974,616 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DCompiler_42.dll
[2011/03/30 19:45:09 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Local\Turbine
[2011/03/30 19:40:02 | 001,892,184 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DX9_42.dll
[2011/03/30 19:40:01 | 003,495,784 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_33.dll
[2011/03/30 19:39:19 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Local\ApplicationHistory
[2011/03/30 19:36:30 | 000,000,000 | —D | C] – C:\Windows\System32\URTTEMP
[2011/03/30 19:35:41 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Codemasters
[2011/03/30 18:52:45 | 000,000,000 | —D | C] – C:\Program Files\Codemasters
[2011/03/30 15:04:33 | 000,000,000 | —D | C] – C:\Users\Andrew\Desktop\LOTROEU_Enedwaith_EN_GB_Installer
[2011/03/30 15:04:01 | 000,000,000 | —D | C] – C:\Users\Andrew\AppData\Local\PMB Files
[2011/03/30 15:03:52 | 000,000,000 | —D | C] – C:\ProgramData\PMB Files
[2011/03/30 15:03:15 | 000,000,000 | —D | C] – C:\Program Files\Pando Networks
[2011/03/30 12:10:09 | 000,000,000 | —D | C] – C:\Windows\Minidump
[2008/12/23 09:32:46 | 000,184,320 | R— | C] ( ) – C:\Windows\System32\SgE.interop.MSXML2.dll
[2006/12/12 11:59:08 | 000,184,320 | —- | C] ( ) – C:\Windows\System32\Interop.MSXML2.dll

========== Files - Modified Within 30 Days ==========

[2011/04/28 17:24:08 | 000,015,008 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/04/28 17:24:08 | 000,015,008 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/04/28 17:21:02 | 000,301,568 | —- | M] () – C:\Users\Andrew\Desktop\gmer.exe
[2011/04/28 17:16:37 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/04/28 17:16:32 | 1408,737,280 | -HS- | M] () – C:\hiberfil.sys
[2011/04/28 17:14:51 | 001,474,832 | —- | M] () – C:\Windows\System32\drivers\sfi.dat
[2011/04/28 16:51:00 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2133833747-3894688989-3222378912-1001UA.job
[2011/04/28 08:00:56 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\Andrew\Desktop\OTL.exe
[2011/04/28 07:59:21 | 000,043,630 | —- | M] () – C:\Users\Public\Documents\NewDatabase.kdbx
[2011/04/28 01:51:08 | 000,000,860 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2133833747-3894688989-3222378912-1001Core.job
[2011/04/26 20:47:12 | 000,002,407 | —- | M] () – C:\Users\Andrew\Desktop\Google Chrome.lnk
[2011/04/23 11:13:26 | 000,636,792 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/04/23 11:13:26 | 000,114,234 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/04/21 09:49:52 | 000,001,753 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/04/20 13:15:47 | 000,001,392 | —- | M] () – C:\Users\Public\Desktop\EASEUS Partition Master 8.0.1 Home Edition.lnk
[2011/04/16 03:40:48 | 000,411,616 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/04/06 16:20:16 | 000,197,920 | —- | M] (Apple Inc.) – C:\Windows\System32\dnssdX.dll
[2011/04/06 16:20:16 | 000,107,808 | —- | M] (Apple Inc.) – C:\Windows\System32\dns-sd.exe
[2011/04/06 16:20:16 | 000,091,424 | —- | M] (Apple Inc.) – C:\Windows\System32\dnssd.dll
[2011/04/06 16:20:16 | 000,075,040 | —- | M] (Apple Inc.) – C:\Windows\System32\jdns_sd.dll
[2011/04/04 22:03:51 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2011/04/04 22:00:12 | 000,002,098 | —- | M] () – C:\Users\Public\Desktop\Nokia Ovi Suite.lnk
[2011/03/30 19:45:11 | 000,000,094 | —- | M] () – C:\Users\Andrew\AppData\Local\fusioncache.dat
[2011/03/30 19:35:44 | 000,002,213 | —- | M] () – C:\Users\Andrew\Desktop\The Lord of the Rings Online.lnk
[2011/03/30 15:02:47 | 000,000,117 | —- | M] () – C:\Users\Andrew\jagex_runescape_preferences2.dat
[2011/03/30 15:02:47 | 000,000,046 | —- | M] () – C:\Users\Andrew\jagex_runescape_preferences.dat
[2011/03/30 14:49:42 | 000,032,768 | —- | M] () – C:\Users\Andrew\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/03/30 12:10:05 | 148,307,842 | —- | M] () – C:\Windows\MEMORY.DMP

========== Files Created - No Company Name ==========

[2011/04/21 09:49:52 | 000,001,753 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/04/20 13:15:47 | 002,340,992 | —- | C] () – C:\Windows\System32\BootMan.exe
[2011/04/20 13:15:47 | 000,086,408 | —- | C] () – C:\Windows\System32\setupempdrv03.exe
[2011/04/20 13:15:47 | 000,018,048 | —- | C] () – C:\Windows\System32\EuEpmGdi.dll
[2011/04/20 13:15:47 | 000,014,216 | —- | C] () – C:\Windows\System32\epmntdrv.sys
[2011/04/20 13:15:47 | 000,008,456 | —- | C] () – C:\Windows\System32\EuGdiDrv.sys
[2011/04/20 13:15:47 | 000,001,392 | —- | C] () – C:\Users\Public\Desktop\EASEUS Partition Master 8.0.1 Home Edition.lnk
[2011/04/04 22:03:51 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2011/04/04 22:00:12 | 000,002,098 | —- | C] () – C:\Users\Public\Desktop\Nokia Ovi Suite.lnk
[2011/03/30 19:45:11 | 000,000,094 | —- | C] () – C:\Users\Andrew\AppData\Local\fusioncache.dat
[2011/03/30 19:35:44 | 000,002,213 | —- | C] () – C:\Users\Andrew\Desktop\The Lord of the Rings Online.lnk
[2011/03/30 12:10:05 | 148,307,842 | —- | C] () – C:\Windows\MEMORY.DMP
[2011/03/27 09:37:11 | 000,007,599 | —- | C] () – C:\Users\Andrew\AppData\Local\Resmon.ResmonCfg
[2010/12/20 14:12:23 | 000,121,342 | —- | C] () – C:\Windows\File Renamer - Basic Uninstaller.exe
[2010/11/17 10:56:11 | 000,032,768 | —- | C] () – C:\Users\Andrew\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/05 18:12:15 | 000,038,425 | —- | C] () – C:\Users\Andrew\AppData\Roaming\Comma Separated Values (DOS).ADR
[2010/06/21 09:35:44 | 000,004,096 | -H– | C] () – C:\Users\Andrew\AppData\Local\keyfile3.drm
[2010/05/28 15:20:08 | 000,042,496 | —- | C] () – C:\Windows\System32\K8062D.dll
[2010/05/28 15:20:06 | 000,032,768 | —- | C] () – C:\Windows\System32\DMX4ALL.dll
[2010/04/07 19:14:58 | 000,270,848 | —- | C] () – C:\Windows\UNWISE32.EXE
[2010/03/26 15:35:02 | 000,000,037 | —- | C] () – C:\Windows\iltwain.ini
[2010/03/25 18:11:33 | 000,002,560 | —- | C] () – C:\Windows\_MSRSTRT.EXE
[2010/03/25 17:32:35 | 000,200,704 | —- | C] () – C:\Windows\System32\ftssrch.dll
[2010/03/24 23:05:21 | 000,006,656 | —- | C] () – C:\Windows\System32\NT6CDLMU.DLL
[2010/03/24 23:04:46 | 000,405,504 | —- | C] () – C:\Windows\deinscdl.exe
[2010/03/24 22:44:23 | 000,006,656 | —- | C] () – C:\Windows\System32\IMGFX6MU.DLL
[2010/03/24 22:44:20 | 000,319,488 | —- | C] () – C:\Windows\deinst32.exe
[2010/03/24 22:43:03 | 000,144,896 | —- | C] () – C:\Windows\CHT_SUP.DLL
[2010/03/24 17:34:44 | 000,000,179 | —- | C] () – C:\Windows\ODBCINST.INI
[2010/03/23 19:05:20 | 001,474,832 | —- | C] () – C:\Windows\System32\drivers\sfi.dat
[2010/03/22 17:14:32 | 000,000,578 | —- | C] () – C:\Windows\ODBC.INI
[2010/03/22 16:38:09 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2009/08/03 16:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 16:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/07/14 05:57:37 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/14 05:33:53 | 000,411,616 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/14 03:05:48 | 000,636,792 | —- | C] () – C:\Windows\System32\perfh009.dat
[2009/07/14 03:05:48 | 000,291,294 | —- | C] () – C:\Windows\System32\perfi009.dat
[2009/07/14 03:05:48 | 000,114,234 | —- | C] () – C:\Windows\System32\perfc009.dat
[2009/07/14 03:05:48 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd009.dat
[2009/07/14 03:05:05 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2009/07/14 03:04:11 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2009/07/14 00:55:01 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/14 00:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/14 00:42:47 | 000,200,704 | —- | C] () – C:\Windows\System32\addvpack.dll
[2009/07/14 00:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/07/14 00:26:12 | 000,200,704 | —- | C] () – C:\Windows\System32\msls331.dll
[2009/07/14 00:20:02 | 000,017,408 | —- | C] () – C:\Windows\System32\cofirre.exe
[2009/07/10 14:59:26 | 000,282,624 | —- | C] () – C:\Windows\System32\SGList32.dll
[2009/07/10 14:59:20 | 000,278,528 | —- | C] () – C:\Windows\System32\SGTool32.dll
[2009/07/10 14:59:16 | 000,090,112 | —- | C] () – C:\Windows\System32\SGIntl32.dll
[2009/07/10 14:59:14 | 000,073,728 | —- | C] () – C:\Windows\System32\SGDt32.dll
[2009/07/10 14:59:12 | 000,172,032 | —- | C] () – C:\Windows\System32\SGHelp32.dll
[2009/07/10 14:59:08 | 000,253,952 | —- | C] () – C:\Windows\System32\SGSchemeXml.dll
[2009/07/10 14:59:00 | 000,118,784 | —- | C] () – C:\Windows\System32\SGSchemeXP.dll
[2009/07/10 14:58:56 | 000,176,128 | —- | C] () – C:\Windows\System32\SGSchemeDefault.dll
[2009/07/10 14:58:52 | 000,221,184 | —- | C] () – C:\Windows\System32\SGSchemeManager.dll
[2009/07/10 14:58:46 | 000,094,208 | —- | C] () – C:\Windows\System32\SGCom32.dll
[2009/07/10 14:58:02 | 000,237,568 | —- | C] () – C:\Windows\System32\SGWebBrowser.dll
[2009/06/18 20:29:04 | 000,197,654 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2009/06/10 22:26:10 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2009/02/18 18:55:22 | 000,294,912 | —- | C] () – C:\Windows\System32\ATIODE.exe
[2009/02/03 21:52:04 | 000,045,056 | —- | C] () – C:\Windows\System32\ATIODCLI.exe
[2008/12/23 09:33:50 | 000,045,056 | —- | C] () – C:\Windows\System32\SgELauncher.dll
[2008/12/23 09:33:26 | 000,114,688 | —- | C] () – C:\Windows\System32\SgEData.dll
[2008/12/22 10:26:34 | 000,143,360 | —- | C] () – C:\Windows\System32\SGSTDREG.dll
[2008/12/22 10:26:30 | 000,131,072 | —- | C] () – C:\Windows\System32\SGRegister.dll
[2008/12/01 15:36:12 | 000,143,360 | —- | C] () – C:\Windows\System32\SGCtrlEx.dll
[2008/12/01 15:36:06 | 000,200,704 | —- | C] () – C:\Windows\System32\SGTBAR32.DLL
[2008/12/01 15:36:02 | 000,049,152 | —- | C] () – C:\Windows\System32\SGSTAT32.DLL
[2008/12/01 15:36:02 | 000,049,152 | —- | C] () – C:\Windows\System32\SGLOGO32.DLL
[2008/12/01 15:36:00 | 000,180,224 | —- | C] () – C:\Windows\System32\SGJPEG32.dll
[2008/12/01 15:35:56 | 000,249,856 | —- | C] () – C:\Windows\System32\SGCDLG32.DLL
[2008/12/01 15:35:36 | 000,061,440 | —- | C] () – C:\Windows\System32\SGAPPBAR.DLL
[2008/12/01 15:35:34 | 000,061,440 | —- | C] () – C:\Windows\System32\SG3D32.DLL
[2008/05/29 12:17:22 | 000,172,032 | —- | C] () – C:\Windows\System32\SageEventHandler.exe
[2007/12/04 14:22:58 | 000,061,440 | —- | C] () – C:\Windows\System32\SageFolderBrowser.dll
[2006/11/01 16:50:40 | 000,126,976 | R— | C] () – C:\Windows\System32\PDFInstall.exe
[2006/11/01 16:41:24 | 000,233,472 | —- | C] () – C:\Windows\System32\SGLCH32.DLL
[2006/11/01 15:41:16 | 001,712,128 | —- | C] () – C:\Windows\System32\SGRep32.dll
[2005/11/30 12:49:32 | 000,040,960 | —- | C] () – C:\Windows\System32\REPDES32.EXE
[2005/07/11 13:33:12 | 000,208,896 | —- | C] () – C:\Windows\System32\SDOApp.dll
[2005/06/03 08:06:04 | 000,212,992 | —- | C] () – C:\Windows\System32\SGSchemeConfig.dll
[2005/05/16 21:36:56 | 001,798,144 | —- | C] () – C:\Windows\System32\ltmm_n.dll
[2004/06/09 10:57:12 | 000,118,784 | —- | C] () – C:\Windows\System32\Install.exe
[2002/10/16 09:42:02 | 000,114,688 | —- | C] () – C:\Windows\System32\fdi.dll
[2002/10/16 09:40:14 | 000,094,208 | —- | C] () – C:\Windows\System32\fci.dll
[2002/04/16 11:27:54 | 000,000,005 | -HS- | C] () – C:\Windows\System32\CdI5T.drv
[2000/07/27 01:13:02 | 000,053,760 | —- | C] () – C:\Windows\System32\zlib.dll
[1998/03/26 02:12:00 | 000,053,248 | —- | C] () – C:\Windows\System32\SgHmZLib.dll
[1998/03/20 01:00:00 | 000,001,048 | -HS- | C] () – C:\Windows\System32\fnmode.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:0CFF5F08

< End of report >
Post #5
The GMER file is too big to paste in one post, I cant get the attachment system to work so Ill spread it over a couple of posts


Gmer.txt

GMER 1.0.15.15570 - http://www.gmer.net
Rootkit scan 2011-04-28 17:44:32
Windows 6.1.7600 Harddisk2\DR2 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HDS721032CLA362 rev.JPFOA39C
Running: gmer.exe; Driver: C:\Users\Andrew\AppData\Local\Temp\uwdiqpob.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwAdjustPrivilegesToken [0x883CFC14]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwAlpcConnectPort [0x883D11C4]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwAlpcCreatePort [0x883CFE00]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwConnectPort [0x883CEF40]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateFile [0x883CF87A]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreatePort [0x883CEE1C]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateSection [0x883CF626]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateSymbolicLinkObject [0x883D0E54]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateThread [0x883CE808]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateThreadEx [0x883CFF10]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwLoadDriver [0x883D0864]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwMakeTemporaryObject [0x883CF208]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenFile [0x883CFA56]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenSection [0x883CF4AC]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwRequestWaitReplyPort [0x883D02FC]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSecureConnectPort [0x883D05B0]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSetSystemInformation [0x883D0B5C]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwShutdownSystem [0x883CF172]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSystemDebugControl [0x883CF398]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwTerminateProcess [0x883CEC1E]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwTerminateThread [0x883CEA0C]

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwSaveKeyEx + 13BD 82E99589 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82EBE092 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, …] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!RtlSidHashLookup + 220 82EC5830 4 Bytes [14, FC, 3C, 88] {ADC AL, 0xfc; CMP AL, 0x88}
.text ntkrnlpa.exe!RtlSidHashLookup + 248 82EC5858 8 Bytes [C4, 11, 3D, 88, 00, FE, 3C, …]
.text ntkrnlpa.exe!RtlSidHashLookup + 2DC 82EC58EC 4 Bytes [40, EF, 3C, 88] {INC EAX; OUT DX, EAX; CMP AL, 0x88}
.text ntkrnlpa.exe!RtlSidHashLookup + 2F8 82EC5908 4 Bytes [7A, F8, 3C, 88] {JP 0xfffffffffffffffa; CMP AL, 0x88}
.text ntkrnlpa.exe!RtlSidHashLookup + 324 82EC5934 4 Bytes [1C, EE, 3C, 88] {SBB AL, 0xee; CMP AL, 0x88}
.text …
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x8DE04000, 0x2D5378, 0xE8000020]
.text autochk.exe 002C11D1 1 Byte [01]
.text autochk.exe 002C11D4 2 Bytes [9D, 01]
.text autochk.exe 002C11D8 2 Bytes [9E, 01]
.text autochk.exe 002C11DC 2 Bytes [9F, 01]
.text autochk.exe 002C11E0 2 Bytes [A0, 01]
.text …
.text sechost.dll!CreateServiceA 76FF567C 7 Bytes JMP 1002DD80
.text sechost.dll!CreateServiceW 76FF589F 7 Bytes JMP 1002DAA0
.text sechost.dll!OpenServiceW 76FF714B 7 Bytes JMP 1002D830
.text sechost.dll!OpenServiceA 76FF7245 7 Bytes JMP 1002D590
.text kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790
.text kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320
.text kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0
.text kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0
.text kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20
.text kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0
.text kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0
.text kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20
.text kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0
.text kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00
.text kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0
.text kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0
.text kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20
.text kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60
.text kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60
.text kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20
.text kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0
.text kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80
.text kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60
.text kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0
.text kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80
.text kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80
.text kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40
.text kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40
.text kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0
.text kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00
.text kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40
.text kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00
.text shell32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0
.text shell32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0
.text shell32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0
.text shell32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00
.text ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600
.text ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840
.text user32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0
.text advapi32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0

—- User code sections - GMER 1.0.15 —-

.text C:\Windows\System32\svchost.exe[176] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9]
.text C:\Windows\System32\svchost.exe[176] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[176] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9]
.text C:\Windows\system32\wininit.exe[472] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[472] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9]
.text C:\Windows\system32\services.exe[520] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[520] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9]
.text C:\Windows\system32\lsass.exe[540] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[540] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9]
.text C:\Windows\system32\lsm.exe[548] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[548] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[668] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[668] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[800] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[800] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe[852] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 0050ED30 C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO Internet Security/COMODO)
.text C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe[852] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 005266C0 C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[892] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[936] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[936] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9]
.text C:\Windows\system32\atiesrxx.exe[976] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atiesrxx.exe[976] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9]
.text C:\Windows\System32\svchost.exe[1020] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1020] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9]
.text C:\Windows\System32\svchost.exe[1092] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\svchost.exe[1092] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[1124] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1124] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[1244] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1244] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9]
.text C:\Windows\system32\atieclxx.exe[1468] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\atieclxx.exe[1468] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9]
.text C:\Windows\System32\spoolsv.exe[1612] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\System32\spoolsv.exe[1612] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[1676] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1676] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9]
.text C:\Windows\system32\taskhost.exe[1708] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\taskhost.exe[1708] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[1788] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\svchost.exe[1788] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
Post #6
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1808] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Windows\Explorer.EXE[1832] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\Explorer.EXE[1832] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Windows\system32\Dwm.exe[1852] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\Dwm.exe[1852] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Bonjour\mDNSResponder.exe[1876] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Windows\system32\svchost.exe[1900] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1900] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Windows\system32\svchost.exe[1984] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[1984] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe[2012] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2132] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe[2172] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe[2184] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 0121CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 0120CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 0121CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 0121CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 0121CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 0121CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 0121C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 0121CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 0121CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 0121C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 0121CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 0121CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 0121CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 0121C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 0120CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 0121CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 0121A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 01217790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 01218320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 0121CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 012162C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 0121CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 0121CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 0121CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 0121CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 0121CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 0121CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 0121CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 0121CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 0121CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 0121CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 0121CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 0121CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 0121CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 0121CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 0121CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 0121CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 0121CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 0121CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 0121CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 0121CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 0121CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 0121CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 0121CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 0121CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 01216BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 0121E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 0121E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 0121E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 0121C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 0121C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 0121C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\ServiceLayer.exe[2592] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 0121CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Windows\system32\svchost.exe[2648] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[2648] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2736] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Windows\notepad.exe[2980] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[2980] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\COMODO\COMODO Internet Security\cfp.exe[3064] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 00744760 C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DLSService.exe[3088] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] WININET.dll!InternetConnectW 752E0452 5 Bytes JMP 1002C960 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] WININET.dll!InternetConnectA 752E050F 5 Bytes JMP 1002C980 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3120] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Windows\WindowsMobile\wmdc.exe[3128] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] WININET.dll!InternetConnectW 752E0452 5 Bytes JMP 1002C960 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] WININET.dll!InternetConnectA 752E050F 5 Bytes JMP 1002C980 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\WindowsMobile\wmdc.exe[3128] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] KERNEL32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] shell32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] shell32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] shell32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] shell32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\ROUTE 66\ROUTE 66 Sync\Sync9Loader.exe[3168] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
Post #7
.text C:\Windows\system32\svchost.exe[3268] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Windows\system32\svchost.exe[3268] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\svchost.exe[3268] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Microsoft IntelliPoint\ipoint.exe[3292] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] WININET.dll!InternetConnectW 752E0452 5 Bytes JMP 1002C960 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] WININET.dll!InternetConnectA 752E050F 5 Bytes JMP 1002C980 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3304] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe[3368] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\iTunes\iTunesHelper.exe[3384] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] WININET.DLL!InternetConnectW 752E0452 5 Bytes JMP 1002C960 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iTunes\iTunesHelper.exe[3384] WININET.DLL!InternetConnectA 752E050F 5 Bytes JMP 1002C980 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\DYMO\DYMO Label Software\DymoQuickPrint.exe[3392] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\iPod\bin\iPodService.exe[3576] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\iPod\bin\iPodService.exe[3576] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe[3700] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Windows\system32\SearchIndexer.exe[3824] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\SearchIndexer.exe[3824] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtCreateFile + 6 76EB4876 4 Bytes [28, 00, 17, 00] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtCreateFile + B 76EB487B 1 Byte [E2] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtMapViewOfSection + 6 76EB4ED6 1 Byte [28] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtMapViewOfSection + 6 76EB4ED6 4 Bytes [28, 03, 17, 00] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtMapViewOfSection + B 76EB4EDB 1 Byte [E2] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenFile + 6 76EB4F86 4 Bytes [68, 00, 17, 00] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenFile + B 76EB4F8B 1 Byte [E2] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenProcess + 6 76EB5036 4 Bytes [A8, 01, 17, 00] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenProcess + B 76EB503B 1 Byte [E2] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenProcessToken + 6 76EB5046 4 Bytes CALL 75EB674C C:\Windows\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenProcessToken + B 76EB504B 1 Byte [E2] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenProcessTokenEx + 6 76EB5056 4 Bytes [A8, 02, 17, 00] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenProcessTokenEx + B 76EB505B 1 Byte [E2] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenThread + 6 76EB50B6 4 Bytes [68, 01, 17, 00] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenThread + B 76EB50BB 1 Byte [E2] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenThreadToken + 6 76EB50C6 4 Bytes [68, 02, 17, 00] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenThreadToken + B 76EB50CB 1 Byte [E2] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenThreadTokenEx + 6 76EB50D6 4 Bytes CALL 75EB67DD C:\Windows\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenThreadTokenEx + B 76EB50DB 1 Byte [E2] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtQueryAttributesFile + 6 76EB51E6 4 Bytes [A8, 00, 17, 00] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtQueryAttributesFile + B 76EB51EB 1 Byte [E2] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtQueryFullAttributesFile + 6 76EB5296 4 Bytes CALL 75EB699B C:\Windows\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtQueryFullAttributesFile + B 76EB529B 1 Byte [E2] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtSetInformationFile + 6 76EB58E6 4 Bytes [28, 01, 17, 00] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtSetInformationFile + B 76EB58EB 1 Byte [E2] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtSetInformationThread + 6 76EB5946 4 Bytes [28, 02, 17, 00] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtSetInformationThread + B 76EB594B 1 Byte [E2] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtUnmapViewOfSection + 6 76EB5C66 1 Byte [68] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtUnmapViewOfSection + 6 76EB5C66 4 Bytes [68, 03, 17, 00] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtUnmapViewOfSection + B 76EB5C6B 1 Byte [E2] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!KiUserExceptionDispatcher 76EB6298 5 Bytes JMP 1002C750 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[4092] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Windows\System32\svchost.exe[4108] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\System32\svchost.exe[4108] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Windows\notepad.exe[4276] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\notepad.exe[4276] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Windows\system32\DllHost.exe[4280] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\DllHost.exe[4280] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Windows\system32\AUDIODG.EXE[4332] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\system32\AUDIODG.EXE[4332] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
Post #8
.text C:\Users\Andrew\Desktop\gmer.exe[4576] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Users\Andrew\Desktop\gmer.exe[4576] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] shell32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] shell32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] shell32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] shell32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\Desktop\gmer.exe[4576] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[4592] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] WS2_32.dll!WSASocketW 76FB3D1B 7 Bytes JMP 1002C920 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe[4660] WS2_32.dll!WSASocketA 76FBB7FC 5 Bytes JMP 1002C940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ntdll.dll!KiUserExceptionDispatcher 76EB6298 5 Bytes JMP 1002C750 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] SHELL32.dll!ShellExecuteW 75B24250 5 Bytes JMP 1002C9E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] SHELL32.dll!ShellExecuteExW 75B31BCC 5 Bytes JMP 1002C9A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] SHELL32.dll!ShellExecuteEx 75D59B12 5 Bytes JMP 1002C9C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] SHELL32.dll!ShellExecuteA 75D59BAD 5 Bytes JMP 1002CA00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Users\Andrew\AppData\Local\Google\Chrome\Application\chrome.exe[5768] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ntdll.dll!NtAllocateVirtualMemory 76EB4580 5 Bytes JMP 1002CE00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ntdll.dll!NtClose 76EB4770 5 Bytes JMP 1001CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ntdll.dll!NtCreateFile 76EB4870 5 Bytes JMP 1002CDC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ntdll.dll!NtCreateProcess 76EB4940 5 Bytes JMP 1002CE80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ntdll.dll!NtCreateProcessEx 76EB4950 5 Bytes JMP 1002CE60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ntdll.dll!NtDeleteFile 76EB4AB0 5 Bytes JMP 1002CE20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ntdll.dll!NtFreeVirtualMemory 76EB4C80 5 Bytes JMP 1002C490 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ntdll.dll!NtLoadDriver 76EB4E00 5 Bytes JMP 1002CDE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ntdll.dll!NtOpenFile 76EB4F80 5 Bytes JMP 1002CDA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ntdll.dll!NtProtectVirtualMemory 76EB51C0 5 Bytes JMP 1002C440 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ntdll.dll!NtSetInformationProcess 76EB5920 5 Bytes JMP 1002CD60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ntdll.dll!NtUnloadDriver 76EB5C00 1 Byte [E9] .text C:\Windows\servicing\TrustedInstaller.exe[5944] ntdll.dll!NtUnloadDriver 76EB5C00 5 Bytes JMP 1002CD80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ntdll.dll!NtWriteVirtualMemory 76EB5D40 5 Bytes JMP 1002CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ntdll.dll!RtlAllocateHeap 76EC20B5 5 Bytes JMP 1002C4E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ntdll.dll!LdrUnloadDll 76ECBEAF 7 Bytes JMP 1001CE40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ntdll.dll!LdrGetProcedureAddress 76ECEE57 5 Bytes JMP 1002CD40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ntdll.dll!LdrLoadDll 76ECF5B5 5 Bytes JMP 1002A630 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!CreateProcessW 76B3202D 5 Bytes JMP 10027790 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!CreateProcessA 76B32062 5 Bytes JMP 10028320 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!OpenFile 76B6410F 5 Bytes JMP 1002CCA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!CreateProcessAsUserW 76B679B4 5 Bytes JMP 100262C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!CopyFileW 76B68C8F 5 Bytes JMP 1002CC20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!MoveFileW 76B6A173 5 Bytes JMP 1002CBA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!CopyFileExW 76B707BB 7 Bytes JMP 1002CBE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!VirtualProtect 76B750AB 5 Bytes JMP 1002CA20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!DeleteFileW 76B7656B 5 Bytes JMP 1002CAE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!DeleteFileA 76B78BB6 5 Bytes JMP 1002CB00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!LoadLibraryExW 76B7B6BF 5 Bytes JMP 1002CCC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!LoadLibraryExA 76B7BC8B 5 Bytes JMP 1002CCE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!MoveFileWithProgressW 76B7BF04 5 Bytes JMP 1002CB20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!MoveFileExW 76B7BF28 5 Bytes JMP 1002CB60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!CreateFileW 76B80B7D 5 Bytes JMP 1002CC60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!GetProcAddress 76B81857 5 Bytes JMP 1002CD20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!GetModuleHandleW 76B819C1 5 Bytes JMP 1002CAA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!LoadLibraryA 76B82884 5 Bytes JMP 1002CA80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!LoadLibraryW 76B828D2 5 Bytes JMP 1002CA60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!GetModuleHandleA 76B828F7 5 Bytes JMP 1002CAC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!CreateFileA 76B8291C 5 Bytes JMP 1002CC80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!MoveFileExA 76B93013 5 Bytes JMP 1002CB80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!MoveFileWithProgressA 76B93033 5 Bytes JMP 1002CB40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!CopyFileA 76B97D1C 5 Bytes JMP 1002CC40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!MoveFileA 76BBAD89 5 Bytes JMP 1002CBC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!CopyFileExA 76BBBBE1 5 Bytes JMP 1002CC00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!WinExec 76BBE76D 5 Bytes JMP 1002CA40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] kernel32.dll!LoadModule 76BBEC86 5 Bytes JMP 1002CD00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ADVAPI32.dll!CreateProcessAsUserA 757114FD 5 Bytes JMP 10026BF0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ole32.dll!CoGetClassObject 759EA394 5 Bytes JMP 1002E600 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] ole32.dll!CoCreateInstanceEx 75A0594F 5 Bytes JMP 1002E840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) .text C:\Windows\servicing\TrustedInstaller.exe[5944] USER32.dll!EndTask 7592FD8E 5 Bytes JMP 1002E3C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO) —- Devices - GMER 1.0.15 —- Device \Driver\ACPI_HAL \Device\00000045 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) AttachedDevice \Driver\tdx \Device\Tcp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO) AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume6 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume6 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation) AttachedDevice \Driver\tdx \Device\Udp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO) AttachedDevice \Driver\tdx \Device\RawIp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO) AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) —- Registry - GMER 1.0.15 —- Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsDriver@printBinNames ? Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsDriver@printMaxXExtent 11176 Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsDriver@printMaxYExtent 11176 Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsDriver@printMinXExtent 254 Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsDriver@printMinYExtent 508 Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsDriver@printMediaSupported Letter?Letter Small?Tabloid?Ledger?Legal?Statement?Executive?A3?A4?A4 Small?A5?B4 (JIS)?B5 (JIS)?Folio?Quarto?10x14?11x17?Note?Envelope #9?Envelope #10?Envelope #11?Envelope #12?Envelope #14?C size sheet?D size sheet?E size sheet?Envelope DL?Envelope C5?Envelope C3?Envelope C4?Envelope C6?Envelope C65?Envelope B4?Envelope B5?Envelope B6?Envelope?Envelope Monarch?6 3/4 Envelope?US Std Fanfold?German Std Fanfold?German Legal Fanfold?B4 (ISO)?Japanese Postcard?9x11?10x11?15x11?Envelope Invite?Reserved48?Reserved49?Letter Extra?Legal Extra?Tabloid Extra?A4 Extra?Letter Transverse?A4 Transverse?Letter Extra Transverse?Super A?Super B?Letter Plus?A4 Plus?A5 Transverse?B5 (JIS) Transverse?A3 Extra?A5 Extra?B5 (ISO) Extra?A2?A3 Transverse?A3 Extra Transverse?Japanese Double Postcard?A6?Japanese Envelope Kaku #2?Japanese Envelope Kaku #3?Japanese Envelope Chou #3?Japanese Envelope Chou #4?Letter Rotated?A3 Rotated?A4 Rotated?A5 Rotated?B4 (JIS) Rotated?B5 (JIS) Rotated?Japanese Postcard Rotated?Double Japan Postcard Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsDriver@printMediaReady ? Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsDriver@printOrientationsSupported PORTRAIT?LANDSCAPE? Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsDriver@printMaxResolutionSupported 204 Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsDriver@printLanguage ? Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsDriver@printRateUnit Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsDriver@driverVersion 1025 Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsSpooler@driverName COMM DELUXE FAX Printer Driver Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsSpooler@portName DELUXEFAXMODEM? Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsSpooler@printStartTime 0 Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsSpooler@printEndTime 0 Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsSpooler@printerName COMMUNICATE! DELUXE Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsSpooler@printSpooling PrintWhileSpooling Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsSpooler@priority 1 Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsSpooler@uNCName \\Andrew-PC\COMMUNICATE! DELUXE Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsSpooler@serverName Andrew-PC Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsSpooler@shortServerName ANDREW-PC Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsSpooler@versionNumber 4 Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\COMMUNICATE! DELUXE\DsSpooler@flags 0 —- Files - GMER 1.0.15 —- File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Temp 0 bytes File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Temp\baseupd 0 bytes —- EOF - GMER 1.0.15 —- Mbam.txt Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 6465 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 28/04/2011 17:49:57 mbam-log-2011-04-28 (17-49-57).txt Scan type: Quick scan Objects scanned: 154449 Time elapsed: 4 minute(s), 55 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #11
Hi Andy

Before cleaning up the tools we've used, I'd like one more check.

Run ESET Online Scan

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan 1. Click the Eset online Scanner button.
2. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
• Double click on the Eset installer icon on your desktop.

3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Accept any security warnings from your browser.
6. Check Scan archives
7. Push the Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push List of found threats
10. Push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - when ESET doesn't find any threats, no report will be created.
11. Push the back button.
12. Push Finish
If a log has been produced post it in your next reply.

Satchfan
Post #12
Hello andyjw1 It has been several days since I sent my last post with instructions to help with your computer problem.. Please let me know if you are having problems and still need help. Thanks Satchfan
Post #13
Hi I tried replying and had proplems with the forum, then i was away for a couple of days. Here is the ESET log C:\Users\Andrew\Downloads\avi2video_install (1).exe Win32/Adware.MarketScore.A application deleted - quarantined C:\Users\Andrew\Downloads\avi2video_install.exe Win32/Adware.MarketScore.A application deleted - quarantined C:\Users\Andrew\Downloads\Sony Vegas Movie Studio Platinum 9 + All Plugins\Setup.exe a variant of Win32/Injector.DAT trojan deleted - quarantined C:\Windows\System32\addvpack.dll a variant of Win32/Agent.RNM trojan cleaned by deleting - quarantined C:\Windows\System32\cofirre.exe a variant of Win32/Agent.RNM trojan cleaned by deleting - quarantined C:\Windows\System32\ftssrch.dll a variant of Win32/Agent.RNM trojan cleaned by deleting - quarantined C:\Windows\System32\msls331.dll a variant of Win32/Agent.RNM trojan cleaned by deleting - quarantined
Post #14
II Andy

I tried replying and had proplems with the forum

Sorry for the inconvenience, it was having some routine maintenance done foe a short time.

It seems that Eset took care of the remnants.

We need to tidy up by removing the tools that have been used.

===================================================

Uninstall OTL
• Double-click OTL.exe
• Click the CleanUp! button.
• Select Yes when the Begin cleanup Process? prompt appears.
• If you are prompted to reboot during the cleanup, select Yes.
• The tool will delete itself once it finishes, if not delete it by yourself.
NOTE: If you receive a warning from your firewall or other security programs regarding OTL attempting to contact the internet, please allow it to do so.

===================================================

Create a Restore Point

• click Start, right-click Computer, and then Properties.
• in the left pane, click System protection. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
• click the System Protection tab, and then click Create.
• in the System Protection dialog box, type a description, and then click Create.
Remove old restore points• click Start button and in the search box, type Disk Cleanup, and then, in the list of results, click Disk Cleanup.
• if prompted, select the drive that you want to clean up, and then click OK.
• in the Disk Cleanup for (drive letter) dialog box, click Clean up system files. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
• if prompted, select the drive that you want to clean up, and then click OK.
• click the More Options tab, under System Restore and Shadow Copies, click Clean up.
• in the Disk Cleanup dialog box, click Delete.
• click Delete Files, and then click OK.
===================================================

Update and run Malwarebytes. This really is an excellent program that you should update and run on a regular basis, probably weekly.

===================================================

I also recommend that you read the following:

How to prevent malware by miekiemoes

Safe computing

Satchfan
Post #15 last edited
Andy Could you reply once more to reassure me that all is now well and we can close this topic If I hear nothing within 48 hours, the topic will be closed Thanks SF

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI