Search not working in windows explorer

Anya Topic Starter

Post #1May 10, 2011, 9:31 AM UTC

Search in Windows explorer is not working (I cannot find files I know exist).

Hijack this gave this log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:57:54 PM, on 5/9/2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Labtec\WebCam10\WebCam10.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Wave Systems Corp\Common\DataServer.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
C:\WINDOWS\system32\am_tlmd.exe
c:\program files\common files\installshield\updateservice\isuspm.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Documents and Settings\Anja Randjelovic\Desktop\HiJackThis.exe
C:\WINDOWS\system32\HPBPRO.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.grf.bg.ac.rs:8080
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=042310 serial=DR12WNG-0249275-TMV lang=EN
O4 - HKLM\..\Run: [StatusClient 2.6] C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Labtec\WebCam10\WebCam10.exe" /hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10n_Plugin.exe -update plugin
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O4 - Global Startup: NetHASP License Manager.lnk = C:\Program Files\Aladdin\NetHASP LM\NHSRVW32.EXE
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~3\Office14\ONBttnIE.dll/105
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1265292694468
O16 - DPF: {76326493-E84F-4D4B-939C-1E07B50037F2} (ProxyModule Class) - https://online.bancaintesabeograd.com/RetailDLL/SGCMSCCD.DLL
O16 - DPF: {A7C346A3-B076-46B3-97F0-D00F6B479451} (FileInterface Class) - https://online.bancaintesabeograd.com/RetailDLL/FSINT.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVSrvLauncher - Labtec Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: NTRU Hybrid TSS v2.0.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe
O23 - Service: Tecplot license manager (TecplotLM) - Unknown owner - C:\WINDOWS\system32\am_tlmd.exe

–
End of file - 11340 bytes

Satchfan

Post #2May 12, 2011, 10:57 AM UTC

Hello Anya and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:
• Please follow all instructions in the order posted
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• If you don't understand something, please don't hesitate to ask for clarification before proceeding
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

I am looking at your log now and will reply with instructions shortly

Satchfan

Satchfan

Post #3May 12, 2011, 11:14 AM UTC

Hello again anya

P2P - I see you have P2P software, (uTorrent, ), installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infection. If your computer is infected, it almost certainly contributed to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are more often than not, infected. The bad guys use P2P file-sharing as a major conduit to spread their wares.

Please see this topic for more information:

Perils of P2P File Sharing.

I would strongly recommend that you uninstall it now. You can do so via Control Panel, Programs, and then Programs and Features.

Should you decide to keep it, please don’t use it until we have finished up here.

===================================================

Run HijackThis

Open HijackThis and click Do a system scan only.

Place a check mark next to:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.grf.bg.ac.rs:8080

Close all windows except for HijackThis and click Fix checked.

===================================================

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.

The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.

===================================================

Download and run OTL

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.
===================================================

Download the GMER Rootkit Scanner

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it

In the right panel, you will see several boxes that have been checked. Uncheck the following …
IAT/EAT
All drives/partitions except C:\)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.

Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Logs to include with next post:

OTL.txt
Extras.txt
Gmer.txt

Thanks

Satchfan

Anya

Post #4May 12, 2011, 11:50 AM UTC

Hello Satchfan!

Thank you very much for your response!!

Here is the OTL.TXT

OTL logfile created on: 5/12/2011 1:36:03 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Anja Randjelovic\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 533.00 Mb Available Physical Memory | 52.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 40.00 Gb Total Space | 9.26 Gb Free Space | 23.15% Space Free | Partition Type: NTFS
Drive D: | 108.96 Gb Total Space | 61.36 Gb Free Space | 56.31% Space Free | Partition Type: NTFS

Computer Name: ANJA-DESKTOP | User Name: Anja Randjelovic | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe ()
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
PRC - C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
PRC - C:\Program Files\Adobe\Acrobat 7.0\Distillr\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
PRC - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
PRC - C:\Program Files\Labtec\WebCam10\WebCam10.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe (Labtec Inc.)
PRC - C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe (Labtec Inc,)
PRC - C:\Program Files\Google\Google Talk\googletalk.exe (Google)
PRC - C:\WINDOWS\ATKKBService.exe (ASUSTeK COMPUTER INC.)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.)
PRC - C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe (Wave Systems Corp.)
PRC - C:\Program Files\Wave Systems Corp\Common\DataServer.exe (Wave Systems Corp.)
PRC - C:\Program Files\Dell Support\DSAgnt.exe (Gteko Ltd.)
PRC - C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe (Wave Systems Corp.)
PRC - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe ()
PRC - C:\WINDOWS\system32\am_tlmd.exe ()
PRC - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (Rocket Division Software)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe (Hewlett-Packard)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Alwil Software\Avast5\snxhk.dll (AVAST Software)
MOD - C:\WINDOWS\system32\wxvault.dll ()
MOD - C:\WINDOWS\system32\detoured.dll ()
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (Autodesk Licensing Service) – C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe (Autodesk)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (PSI_SVC_2) – c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
SRV - (LVSrvLauncher) – C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe (Labtec Inc.)
SRV - (ATKKeyboardService) – C:\WINDOWS\ATKKBService.exe (ASUSTeK COMPUTER INC.)
SRV - (DataSvr2) – C:\Program Files\Wave Systems Corp\Common\DataServer.exe (Wave Systems Corp.)
SRV - (tcsd_win32.exe) – C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe ()
SRV - (TecplotLM) – C:\WINDOWS\system32\am_tlmd.exe ()
SRV - (StarWindService) – C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (Rocket Division Software)

========== Driver Services (SafeList) ==========

DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (hardlock) – C:\WINDOWS\system32\drivers\hardlock.sys (Aladdin Knowledge Systems)
DRV - (Haspnt) – C:\WINDOWS\system32\drivers\Haspnt.sys (Aladdin Knowledge Systems)
DRV - (ISODrive) – C:\Program Files\UltraISO\drivers\ISODrive.sys (EZB Systems, Inc.)
DRV - (mcdbus) – C:\WINDOWS\system32\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (LVUSBSta) – C:\WINDOWS\system32\drivers\LVUSBSta.sys (Labtec Inc.)
DRV - (LVMVDrv) – C:\WINDOWS\system32\drivers\LVMVdrv.sys (Labtec Inc.)
DRV - (LVcKap) – C:\WINDOWS\system32\drivers\Lvckap.sys ()
DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) – C:\WINDOWS\system32\drivers\LV302V32.SYS (Labtec Inc.)
DRV - (pepifilter) – C:\WINDOWS\system32\drivers\lv302af.sys (Labtec Inc.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (asuskbnt) – C:\WINDOWS\system32\drivers\atkkbnt.sys (ASUSTeK COMPUTER INC.)
DRV - (EIO) – C:\WINDOWS\system32\drivers\EIO.sys (ASUSTeK Computer Inc.)
DRV - (Video3D) – C:\WINDOWS\system32\drivers\Video3D32.sys (ASUSTeK COMPUTER INC.)
DRV - (WinDriver) – C:\WINDOWS\system32\drivers\windrvr.sys (Jungo)
DRV - (SenFiltService) – C:\WINDOWS\system32\drivers\senfilt.sys (Sensaura)
DRV - (DSproct) – C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys (GTek Technologies Ltd.)
DRV - (PBADRV) – C:\WINDOWS\system32\drivers\pbadrv.sys (Dell Inc)
DRV - (atidgllk) – C:\WINDOWS\atidgllk.sys (Overclocking Tool)
DRV - (vax347b) – C:\WINDOWS\system32\DRIVERS\vax347b.sys ( )
DRV - (Sentinel) – C:\WINDOWS\System32\Drivers\SENTINEL.SYS ()
DRV - (vax347s) – C:\WINDOWS\System32\Drivers\vax347s.sys ( )

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.90
FF - prefs.js..network.proxy.backup.ftp: "proxy.grf.bg.ac.rs"
FF - prefs.js..network.proxy.backup.ftp_port: 8080
FF - prefs.js..network.proxy.backup.gopher: "proxy.grf.bg.ac.rs"
FF - prefs.js..network.proxy.backup.gopher_port: 8080
FF - prefs.js..network.proxy.backup.socks: "proxy.grf.bg.ac.rs"
FF - prefs.js..network.proxy.backup.socks_port: 8080
FF - prefs.js..network.proxy.backup.ssl: "proxy.grf.bg.ac.rs"
FF - prefs.js..network.proxy.backup.ssl_port: 8080
FF - prefs.js..network.proxy.ftp: "proxy.rcub.bg.ac.rs"
FF - prefs.js..network.proxy.ftp_port: 8080
FF - prefs.js..network.proxy.gopher: "proxy.rcub.bg.ac.rs"
FF - prefs.js..network.proxy.gopher_port: 8080
FF - prefs.js..network.proxy.http: "proxy.rcub.bg.ac.rs"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "proxy.rcub.bg.ac.rs"
FF - prefs.js..network.proxy.socks_port: 8080
FF - prefs.js..network.proxy.ssl: "proxy.rcub.bg.ac.rs"
FF - prefs.js..network.proxy.ssl_port: 8080
FF - prefs.js..network.proxy.type: 1

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/29 10:21:08 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/29 10:21:08 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.3\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010/09/08 11:55:27 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.3\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/09/08 11:55:31 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Anja Randjelovic\Application Data\Mozilla\Extensions
[2010/09/08 11:55:31 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Anja Randjelovic\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011/05/12 11:33:28 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Anja Randjelovic\Application Data\Mozilla\Firefox\Profiles\gm6666fl.default\extensions
[2011/04/11 10:02:19 | 000,000,000 | —D | M] (BitDefender QuickScan) – C:\Documents and Settings\Anja Randjelovic\Application Data\Mozilla\Firefox\Profiles\gm6666fl.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2011/02/08 13:58:06 | 000,000,000 | —D | M] (EBrary Reader Plugin) – C:\Documents and Settings\Anja Randjelovic\Application Data\Mozilla\Firefox\Profiles\gm6666fl.default\extensions\[removed]
[2011/05/12 11:33:28 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/02/17 11:12:25 | 000,000,000 | —D | M] (Skype extension) – C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/06/28 14:52:49 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/11/09 10:35:19 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/06/28 14:52:34 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010/09/15 05:50:38 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/01/14 00:46:00 | 000,063,488 | —- | M] (Nullsoft, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npwachk.dll

O1 HOSTS File: ([2004/08/04 12:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 7.0] C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe ()
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [CorelDRAW Graphics Suite 11b] File not found
O4 - HKLM..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe (Google)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe (Labtec Inc,)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Labtec\WebCam10\WebCam10.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [StatusClient 2.6] C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe (Hewlett-Packard)
O4 - HKLM..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe (Hewlett-Packard)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] File not found
O4 - HKCU..\Run: [DellSupport] C:\Program Files\Dell Support\DSAgnt.exe (Gteko Ltd.)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk = C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe ()
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe (Autodesk, Inc)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe (Wave Systems Corp.)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\NetHASP License Manager.lnk = C:\Program Files\Aladdin\NetHASP LM\NHSRVW32.EXE (Aladdin Knowledge Systems.)
O4 - Startup: C:\Documents and Settings\Anja Randjelovic\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1265292694468 (WUWebControl Class)
O16 - DPF: {76326493-E84F-4D4B-939C-1E07B50037F2} https://online.bancaintesabeograd.com/RetailDLL/SGCMSCCD.DLL (ProxyModule Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {A7C346A3-B076-46B3-97F0-D00F6B479451} https://online.bancaintesabeograd.com/RetailDLL/FSINT.dll (FileInterface Class)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (wxvault.dll) - C:\WINDOWS\System32\wxvault.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O30 - LSA: Authentication Packages - (wvauth) - C:\WINDOWS\System32\wvauth.dll (Wave Systems Corp.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/02/02 14:42:06 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{0fea642c-4c72-11df-b387-001aa0b17a07}\Shell\AutoRun\command - "" = F:\GORDANA///lakitj.exe
O33 - MountPoints2\{0fea642c-4c72-11df-b387-001aa0b17a07}\Shell\open\command - "" = F:\GORDANA///lakitj.exe
O33 - MountPoints2\{684476ff-feba-11df-b425-001aa0b17a07}\Shell\AutoRun\command - "" = H:\avira.exe
O33 - MountPoints2\{68447705-feba-11df-b425-001aa0b17a07}\Shell\AutoRun\command - "" = I:\urDrive.exe
O33 - MountPoints2\{7488d178-2c3d-11df-b36e-001aa0b17a07}\Shell\AutoRun\command - "" = RECYCLING\autorun.exe
O33 - MountPoints2\{7488d178-2c3d-11df-b36e-001aa0b17a07}\Shell\open\command - "" = RECYCLING\autorun.exe
O33 - MountPoints2\{dd120fd8-2ddd-11df-b370-001aa0b17a07}\Shell\AutoRun\command - "" = GORDANA///lakitj.exe
O33 - MountPoints2\{dd120fd8-2ddd-11df-b370-001aa0b17a07}\Shell\open\command - "" = GORDANA///lakitj.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: SENTINEL - C:\WINDOWS\System32\SNTI386.DLL ()
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Labtec Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (56308606093492224)

========== Files/Folders - Created Within 30 Days ==========

[2011/05/12 13:34:36 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe
[2011/05/12 13:27:51 | 000,000,000 | —D | C] – C:\Documents and Settings\Anja Randjelovic\Desktop\backups
[2011/05/12 09:59:43 | 000,000,000 | —D | C] – C:\Documents and Settings\Anja Randjelovic\Desktop\Visual Studio 2008
[2011/05/09 15:13:32 | 000,000,000 | —D | C] – C:\Documents and Settings\Anja Randjelovic\Desktop\HidroloskiGodisnjaci
[2011/05/09 15:13:21 | 000,000,000 | —D | C] – C:\Documents and Settings\Anja Randjelovic\Desktop\MeteoroloskiGodisnjaci
[2011/05/09 14:57:33 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Anja Randjelovic\Desktop\HiJackThis.exe
[2011/04/27 09:48:09 | 000,000,000 | —D | C] – C:\Documents and Settings\Anja Randjelovic\Desktop\Za reizbor
[2011/04/26 15:22:37 | 000,000,000 | —D | C] – C:\Program Files\Interactive Groundwater 3.5.8.2
[2011/04/19 12:52:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Anja Randjelovic\Desktop\Rad-jahorina
[2011/01/13 12:52:55 | 000,159,616 | —- | C] ( ) – C:\WINDOWS\System32\drivers\vax347b.sys
[2011/01/13 12:52:55 | 000,005,248 | —- | C] ( ) – C:\WINDOWS\System32\drivers\vax347s.sys
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/12 13:34:58 | 000,000,401 | —- | M] () – C:\WINDOWS\hpbafd.ini
[2011/05/12 13:34:37 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe
[2011/05/12 13:34:00 | 000,000,906 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/05/12 13:34:00 | 000,000,902 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/05/12 13:31:25 | 000,002,335 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
[2011/05/12 13:31:17 | 000,013,738 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/05/12 13:31:12 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/05/12 13:29:47 | 000,000,228 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\defogger_reenable
[2011/05/12 13:28:58 | 000,050,477 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Defogger.exe
[2011/05/10 11:44:45 | 006,432,919 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\fao56.pdf
[2011/05/10 11:31:43 | 000,002,500 | —- | M] () – C:\WINDOWS\wincmd.ini
[2011/05/10 11:20:32 | 000,967,373 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\20.pdf
[2011/05/09 15:34:13 | 000,031,744 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/09 15:25:37 | 000,006,961 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\proba.csv
[2011/05/09 14:57:34 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Anja Randjelovic\Desktop\HiJackThis.exe
[2011/05/04 13:15:07 | 000,156,493 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 11 cas-otpad uvod-2010.pdf
[2011/05/04 13:15:04 | 000,175,602 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 10 i 11 cas 2010.pdf
[2011/04/27 11:27:44 | 005,006,007 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\OEI 10 predavanje Buka.pdf
[2011/04/27 10:42:43 | 000,114,769 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 10 cas Buka.pdf
[2011/04/27 10:42:40 | 000,125,518 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 8 cas Energija.pdf
[2011/04/26 15:36:05 | 000,474,877 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Novo7.igw
[2011/04/26 15:25:21 | 001,254,214 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\zhbackground.bmp
[2011/04/26 15:22:08 | 010,565,931 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\igw3.5.8.nomovie.zip
[2011/04/21 11:49:44 | 002,719,329 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\OrtoFoto-podloga.jpg
[2011/04/19 14:49:45 | 000,168,660 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 9 cas.pdf
[2011/04/19 12:46:09 | 000,133,033 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\2.pdf
[2011/04/19 12:41:52 | 000,107,438 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\OEI 2011.pdf
[2011/04/14 13:23:55 | 001,827,455 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\OEI4_Povrsinske vode_NJ.pdf
[2011/04/12 15:03:22 | 004,439,238 | R— | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\408.pdf
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/12 13:29:39 | 000,000,228 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\defogger_reenable
[2011/05/12 13:28:58 | 000,050,477 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Defogger.exe
[2011/05/10 11:40:22 | 006,432,919 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\fao56.pdf
[2011/05/10 11:20:32 | 000,967,373 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\20.pdf
[2011/05/09 15:25:36 | 000,006,961 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\proba.csv
[2011/05/04 13:15:07 | 000,156,493 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 11 cas-otpad uvod-2010.pdf
[2011/05/04 13:15:03 | 000,175,602 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 10 i 11 cas 2010.pdf
[2011/04/27 11:27:42 | 005,006,007 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\OEI 10 predavanje Buka.pdf
[2011/04/27 10:42:43 | 000,114,769 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 10 cas Buka.pdf
[2011/04/27 10:42:39 | 000,125,518 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 8 cas Energija.pdf
[2011/04/26 15:25:21 | 001,254,214 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\zhbackground.bmp
[2011/04/26 15:20:31 | 010,565,931 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\igw3.5.8.nomovie.zip
[2011/04/26 15:18:58 | 002,719,329 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\OrtoFoto-podloga.jpg
[2011/04/26 15:18:58 | 000,474,877 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Novo7.igw
[2011/04/19 14:49:44 | 000,168,660 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 9 cas.pdf
[2011/04/19 12:46:09 | 000,133,033 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\2.pdf
[2011/04/19 12:41:52 | 000,107,438 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\OEI 2011.pdf
[2011/04/14 13:23:54 | 001,827,455 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\OEI4_Povrsinske vode_NJ.pdf
[2011/04/12 15:05:38 | 004,439,238 | R— | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\408.pdf
[2011/03/03 16:17:56 | 000,150,919 | —- | C] () – C:\WINDOWS\hpwins11.dat
[2011/03/03 16:17:56 | 000,000,522 | —- | C] () – C:\WINDOWS\hpwmdl11.dat
[2010/11/02 10:31:56 | 004,153,404 | —- | C] () – C:\WINDOWS\System32\stoat32.dll
[2010/11/02 10:31:56 | 000,024,642 | —- | C] () – C:\WINDOWS\System32\stoat_user.dll
[2010/11/01 17:00:59 | 000,108,032 | R— | C] () – C:\WINDOWS\System32\wdrvr.dll
[2010/11/01 17:00:59 | 000,024,630 | —- | C] () – C:\WINDOWS\System32\niva.dll
[2010/09/24 10:18:39 | 000,051,370 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2010/05/11 13:02:12 | 000,000,383 | —- | C] () – C:\WINDOWS\System32\haspdos.sys
[2010/04/09 12:42:52 | 000,000,152 | —- | C] () – C:\WINDOWS\wcx_ftp.ini
[2010/04/08 12:55:33 | 000,000,056 | RHS- | C] () – C:\WINDOWS\System32\5F166C4BE3.sys
[2010/04/08 12:55:08 | 000,003,350 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2010/03/31 13:38:23 | 000,000,207 | —- | C] () – C:\WINDOWS\TecplotL.ini
[2010/03/05 11:17:57 | 000,064,512 | —- | C] () – C:\WINDOWS\System32\drivers\SENTINEL.SYS
[2010/03/05 11:17:57 | 000,038,400 | —- | C] () – C:\WINDOWS\System32\SNTI386.DLL
[2010/03/05 11:17:57 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\RNBOVDD.DLL
[2010/02/22 11:36:29 | 000,031,744 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/11 13:00:16 | 000,000,169 | —- | C] () – C:\WINDOWS\ODBC.INI
[2010/02/10 16:43:33 | 000,000,394 | —- | C] () – C:\WINDOWS\capture.ini
[2010/02/10 16:42:15 | 000,000,088 | RHS- | C] () – C:\Documents and Settings\All Users.WINDOWS\Application Data\E34B6C165F.sys
[2010/02/10 16:42:14 | 000,002,516 | -HS- | C] () – C:\Documents and Settings\All Users.WINDOWS\Application Data\KGyGaAvL.sys
[2010/02/08 12:12:11 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2010/02/05 16:14:15 | 000,002,500 | —- | C] () – C:\WINDOWS\wincmd.ini
[2010/02/05 15:55:32 | 000,000,401 | —- | C] () – C:\WINDOWS\hpbafd.ini
[2010/02/05 15:52:59 | 000,074,752 | —- | C] () – C:\WINDOWS\System32\jst.dll
[2010/02/05 15:52:59 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\PMLJNI.dll
[2010/02/05 15:52:02 | 000,003,399 | —- | C] () – C:\WINDOWS\System32\hptcpmon.ini
[2010/02/05 15:52:02 | 000,000,267 | —- | C] () – C:\WINDOWS\System32\AddPort.ini
[2010/02/05 15:50:16 | 000,000,103 | —- | C] () – C:\WINDOWS\System32\hptrace.ini
[2010/02/05 15:49:56 | 000,023,191 | —- | C] () – C:\WINDOWS\hpclj5550.ini
[2010/02/05 15:12:44 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/02/05 13:00:48 | 000,013,312 | —- | C] () – C:\WINDOWS\System32\BASSMOD.dll
[2010/02/04 16:13:08 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2010/02/04 15:49:32 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2010/02/04 15:48:34 | 000,383,224 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/02/04 15:33:49 | 000,143,360 | —- | C] () – C:\WINDOWS\System32\bioapi_mds300.dll
[2010/02/04 15:33:49 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\bioapi100.dll
[2010/02/04 15:33:28 | 000,000,139 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Local Settings\Application Data\fusioncache.dat
[2010/02/04 15:08:17 | 000,639,046 | —- | C] () – C:\WINDOWS\aticlocklib.dll
[2010/02/04 15:08:17 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\drivers\nVivid.bin
[2010/02/04 15:08:17 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\drivers\nStandard.bin
[2010/02/04 15:08:17 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\drivers\nAsmedia.bin
[2010/02/04 15:08:17 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\drivers\nAdvanced.bin
[2010/02/04 15:08:17 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\drivers\aVivid.bin
[2010/02/04 15:08:17 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\drivers\aStandard.bin
[2010/02/04 15:08:17 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\drivers\aAsmedia.bin
[2010/02/04 15:08:17 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\drivers\aAdvanced.bin
[2010/02/04 15:08:17 | 000,110,592 | —- | C] () – C:\WINDOWS\R5ClkLib.dll
[2010/02/04 15:08:17 | 000,046,080 | —- | C] () – C:\WINDOWS\System32\aseng.dll
[2010/02/04 15:08:17 | 000,020,480 | —- | C] () – C:\WINDOWS\HyperDrive.exe
[2010/02/04 15:08:17 | 000,011,136 | —- | C] () – C:\WINDOWS\System32\ATKOSDMini.DLL
[2010/02/04 15:08:17 | 000,000,018 | —- | C] () – C:\WINDOWS\System32\atkid.ini
[2010/02/04 15:03:38 | 003,107,788 | R— | C] () – C:\WINDOWS\System32\ativvaxx.dat
[2010/02/04 15:03:37 | 000,138,101 | R— | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2010/02/04 14:59:12 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2010/02/04 14:54:39 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2008/10/22 04:25:32 | 000,094,274 | —- | C] () – C:\WINDOWS\System32\HPBHEALR.DLL
[2007/03/06 17:50:30 | 001,669,664 | —- | C] () – C:\WINDOWS\System32\drivers\Lvckap.sys
[2006/09/12 13:07:36 | 000,184,320 | —- | C] () – C:\WINDOWS\System32\AmRes_en.dll
[2006/09/12 13:01:48 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\AmRes_es.dll
[2006/09/12 13:01:42 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\AmRes_ko.dll
[2006/09/12 13:01:34 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\AmRes_de.dll
[2006/09/12 13:01:28 | 000,184,320 | —- | C] () – C:\WINDOWS\System32\AmRes_pt-BR.dll
[2006/09/12 13:01:20 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\AmRes_fr.dll
[2006/09/12 13:01:12 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\AmRes_ja.dll
[2006/09/12 13:01:06 | 000,208,896 | —- | C] () – C:\WINDOWS\System32\AmRes_ru.dll
[2006/09/12 13:00:58 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\AmRes_it.dll
[2006/09/12 13:00:52 | 000,176,128 | —- | C] () – C:\WINDOWS\System32\AmRes_zh-CHS.dll
[2006/09/12 13:00:44 | 000,172,032 | —- | C] () – C:\WINDOWS\System32\AmRes_zh-CHT.dll
[2006/09/08 09:32:02 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\wxvault.dll
[2006/09/08 09:30:44 | 000,004,096 | —- | C] () – C:\WINDOWS\System32\detoured.dll
[2006/09/05 11:05:32 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\Internationalization_en.dll
[2006/09/05 10:26:06 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\Internationalization_pt.dll
[2006/09/05 10:25:54 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\Internationalization_zh-CHT.dll
[2006/09/05 10:25:42 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\Internationalization_ko.dll
[2006/09/05 10:25:32 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\Internationalization_es.dll
[2006/09/05 10:25:20 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\Internationalization_ru.dll
[2006/09/05 10:25:10 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\Internationalization_ja.dll
[2006/09/05 10:24:58 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_it.dll
[2006/09/05 10:24:48 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_de.dll
[2006/09/05 10:24:36 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_fr.dll
[2006/09/05 10:24:26 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\Internationalization_zh-CHS.dll
[2006/06/12 11:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_RUS.dll
[2006/06/12 11:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_ITA.dll
[2006/06/12 11:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_FRA.dll
[2006/06/12 11:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_ESN.dll
[2006/06/12 11:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_ENU.dll
[2006/06/12 11:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_DEU.dll
[2006/06/12 11:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_CHS.dll
[2006/06/12 11:01:16 | 000,348,160 | —- | C] () – C:\WINDOWS\System32\Tsp.dll
[2006/03/02 18:13:36 | 000,143,872 | —- | C] () – C:\WINDOWS\System32\am_tlmd.exe
[2005/12/01 15:41:20 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\pbadrvdll.dll
[2005/09/20 14:36:06 | 000,798,720 | —- | C] () – C:\WINDOWS\System32\DemoLicense.dll
[2005/03/22 01:48:05 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2005/03/22 01:48:05 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 12:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 12:00:00 | 000,443,588 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 12:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 12:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 12:00:00 | 000,071,846 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 12:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 12:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 12:00:00 | 000,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys
[2004/08/04 12:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 12:00:00 | 000,001,788 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2004/08/04 12:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/07/21 16:03:14 | 000,917,504 | —- | C] () – C:\WINDOWS\System32\lmgr10.dll
[2004/07/20 15:27:52 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\ADsSecurity.dll
[2004/03/18 19:01:20 | 000,072,192 | —- | C] () – C:\WINDOWS\System32\xltZlib.dll
[2003/09/17 17:50:19 | 000,929,280 | —- | C] () – C:\WINDOWS\System32\vtkHybrid.dll
[2003/08/05 12:28:14 | 001,798,656 | —- | C] () – C:\WINDOWS\System32\vtkRendering.dll
[2003/08/05 12:28:10 | 001,998,848 | —- | C] () – C:\WINDOWS\System32\vtkIO.dll
[2003/08/05 12:28:06 | 002,162,688 | —- | C] () – C:\WINDOWS\System32\vtkGraphics.dll
[2003/08/05 12:28:02 | 002,234,368 | —- | C] () – C:\WINDOWS\System32\vtkImaging.dll
[2003/08/05 12:27:59 | 000,329,216 | —- | C] () – C:\WINDOWS\System32\vtkFiltering.dll
[2003/08/05 12:27:57 | 001,463,808 | —- | C] () – C:\WINDOWS\System32\vtkCommon.dll
[2003/08/05 12:27:54 | 000,096,768 | —- | C] () – C:\WINDOWS\System32\vtkjpeg.dll
[2003/08/05 12:27:52 | 000,103,936 | —- | C] () – C:\WINDOWS\System32\vtkpng.dll
[2003/08/05 12:27:51 | 000,046,592 | —- | C] () – C:\WINDOWS\System32\vtkzlib.dll
[2003/01/30 08:04:00 | 000,618,496 | —- | C] () – C:\WINDOWS\System32\stlpmt45.dll

========== LOP Check ==========

[2010/02/04 15:14:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Alwil Software
[2010/02/04 16:56:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Autodesk
[2010/08/06 13:55:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\DAEMON Tools Lite
[2010/02/04 15:33:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Wave Systems Corp
[2010/02/08 16:19:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Anja Randjelovic\Application Data\Autodesk
[2010/08/05 13:02:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Anja Randjelovic\Application Data\Azureus
[2010/02/10 16:42:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Anja Randjelovic\Application Data\Bitstream
[2010/08/06 14:02:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Anja Randjelovic\Application Data\DAEMON Tools Lite
[2011/02/17 14:18:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Anja Randjelovic\Application Data\Design Science
[2011/01/13 15:17:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Anja Randjelovic\Application Data\ImgBurn
[2011/03/17 12:02:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Anja Randjelovic\Application Data\QuickScan
[2010/09/08 11:55:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Anja Randjelovic\Application Data\Thunderbird
[2011/05/12 13:26:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Anja Randjelovic\Application Data\uTorrent

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/02/02 14:42:06 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010/02/04 14:53:14 | 000,000,232 | -HS- | M] () – C:\boot.ini
[2010/02/02 14:42:06 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/02/02 14:42:06 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/02/02 14:42:06 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2002/12/31 14:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2002/12/31 14:00:00 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/05/12 13:31:01 | 1610,612,736 | -HS- | M] () – C:\pagefile.sys
[2011/05/12 13:31:59 | 000,002,051 | —- | M] () – C:\statusclient.log

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2010/02/04 14:56:31 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/10/22 04:25:32 | 000,051,712 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\HPZPP034.DLL
[2007/06/27 13:04:44 | 000,274,944 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp5k2.dll
[2008/07/06 12:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/01/13 10:47:35 | 000,038,848 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2010/02/04 15:46:31 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2010/02/04 15:46:30 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2010/02/04 15:46:30 | 000,917,504 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2010/02/04 14:56:56 | 000,000,294 | -HS- | M] () – C:\Documents and Settings\All Users.WINDOWS\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/02/04 15:01:32 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\Anja Randjelovic\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2010/02/04 15:01:32 | 000,000,079 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/05/12 13:28:58 | 000,050,477 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Defogger.exe
[2011/05/09 14:57:34 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Anja Randjelovic\Desktop\HiJackThis.exe
[2011/05/12 13:34:37 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-11 12:05:38

========== Files - Unicode (All) ==========
[2011/04/26 16:52:11 | 000,022,651 | —- | M] ()(C:\Documents and Settings\Anja Randjelovic\Desktop\Izvestaj-????.docx) – C:\Documents and Settings\Anja Randjelovic\Desktop\Izvestaj-Анја.docx
[2011/03/21 14:20:40 | 000,022,651 | —- | C] ()(C:\Documents and Settings\Anja Randjelovic\Desktop\Izvestaj-????.docx) – C:\Documents and Settings\Anja Randjelovic\Desktop\Izvestaj-Анја.docx

< End of report >

Anya

Post #5May 12, 2011, 11:51 AM UTC

And the EXTRAS.TXT.

OTL Extras logfile created on: 5/12/2011 1:36:03 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Anja Randjelovic\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 533.00 Mb Available Physical Memory | 52.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 40.00 Gb Total Space | 9.26 Gb Free Space | 23.15% Space Free | Partition Type: NTFS
Drive D: | 108.96 Gb Total Space | 61.36 Gb Free Space | 56.31% Space Free | Partition Type: NTFS

Computer Name: ANJA-DESKTOP | User Name: Anja Randjelovic | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
InternetShortcut [open] – rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Microsoft Office\Office14\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office14\GROOVE.EXE:*:Enabled:Microsoft SharePoint Workspace
"C:\Program Files\Google\Google Talk\googletalk.exe" = C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk – (Google)
"C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe" = C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe:*:Enabled:javaw – ()
"C:\totalcmd\TOTALCMD.EXE" = C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows – (C. Ghisler & Co.)
"C:\Program Files\Vuze\Azureus.exe" = C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus / Vuze
"C:\Program Files\Google\Google Earth\client\googleearth.exe" = C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth – (Google)
"C:\Program Files\Aladdin\NetHASP LM\NHSRVW32.EXE" = C:\Program Files\Aladdin\NetHASP LM\NHSRVW32.EXE:*:Enabled:NetHASP License Manager (as standard 32-bit executable). – (Aladdin Knowledge Systems.)
"C:\Documents and Settings\Anja Randjelovic\Local Settings\Temp\7zS53.tmp\setup\HPZnui01.exe" = C:\Documents and Settings\Anja Randjelovic\Local Settings\Temp\7zS53.tmp\setup\HPZnui01.exe:*:Enabled:hpznui01.exe
"C:\Documents and Settings\Anja Randjelovic\Local Settings\Temp\7zS53.tmp\setup\hponicifs01.exe" = C:\Documents and Settings\Anja Randjelovic\Local Settings\Temp\7zS53.tmp\setup\hponicifs01.exe:*:Enabled:hponicifs01.exe

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{51DD370C-6690-424E-9674-5F14468B323F}" = Corel Graphics - Windows Shell Extension
"_{7F05E704-30A6-421A-97A7-8EEB1C7FF010}" = CorelDRAW® Graphics Suite X4
"_{CE2DA11A-917F-4CF5-AB55-755EC115DD10}" = CorelDRAW® Graphics Suite X4 - Windows Shell Extension
"{06D03B0D-1B4B-43D9-B24C-E547DCAEFB42}" = STOAT
"{07D618CD-B016-438A-ADC9-A75BD23F85CE}" = Wave Support Software
"{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"{0BA2A0BA-7F4D-4B7B-AE94-5F0233AC8A5A}" = NTRU Hybrid TSS v2.0.25
"{0CA49C4E-7B1C-460c-9DB8-4A7160CDF8D1}" = ProductContext
"{0CBC9A39-5A64-446E-8D6B-0E75987D9425}" = ASUS ATI Driver
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1DEF8B27-D75B-4f2a-B723-C506047D1438}" = K8600
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 22
"{27575922-AF37-4BB3-8DEA-B2E1EB25A403}" = ATI Catalyst Control Center
"{2764CA82-DFB9-4498-AF85-719340BF5305}" = Dell Resource CD
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{299C0434-4F4E-341F-A916-4E07AEB35E79}" = Microsoft Visual Studio Tools for Applications 2.0 Runtime
"{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg
"{315ACD04-BCEB-478B-9B1D-5431D0E6CB11}" = ASUS Gamer OSD
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{324CEC09-007A-48eb-90E0-9D42D4D5EB0A}" = NetDeviceManager
"{32A72502-BC2C-4C39-ACEA-BC3D463F0697}" = EN
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35725FBC-A136-4A46-9F29-091759D9BB93}" = MVision
"{36269069-CC92-D777-337F-E14FE6BF6FF6}" = ATI Stream SDK v2 Samples
"{3A98125E-B0AC-47E4-80D7-75DF75B13AA1}" = BPDSoftware_Ini
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{44A27085-0616-4181-A0C3-81C7ECA17F73}" = CorelDRAW Graphics Suite X4
"{44B44E0E-B7F8-45D2-9B1F-B073D337A097}" = BPD_HPSU
"{48EE6C79-1CE2-4CE8-B511-F2140B6781D6}" = Google Earth Pro
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B8AB184-EE5E-4277-BB68-C352BE13DD7B}" = 8600_Help
"{4E98F23B-1328-4322-A6EC-2EDC8FC3A4FE}" = FontNav
"{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"{51DD370C-6690-424E-9674-5F14468B323F}" = Corel Graphics - Windows Shell Extension
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{5783F2D7-5001-0409-0002-0060B0CE6BBA}" = AutoCAD 2007 - English
"{63218538-4A69-497F-8455-904261B0E9E4}" = CorelDRAW Graphics Suite X3
"{63BF0B7D-DFB7-2A23-4212-E7C6D5196A46}" = ATI Stream SDK v2 Developer
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69B078F7-E057-4488-AE6B-CB7BBEEE8DA6}" = HP Officejet Pro K8600 Series
"{6C074FE1-882E-11D6-B602-00105AD85DD7}" = STOAT
"{72FECEA1-E87F-4192-89FA-D0FBF92885BB}" = ETS Upgrade
"{7A35F91E-1D16-454F-A248-B9B782A2327C}" = Dell Support 3.2.1
"{7CF9780C-0F2B-42E3-8B15-9CD9CC635E28}" = Tecplot 10 Dongle
"{7E369B27-13E2-41A5-9879-358EE1C8B5AD}" = Broadcom Gigabit Integrated Controller
"{7F05E704-30A6-421A-97A7-8EEB1C7FF010}" = CorelDRAW Graphics SUite X4 - ICA
"{7F05E704-30A6-421A-97A7-8EEB1C7FF012}" = CorelDRAW Graphics Suite X4 - Capture
"{7F05E704-30A6-421A-97A7-8EEB1C7FF013}" = CorelDRAW Graphics Suite X4 - Draw
"{7F05E704-30A6-421A-97A7-8EEB1C7FF014}" = CorelDRAW Graphics Suite X4 - PP
"{7F05E704-30A6-421A-97A7-8EEB1C7FF016}" = CorelDRAW Graphics Suite X4 - Content
"{7F05E704-30A6-421A-97A7-8EEB1C7FF017}" = CorelDRAW Graphics Suite X4 - Filters
"{7F05E704-30A6-421A-97A7-8EEB1C7FF019}" = CorelDRAW Graphics Suite X4 - FontNav
"{7F05E704-30A6-421A-97A7-8EEB1C7FF100}" = CorelDRAW Graphics Suite X4 - Lang EN
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8D10D317-F8E0-4493-99AE-F6ADBB223553}" = BPDSoftware
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00B0-0409-0000-0000000FF1CE}" = Microsoft Save as PDF Add-in for 2007 Microsoft Office programs
"{90120000-00CA-0000-0000-0000000FF1CE}" = Microsoft Office Small Business 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{9862B19F-4CAD-4EED-920F-2F378D84393F}" = ATI Parental Control & Encoder
"{995BF1A7-30E5-49E5-A0E4-AD3213D9E330}" = Labtec WebCam
"{9D0798D0-AF6C-4E62-94B1-AEBF1A43E00A}" = CorelDRAW Graphics Suite X4 - IPM
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA4A4B2C-0465-3CF8-BA76-27A027D8ACAB}" = Microsoft Visual Studio Tools for Applications 2.0 - ENU
"{ABBA2EA4-740E-4052-902B-9CA70B081E3F}" = Dell Embassy Trust Suite by Wave Systems
"{AC76BA86-1033-0000-7760-000000000002}" = Adobe Acrobat 7.0 Professional
"{B61D21B6-469D-4423-B161-62DB20B8A70E}" = Visual Basic for Applications ® Core - English
"{BBD6BA59-4593-43CC-BBC8-8E53D354AEA4}" = Atmel TPM Driver Installer [removed]
"{BE40EC9E-9466-4288-916D-C1D6C13F4A40}" = upekmsi
"{BEF726DD-4037-4214-8C6A-E625C02D2870}" = Logitech Audio Echo Cancellation Component
"{BF439B41-0252-48DE-8B8B-0430CB26A181}" = CorelDRAW Graphics Suite X4 - VBA
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C0B5D3CB-5F73-4162-B868-4FCC523E7552}" = Tecplot License Manager
"{C941F1F1-25B3-4DF5-83E6-888C51A1AAB6}" = AVIVO Codecs
"{C94E45B0-6AA6-4FB9-9AAE-22085F631880}" = VBA
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CDD4761A-3D3F-4487-9AAF-7855A36E0D31}" = Wave Infrastructure Installer
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE2DA11A-917F-4CF5-AB55-755EC115DD10}" = CorelDRAW® Graphics Suite X4 - Windows Shell Extension
"{CFB61C36-61C9-46E9-8AA3-6E5A896AC989}" = 8600_Readme
"{D1E829E9-88B8-47C6-A75E-0D40E2C09D50}" = Secure Update
"{D25EB07D-09EF-4DBD-A241-CB5CE9AD0651}" = GeoStudio 2004
"{DB81779E-7CC5-4630-BCFC-754004956444}" = Visual Basic for Applications ® Core
"{DD41AC25-61B2-4FC9-90AA-672F32139AC3}" = ETS Launch Pad
"{E6095BEA-8C97-4342-B771-13BB72AC1D88}" = biolsp patch
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{E9C18EBD-85BE-47D0-AA73-3FEDCC976B04}" = Toolbox
"{E9F81423-211E-46B6-9AE0-38568BC5CF6F}" = Alcohol 120% (Trial Version)
"{EA516024-D84D-41F1-814F-83175A6188F2}" = Logitech Video Enumerator
"{EB4C3C06-CF21-46C5-A800-8D3F418CDC2D}" = Tecplot 360
"{EC84E3E6-C2D6-4DFB-81E0-448324C8FDF4}" = Security Wizards
"{EE2EE62C-E27D-486A-AF6D-FA4A06E67476}" = Preboot Manager
"{EE6C5498-B7A0-44C9-86C1-E18F1CB3C262}" = HP Color LaserJet 5550
"{EEAFE1E5-076B-430A-96D9-B567792AFA88}" = EMBASSY Security Center
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F1802FA6-54E9-4B24-BD2A-B50866819795}" = EMBASSY Trust Suite by Wave Systems
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}" = Update Manager
"{FB64BF25-3593-4E4E-AA85-84AEF1D1475F}" = Broadcom Management Programs
"Adobe Acrobat 7.0 Professional" = Adobe Acrobat 7.1.0 Professional
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"avast5" = avast! Free Antivirus
"Google Chrome" = Google Chrome
"HP LaserJet 2200 Uninstaller" = HP LaserJet 2200 Uninstaller
"Img2CAD_is1" = Img2CAD 7.0
"ImgBurn" = ImgBurn
"InstallShield_{07D618CD-B016-438A-ADC9-A75BD23F85CE}" = Wave Support Software
"InstallShield_{0B0A2153-58A6-4244-B458-25EDF5FCD809}" = Private Information Manager
"InstallShield_{51AE9E42-640D-4C14-A9B6-43F64AA4E3E2}" = Document Manager Lite
"InstallShield_{72FECEA1-E87F-4192-89FA-D0FBF92885BB}" = ETS Upgrade
"InstallShield_{D1E829E9-88B8-47C6-A75E-0D40E2C09D50}" = Secure Update
"InstallShield_{DD41AC25-61B2-4FC9-90AA-672F32139AC3}" = ETS Launch Pad
"InstallShield_{EC84E3E6-C2D6-4DFB-81E0-448324C8FDF4}" = Security Wizards
"InstallShield_{EEAFE1E5-076B-430A-96D9-B567792AFA88}" = EMBASSY Security Center
"Magic ISO Maker v5.3 (build 0229)" = Magic ISO Maker v5.3 (build 0229)
"Magic ISO Maker v5.5 (build 0276)" = Magic ISO Maker v5.5 (build 0276)
"MagicDisc 2.7.106" = MagicDisc 2.7.106
"MatlabR2010a" = MATLAB R2010a
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)
"Mozilla Thunderbird (3.1.3)" = Mozilla Thunderbird (3.1.3)
"Nero - Burning Rom!UninstallKey" = Nero 6 Demo
"NetHASP License Manager Uninstall" = NetHASP License Manager
"New Release_is1" = Interactive Groundwater [removed]
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"QcDrv" = Labtec® Camera Driver
"ShockwaveFlash" = Macromedia Flash Player 8
"SMALLBUSINESS" = Microsoft Office Small Business 2007
"ST4UNST #1" = WinFlume
"Totalcmd" = Total Commander (Remove or Repair)
"UltraISO_is1" = UltraISO Premium V9.36
"VLC media player" = VLC media player 1.1.8
"WIC" = Windows Imaging Component
"Winamp" = Winamp
"WinRAR archiver" = WinRAR archiver

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"f031ef6ac137efc5" = Dell Driver Download Manager
"Winamp Detect" = Winamp Detector Plug-in
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.8

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/10/2011 9:44:33 AM | Computer Name = ANJA-DESKTOP | Source = PerfNet | ID = 2004
Description = Unable to open the Server service. Server performance data will not
be returned. Error code returned is in data DWORD 0.

Error - 5/11/2011 3:44:56 AM | Computer Name = ANJA-DESKTOP | Source = PerfNet | ID = 2004
Description = Unable to open the Server service. Server performance data will not
be returned. Error code returned is in data DWORD 0.

Error - 5/11/2011 5:21:20 AM | Computer Name = ANJA-DESKTOP | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

Error - 5/11/2011 5:21:20 AM | Computer Name = ANJA-DESKTOP | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 5/11/2011 5:21:20 AM | Computer Name = ANJA-DESKTOP | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 5/11/2011 5:21:20 AM | Computer Name = ANJA-DESKTOP | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 5/11/2011 5:21:21 AM | Computer Name = ANJA-DESKTOP | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 5/11/2011 5:21:21 AM | Computer Name = ANJA-DESKTOP | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 5/12/2011 3:33:40 AM | Computer Name = ANJA-DESKTOP | Source = PerfNet | ID = 2004
Description = Unable to open the Server service. Server performance data will not
be returned. Error code returned is in data DWORD 0.

Error - 5/12/2011 7:31:35 AM | Computer Name = ANJA-DESKTOP | Source = PerfNet | ID = 2004
Description = Unable to open the Server service. Server performance data will not
be returned. Error code returned is in data DWORD 0.

[ OSession Events ]
Error - 4/20/2011 10:34:31 AM | Computer Name = ANJA-DESKTOP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 22963
seconds with 3240 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 5/12/2011 7:20:35 AM | Computer Name = ANJA-DESKTOP | Source = DCOM | ID = 10009
Description = DCOM was unable to communicate with the computer MILOS-PC using any
of the configured protocols.

Error - 5/12/2011 7:20:38 AM | Computer Name = ANJA-DESKTOP | Source = DCOM | ID = 10009
Description = DCOM was unable to communicate with the computer MILOS-PC using any
of the configured protocols.

Error - 5/12/2011 7:20:40 AM | Computer Name = ANJA-DESKTOP | Source = DCOM | ID = 10009
Description = DCOM was unable to communicate with the computer MILOS-PC using any
of the configured protocols.

Error - 5/12/2011 7:21:12 AM | Computer Name = ANJA-DESKTOP | Source = DCOM | ID = 10009
Description = DCOM was unable to communicate with the computer MILOS-PC using any
of the configured protocols.

Error - 5/12/2011 7:21:15 AM | Computer Name = ANJA-DESKTOP | Source = DCOM | ID = 10009
Description = DCOM was unable to communicate with the computer MILOS-PC using any
of the configured protocols.

Error - 5/12/2011 7:21:17 AM | Computer Name = ANJA-DESKTOP | Source = DCOM | ID = 10009
Description = DCOM was unable to communicate with the computer MILOS-PC using any
of the configured protocols.

Error - 5/12/2011 7:21:49 AM | Computer Name = ANJA-DESKTOP | Source = DCOM | ID = 10009
Description = DCOM was unable to communicate with the computer MILOS-PC using any
of the configured protocols.

Error - 5/12/2011 7:21:52 AM | Computer Name = ANJA-DESKTOP | Source = DCOM | ID = 10009
Description = DCOM was unable to communicate with the computer MILOS-PC using any
of the configured protocols.

Error - 5/12/2011 7:21:54 AM | Computer Name = ANJA-DESKTOP | Source = DCOM | ID = 10009
Description = DCOM was unable to communicate with the computer MILOS-PC using any
of the configured protocols.

Error - 5/12/2011 7:22:26 AM | Computer Name = ANJA-DESKTOP | Source = DCOM | ID = 10009
Description = DCOM was unable to communicate with the computer MILOS-PC using any
of the configured protocols.

< End of report >

Satchfan

Post #6May 12, 2011, 3:22 PM UTC

Hi Anya

P2P - I see you have P2P software, (uTorrent, Azureus), installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infection. If your computer is infected, it almost certainly contributed to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are more often than not, infected. The bad guys use P2P file-sharing as a major conduit to spread their wares.

Please see this topic for more information:

Perils of P2P File Sharing.

I would strongly recommend that you uninstall it now. You can do so via Control Panel, Programs, and then Programs and Features.

Should you decide to keep it, please don’t use it until we have finished up here.

===================================================

Your log shows an e-mail worm on the “F” drive.

This tool will protect both the flash drive and the PC by disabling the autorun feature. Disabling autorun won't prevent infected files from getting into your removable drive but it does prevent these files from launching automatically. Without getting launched, these infected files lie dormant on the drive, and are pretty much harmless unless you double click on them.

Run this tool on all usb drives and computers:

Please download Flash_Disinfector.exe by sUBs from here
and save it to your desktop. • Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
• The utility may ask you to insert your flash drive and/or other removable drives. Please do so and allow the utility to clean up those drives as well.
• Hold down the Shift key when inserting the drive until Windows detects it to keep autorun.inf from executing if it is present.
• Wait until it has finished scanning and then exit the program.
• Reboot your computer when done.
Note: As part of its routine, Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive that was plugged in when you ran it. Do not delete this folder…it will help protect your drives from future infection by keeping the autorun file from being installed on the root drive and running other malicious files.

===================================================

Run OTL

Double click on the icon to run it.
Copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22) O33 - MountPoints2\{0fea642c-4c72-11df-b387-001aa0b17a07}\Shell\AutoRun\command - "" = F:\GORDANA///lakitj.exe O33 - MountPoints2\{0fea642c-4c72-11df-b387-001aa0b17a07}\Shell\open\command - "" = F:\GORDANA///lakitj.exe O33 - MountPoints2\{684476ff-feba-11df-b425-001aa0b17a07}\Shell\AutoRun\command - "" = H:\avira.exe O33 - MountPoints2\{68447705-feba-11df-b425-001aa0b17a07}\Shell\AutoRun\command - "" = I:\urDrive.exe O33 - MountPoints2\{7488d178-2c3d-11df-b36e-001aa0b17a07}\Shell\AutoRun\command - "" = RECYCLING\autorun.exe O33 - MountPoints2\{7488d178-2c3d-11df-b36e-001aa0b17a07}\Shell\open\command - "" = RECYCLING\autorun.exe O33 - MountPoints2\{dd120fd8-2ddd-11df-b370-001aa0b17a07}\Shell\AutoRun\command - "" = GORDANA///lakitj.exe O33 - MountPoints2\{dd120fd8-2ddd-11df-b370-001aa0b17a07}\Shell\open\command - "" = GORDANA///lakitj.exe :Files :Commands [purity] [emptytemp] [Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log (don't check the boxes beside LOP Check or Purity this time)
===================================================

Can you tell me if the problem with search is the only problem you are aware of on your computer.

Logs to include in next post:

OTL fix log
Gmer.txt

Thanks

Satchfan

Anya

Post #7May 12, 2011, 3:48 PM UTC

GMER 1.0.15.15627 - http://www.gmer.net
Rootkit scan 2011-05-12 17:12:44
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 ST3160815AS rev.3.ADA
Running: gmer.exe; Driver: C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\kwlyqpob.sys

—- System - GMER 1.0.15 —-

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwAllocateVirtualMemory [0xAA508728]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwClose [0xAA50F7EA]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateKey [0xAA50F6A2]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwDeleteKey [0xAA50FCA8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwDeleteValueKey [0xAA50FBBE]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwDuplicateObject [0xAA50F276]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwFreeVirtualMemory [0xAA5087D8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwOpenKey [0xAA50F77E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwOpenProcess [0xAA50F1B2]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwOpenThread [0xAA50F218]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwProtectVirtualMemory [0xAA508870]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwQueryValueKey [0xAA50F8C2]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwRenameKey [0xAA50FD76]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwRestoreKey [0xAA50F880]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwSetValueKey [0xAA50FA04]

INT 0x06 \??\C:\WINDOWS\system32\drivers\Haspnt.sys (HASP Kernel Device Driver for Windows NT/Aladdin Knowledge Systems) A78F016D
INT 0x0E \??\C:\WINDOWS\system32\drivers\Haspnt.sys (HASP Kernel Device Driver for Windows NT/Aladdin Knowledge Systems) A78EFFC2

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0xAA51C82E]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateSection [0xAA51C652]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwLoadDriver [0xAA51C78C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!ZwYieldExecution + DA 804E4934 4 Bytes JMP BBAA50F7
PAGE ntoskrnl.exe!ObInsertObject 8056DBBF 5 Bytes JMP AA519C88 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntoskrnl.exe!NtCreateSection 8056DE25 1 Byte [E9]
PAGE ntoskrnl.exe!NtCreateSection 8056DE25 7 Bytes JMP AA51C656 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntoskrnl.exe!ZwCreateProcessEx 8058C938 7 Bytes JMP AA51C832 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntoskrnl.exe!ZwLoadDriver 805D1CC4 7 Bytes JMP AA51C790 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntoskrnl.exe!ObMakeTemporaryObject 805E38C6 5 Bytes JMP AA5181EE \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
init C:\WINDOWS\system32\drivers\Senfilt.sys entry point in "init" section [0xAA76EA00]
.text C:\WINDOWS\system32\drivers\hardlock.sys section is writeable [0xA750F400, 0x7EE2E, 0xE0000020]
.protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xA75ACA20] C:\WINDOWS\system32\drivers\hardlock.sys entry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xA75ACA20]
.protectÿÿÿÿhardlockunknown last code section [0xA75AC800, 0x4E48, 0xE0000020] C:\WINDOWS\system32\drivers\hardlock.sys unknown last code section [0xA75AC800, 0x4E48, 0xE0000020]

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe[264] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Labtec\WebCam10\WebCam10.exe[280] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Labtec\WebCam10\WebCam10.exe[280] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Labtec\WebCam10\WebCam10.exe[280] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Labtec\WebCam10\WebCam10.exe[280] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Labtec\WebCam10\WebCam10.exe[280] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Labtec\WebCam10\WebCam10.exe[280] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Labtec\WebCam10\WebCam10.exe[280] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Labtec\WebCam10\WebCam10.exe[280] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Labtec\WebCam10\WebCam10.exe[280] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Labtec\WebCam10\WebCam10.exe[280] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Labtec\WebCam10\WebCam10.exe[280] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Labtec\WebCam10\WebCam10.exe[280] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Labtec\WebCam10\WebCam10.exe[280] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Labtec\WebCam10\WebCam10.exe[280] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Labtec\WebCam10\WebCam10.exe[280] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[304] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Dell Support\DSAgnt.exe[324] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll
.text C:\Program Files\Dell Support\DSAgnt.exe[324] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Dell Support\DSAgnt.exe[324] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Dell Support\DSAgnt.exe[324] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Dell Support\DSAgnt.exe[324] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Dell Support\DSAgnt.exe[324] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Dell Support\DSAgnt.exe[324] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Dell Support\DSAgnt.exe[324] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Dell Support\DSAgnt.exe[324] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Dell Support\DSAgnt.exe[324] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Dell Support\DSAgnt.exe[324] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Dell Support\DSAgnt.exe[324] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Dell Support\DSAgnt.exe[324] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Dell Support\DSAgnt.exe[324] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\Program Files\Dell Support\DSAgnt.exe[324] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\WINDOWS\system32\ctfmon.exe[480] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software)
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll
.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll

Anya

Post #8May 12, 2011, 4:07 PM UTC

.text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[480] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\ctfmon.exe[480] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\ctfmon.exe[480] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\ctfmon.exe[480] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\ctfmon.exe[480] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\ctfmon.exe[480] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\ctfmon.exe[480] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\ctfmon.exe[480] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\ctfmon.exe[480] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\ctfmon.exe[480] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\ctfmon.exe[480] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\ctfmon.exe[480] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\ctfmon.exe[480] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\ctfmon.exe[480] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\ctfmon.exe[480] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] KERNEL32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe[560] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe[568] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\MagicDisc\MagicDisc.exe[600] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\MagicDisc\MagicDisc.exe[600] ADVAPI32.DLL!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\MagicDisc\MagicDisc.exe[600] ADVAPI32.DLL!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\MagicDisc\MagicDisc.exe[600] ADVAPI32.DLL!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\MagicDisc\MagicDisc.exe[600] ADVAPI32.DLL!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\MagicDisc\MagicDisc.exe[600] ADVAPI32.DLL!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\MagicDisc\MagicDisc.exe[600] ADVAPI32.DLL!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\MagicDisc\MagicDisc.exe[600] ADVAPI32.DLL!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\MagicDisc\MagicDisc.exe[600] ADVAPI32.DLL!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\MagicDisc\MagicDisc.exe[600] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\MagicDisc\MagicDisc.exe[600] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\MagicDisc\MagicDisc.exe[600] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\MagicDisc\MagicDisc.exe[600] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\MagicDisc\MagicDisc.exe[600] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\MagicDisc\MagicDisc.exe[600] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe[612] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\winlogon.exe[696] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\winlogon.exe[696] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\winlogon.exe[696] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\winlogon.exe[696] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\winlogon.exe[696] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\winlogon.exe[696] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\winlogon.exe[696] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\services.exe[740] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\services.exe[740] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\services.exe[740] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\services.exe[740] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\services.exe[740] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\services.exe[740] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\services.exe[740] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\services.exe[740] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\services.exe[740] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\services.exe[740] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\services.exe[740] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\services.exe[740] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\services.exe[740] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\services.exe[740] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\services.exe[740] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\lsass.exe[752] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\lsass.exe[752] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\lsass.exe[752] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\lsass.exe[752] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\lsass.exe[752] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\lsass.exe[752] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\lsass.exe[752] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\lsass.exe[752] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\lsass.exe[752] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\lsass.exe[752] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\lsass.exe[752] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\lsass.exe[752] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\lsass.exe[752] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\lsass.exe[752] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\lsass.exe[752] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\Ati2evxx.exe[928] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[928] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[928] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[928] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[928] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[928] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[928] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[928] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[928] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[928] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[928] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[928] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[928] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[928] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[928] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[952] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[952] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[952] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[952] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[952] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[952] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[952] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[952] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[952] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[952] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[952] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[952] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[952] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[952] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[952] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[952] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1036] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1036] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1036] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1036] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1036] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1036] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1036] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1036] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1036] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1036] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1036] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1036] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1036] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1036] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1036] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe[1112] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe[1112] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe[1112] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe[1112] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe[1112] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe[1112] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe[1112] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe[1112] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe[1112] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe[1112] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe[1112] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe[1112] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe[1112] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe[1112] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe[1112] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[1148] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[1148] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[1148] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[1148] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[1148] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[1148] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[1148] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[1148] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[1148] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[1148] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[1148] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[1148] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[1148] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[1148] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[1148] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[1148] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1236] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1236] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1236] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1236] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1236] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1236] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1236] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1236] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1236] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1236] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1236] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1236] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1236] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1236] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1236] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\Ati2evxx.exe[1328] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[1328] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[1328] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[1328] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[1328] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[1328] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[1328] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[1328] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[1328] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[1328] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[1328] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[1328] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[1328] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[1328] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\Ati2evxx.exe[1328] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\wuauclt.exe[1340] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\wuauclt.exe[1340] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\wuauclt.exe[1340] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\wuauclt.exe[1340] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\wuauclt.exe[1340] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\wuauclt.exe[1340] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\wuauclt.exe[1340] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\wuauclt.exe[1340] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\wuauclt.exe[1340] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\wuauclt.exe[1340] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\wuauclt.exe[1340] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\wuauclt.exe[1340] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\wuauclt.exe[1340] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\wuauclt.exe[1340] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\wuauclt.exe[1340] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1392] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1392] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[1392] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1392] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1392] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1392] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1392] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1392] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1392] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1392] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1392] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1392] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1392] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1392] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1392] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[1392] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll

Anya

Post #9May 12, 2011, 4:08 PM UTC

.text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!SetUnhandledExceptionFilter 7C8447ED 4 Bytes [C2, 04, 00, 90] {RET 0x4; NOP } .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1624] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\Explorer.EXE[1808] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\Explorer.EXE[1808] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\Explorer.EXE[1808] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\Explorer.EXE[1808] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\Explorer.EXE[1808] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\Explorer.EXE[1808] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\Explorer.EXE[1808] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\Explorer.EXE[1808] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\Explorer.EXE[1808] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\Explorer.EXE[1808] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\Explorer.EXE[1808] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\Explorer.EXE[1808] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\Explorer.EXE[1808] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\Explorer.EXE[1808] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\Explorer.EXE[1808] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\spoolsv.exe[1892] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\spoolsv.exe[1892] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\spoolsv.exe[1892] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\spoolsv.exe[1892] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\spoolsv.exe[1892] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\spoolsv.exe[1892] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\spoolsv.exe[1892] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\spoolsv.exe[1892] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\spoolsv.exe[1892] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\spoolsv.exe[1892] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\spoolsv.exe[1892] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\spoolsv.exe[1892] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\spoolsv.exe[1892] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\spoolsv.exe[1892] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\spoolsv.exe[1892] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1908] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] KERNEL32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE[1916] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Analog Devices\Core\smax4pnp.exe[1932] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Analog Devices\Core\smax4pnp.exe[1932] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Analog Devices\Core\smax4pnp.exe[1932] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Analog Devices\Core\smax4pnp.exe[1932] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Analog Devices\Core\smax4pnp.exe[1932] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Analog Devices\Core\smax4pnp.exe[1932] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Analog Devices\Core\smax4pnp.exe[1932] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Analog Devices\Core\smax4pnp.exe[1932] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Analog Devices\Core\smax4pnp.exe[1932] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Analog Devices\Core\smax4pnp.exe[1932] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Analog Devices\Core\smax4pnp.exe[1932] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Analog Devices\Core\smax4pnp.exe[1932] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Analog Devices\Core\smax4pnp.exe[1932] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Analog Devices\Core\smax4pnp.exe[1932] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Analog Devices\Core\smax4pnp.exe[1932] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe[1940] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Google\Google Talk\googletalk.exe[1948] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Google\Google Talk\googletalk.exe[1948] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Google\Google Talk\googletalk.exe[1948] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Google\Google Talk\googletalk.exe[1948] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Google\Google Talk\googletalk.exe[1948] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Google\Google Talk\googletalk.exe[1948] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Google\Google Talk\googletalk.exe[1948] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Google\Google Talk\googletalk.exe[1948] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Google\Google Talk\googletalk.exe[1948] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Google\Google Talk\googletalk.exe[1948] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Google\Google Talk\googletalk.exe[1948] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Google\Google Talk\googletalk.exe[1948] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Google\Google Talk\googletalk.exe[1948] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Google\Google Talk\googletalk.exe[1948] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Google\Google Talk\googletalk.exe[1948] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe[1956] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe[1956] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe[1956] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe[1956] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe[1956] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe[1956] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe[1956] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe[1956] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe[1956] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe[1956] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe[1956] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe[1956] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe[1956] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe[1956] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe[1956] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe[1972] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[1996] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Winamp\winampa.exe[2016] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Winamp\winampa.exe[2016] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Winamp\winampa.exe[2016] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Winamp\winampa.exe[2016] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Winamp\winampa.exe[2016] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Winamp\winampa.exe[2016] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Winamp\winampa.exe[2016] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Winamp\winampa.exe[2016] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Winamp\winampa.exe[2016] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Winamp\winampa.exe[2016] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Winamp\winampa.exe[2016] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Winamp\winampa.exe[2016] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Winamp\winampa.exe[2016] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Winamp\winampa.exe[2016] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Winamp\winampa.exe[2016] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2364] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2364] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2364] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2364] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2364] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2364] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2364] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2364] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2364] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2364] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2364] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2364] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2364] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2364] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2364] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\cidaemon.exe[2536] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cidaemon.exe[2536] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cidaemon.exe[2536] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cidaemon.exe[2536] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cidaemon.exe[2536] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cidaemon.exe[2536] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cidaemon.exe[2536] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cidaemon.exe[2536] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cidaemon.exe[2536] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cidaemon.exe[2536] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cidaemon.exe[2536] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cidaemon.exe[2536] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cidaemon.exe[2536] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cidaemon.exe[2536] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cidaemon.exe[2536] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\alg.exe[2540] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\alg.exe[2540] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\alg.exe[2540] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\alg.exe[2540] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\alg.exe[2540] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\alg.exe[2540] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\alg.exe[2540] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\alg.exe[2540] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\alg.exe[2540] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\alg.exe[2540] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\alg.exe[2540] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\alg.exe[2540] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\alg.exe[2540] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\alg.exe[2540] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\alg.exe[2540] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll

Anya

Post #10May 12, 2011, 4:09 PM UTC

.text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] KERNEL32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2720] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\ATKKBService.exe[2732] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\ATKKBService.exe[2732] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\ATKKBService.exe[2732] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\ATKKBService.exe[2732] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\ATKKBService.exe[2732] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\ATKKBService.exe[2732] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\ATKKBService.exe[2732] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\ATKKBService.exe[2732] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\ATKKBService.exe[2732] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\ATKKBService.exe[2732] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\ATKKBService.exe[2732] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\ATKKBService.exe[2732] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\ATKKBService.exe[2732] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\ATKKBService.exe[2732] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\ATKKBService.exe[2732] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] KERNEL32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\ATI Technologies\ATI.ACE\cli.exe[2740] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\cisvc.exe[2828] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cisvc.exe[2828] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cisvc.exe[2828] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cisvc.exe[2828] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cisvc.exe[2828] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cisvc.exe[2828] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cisvc.exe[2828] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cisvc.exe[2828] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cisvc.exe[2828] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cisvc.exe[2828] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cisvc.exe[2828] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cisvc.exe[2828] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cisvc.exe[2828] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cisvc.exe[2828] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\cisvc.exe[2828] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 00846DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 008472BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 00845BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 0084737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 0084724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 00845AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 008473E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 00846C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 0084595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 008461DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 008465B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 00846AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 0084633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 00846261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 008462BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 00846035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 008466AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 00846A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 008459B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 008464E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 00846EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 00846F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 00846725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 00847202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 00845C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 00845BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 0084718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 00846BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 0084644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 008469D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 00846135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 00847001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 00846D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 00845E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 00846E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 00845F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 00845A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 00847108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 00847236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Wave Systems Corp\Common\DataServer.exe[2848] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 008471E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2936] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2972] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[2972] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2972] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2972] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2972] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2972] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2972] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2972] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2972] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2972] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2972] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2972] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2972] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2972] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[2972] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Java\jre6\bin\jqs.exe[3032] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3204] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3204] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3204] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3204] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3204] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3204] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3204] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3204] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3204] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3204] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3204] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3204] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3204] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3204] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3204] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\System32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] user32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] user32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] user32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] user32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] user32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] user32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe[3280] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3316] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3316] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\System32\wxvault.dll .text C:\WINDOWS\System32\svchost.exe[3316] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3316] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3316] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3316] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3316] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3316] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3316] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3316] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3316] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3316] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3316] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3316] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3316] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\System32\svchost.exe[3316] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\System32\wxvault.dll

Anya

Post #11May 12, 2011, 4:10 PM UTC

.text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[3336] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe[3420] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[3456] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\svchost.exe[3456] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[3456] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[3456] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[3456] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[3456] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[3456] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[3456] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[3456] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[3456] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[3456] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[3456] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[3456] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[3456] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\svchost.exe[3456] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe[3488] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\am_tlmd.exe[3512] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\WINDOWS\system32\am_tlmd.exe[3512] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\am_tlmd.exe[3512] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\am_tlmd.exe[3512] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\am_tlmd.exe[3512] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\am_tlmd.exe[3512] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\am_tlmd.exe[3512] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\am_tlmd.exe[3512] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\am_tlmd.exe[3512] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\am_tlmd.exe[3512] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\am_tlmd.exe[3512] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\am_tlmd.exe[3512] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\am_tlmd.exe[3512] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\am_tlmd.exe[3512] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\WINDOWS\system32\am_tlmd.exe[3512] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\DOCUME~1\ANJARA~1\LOCALS~1\Temp\Rar$EX00.125\gmer.exe[3820] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] ntdll.dll!NtFlushVirtualMemory 7C90D35E 5 Bytes JMP 10006DCE C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] ntdll.dll!NtMapViewOfSection 7C90D51E 5 Bytes JMP 100072BA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] ntdll.dll!NtReadFile 7C90D9CE 5 Bytes JMP 10005BBB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] ntdll.dll!NtUnmapViewOfSection 7C90DF0E 5 Bytes JMP 1000737D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] ntdll.dll!NtWriteFile 7C90DF7E 5 Bytes JMP 1000724D C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] ntdll.dll!LdrLoadDll 7C915CD3 5 Bytes JMP 64D06950 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] ntdll.dll!LdrUnloadDll 7C916C9B 5 Bytes JMP 64D069B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!ReadFile 7C80180E 7 Bytes JMP 10005AF1 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 100073E3 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!CreateFileMappingW 7C8093AA 5 Bytes JMP 10006C79 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!CloseHandle 7C809B57 5 Bytes JMP 1000595F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!GetDriveTypeW 7C80B2E0 5 Bytes JMP 100061DA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!GetFileAttributesW 7C80B75C 5 Bytes JMP 100065B6 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!DuplicateHandle 7C80DE0E 7 Bytes JMP 10006AEA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!FindFirstFileExW 7C80EA8D 5 Bytes JMP 1000633F C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!FindClose 7C80EDE7 7 Bytes JMP 10006261 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!FindNextFileW 7C80EF4A 7 Bytes JMP 100062BB C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!CreateFileW 7C810770 5 Bytes JMP 10006035 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!GetFileSizeEx 7C810A19 5 Bytes JMP 100066AD C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!GetFileInformationByHandle 7C810C7D 5 Bytes JMP 10006A54 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 100059B9 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!GetFileAttributesExW 7C811105 5 Bytes JMP 100064E4 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!GetLongPathNameW 7C813363 5 Bytes JMP 10006EA5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!GetShortPathNameW 7C81F27E 5 Bytes JMP 10006F53 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!MoveFileWithProgressW 7C81F73E 5 Bytes JMP 10006725 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!SetFilePointerEx 7C821067 5 Bytes JMP 10007202 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!CopyFileExW 7C827B42 7 Bytes JMP 10005C61 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!ReadFileEx 7C82BD0B 5 Bytes JMP 10005BDA C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!WriteFileGather 7C82DDB5 7 Bytes JMP 1000718A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!ReadFileScatter 7C82DE61 7 Bytes JMP 10006BE5 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!SetFileAttributesW 7C8314F5 5 Bytes JMP 1000644C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!GetOverlappedResult 7C8315E4 5 Bytes JMP 100069D0 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!DeleteFileW 7C831F7B 5 Bytes JMP 10006135 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!SetEndOfFile 7C83208E 5 Bytes JMP 10007001 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!FlushViewOfFile 7C8359B9 5 Bytes JMP 10006D63 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!RemoveDirectoryW 7C836FA3 5 Bytes JMP 10005E5A C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!BackupRead 7C856F6F 5 Bytes JMP 10006E31 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!CreateDirectoryExW 7C85A782 5 Bytes JMP 10005F4C C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!WriteFileEx 7C85C891 5 Bytes JMP 10005A83 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!GetCompressedFileSizeW 7C85D501 5 Bytes JMP 10007108 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] kernel32.dll!CreateHardLinkW 7C86B65C 7 Bytes JMP 10007236 C:\WINDOWS\system32\wxvault.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] ADVAPI32.dll!SetServiceObjectSecurity 77E36EC9 5 Bytes JMP 64D09D40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] ADVAPI32.dll!ChangeServiceConfigA 77E36FB1 5 Bytes JMP 64D07AE0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] ADVAPI32.dll!ChangeServiceConfigW 77E37149 5 Bytes JMP 64D07ED0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] ADVAPI32.dll!ChangeServiceConfig2A 77E37249 5 Bytes JMP 64D08290 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] ADVAPI32.dll!ChangeServiceConfig2W 77E372D1 5 Bytes JMP 64D083C0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] ADVAPI32.dll!CreateServiceA 77E37359 5 Bytes JMP 64D06E40 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] ADVAPI32.dll!CreateServiceW 77E374F1 5 Bytes JMP 64D072B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] ADVAPI32.dll!DeleteService 77E375F9 5 Bytes JMP 64D078E0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] USER32.dll!SetWinEventHook 77D6E3D3 4 Bytes JMP 64D0B720 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] USER32.dll!UnhookWinEvent 77D6E544 5 Bytes JMP 64D0B8A0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] USER32.dll!SetWindowsHookExW 77D6E621 4 Bytes JMP 64D0BB30 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] USER32.dll!UnhookWindowsHookEx 77D6F29F 5 Bytes JMP 64D0BCB0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] USER32.dll!SetWindowsHookExA 77D702B2 4 Bytes JMP 64D0B9B0 C:\Program Files\Alwil Software\Avast5\snxhk.dll (avast! snxhk/AVAST Software) .text C:\Program Files\Mozilla Firefox\firefox.exe[3828] USER32.dll!ExitWindowsEx 77D89E6D 5 Bytes JMP 100071E7 C:\WINDOWS\system32\wxvault.dll —- Devices - GMER 1.0.15 —- Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software) AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software) Device \FileSystem\Fastfat \FatCdrom aswSP.SYS (avast! self protection module/AVAST Software) AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/AVAST Software) AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software) AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software) AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software) Device \FileSystem\Fastfat \Fat aswSP.SYS (avast! self protection module/AVAST Software) AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software) —- Registry - GMER 1.0.15 —- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 … Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xA7 0x67 0x14 0x86 … Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 … Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x1D 0x92 0x71 0x8B … Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xEF 0x98 0x35 0x4C … Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 … Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xA7 0x67 0x14 0x86 … Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 … Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x1D 0x92 0x71 0x8B … Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xEF 0x98 0x35 0x4C … —- EOF - GMER 1.0.15 —-

Anya

Post #12May 12, 2011, 4:14 PM UTC

Yes, the problem with search is the only one I am aware of.

Here is the OTL fix log

OTL logfile created on: 5/12/2011 6:00:48 PM - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Anja Randjelovic\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 526.00 Mb Available Physical Memory | 51.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 40.00 Gb Total Space | 9.22 Gb Free Space | 23.05% Space Free | Partition Type: NTFS
Drive D: | 108.96 Gb Total Space | 61.36 Gb Free Space | 56.31% Space Free | Partition Type: NTFS
Drive F: | 3.72 Gb Total Space | 1.03 Gb Free Space | 27.66% Space Free | Partition Type: FAT32
Drive H: | 243.73 Mb Total Space | 154.16 Mb Free Space | 63.25% Space Free | Partition Type: FAT32

Computer Name: ANJA-DESKTOP | User Name: Anja Randjelovic | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Alwil Software\Avast5\Setup\avast.setup (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe ()
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
PRC - C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
PRC - C:\Program Files\Adobe\Acrobat 7.0\Distillr\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
PRC - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
PRC - C:\Program Files\Labtec\WebCam10\WebCam10.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe (Labtec Inc.)
PRC - C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe (Labtec Inc,)
PRC - C:\Program Files\Google\Google Talk\googletalk.exe (Google)
PRC - C:\WINDOWS\ATKKBService.exe (ASUSTeK COMPUTER INC.)
PRC - C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe (Wave Systems Corp.)
PRC - C:\Program Files\Wave Systems Corp\Common\DataServer.exe (Wave Systems Corp.)
PRC - C:\Program Files\Dell Support\DSAgnt.exe (Gteko Ltd.)
PRC - C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe (Wave Systems Corp.)
PRC - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe ()
PRC - C:\WINDOWS\system32\am_tlmd.exe ()
PRC - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (Rocket Division Software)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe (Hewlett-Packard)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Alwil Software\Avast5\snxhk.dll (AVAST Software)
MOD - C:\WINDOWS\system32\wxvault.dll ()
MOD - C:\WINDOWS\system32\detoured.dll ()
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (Autodesk Licensing Service) – C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe (Autodesk)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (PSI_SVC_2) – c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
SRV - (LVSrvLauncher) – C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe (Labtec Inc.)
SRV - (ATKKeyboardService) – C:\WINDOWS\ATKKBService.exe (ASUSTeK COMPUTER INC.)
SRV - (DataSvr2) – C:\Program Files\Wave Systems Corp\Common\DataServer.exe (Wave Systems Corp.)
SRV - (tcsd_win32.exe) – C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe ()
SRV - (TecplotLM) – C:\WINDOWS\system32\am_tlmd.exe ()
SRV - (StarWindService) – C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (Rocket Division Software)

========== Driver Services (SafeList) ==========

DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (hardlock) – C:\WINDOWS\system32\drivers\hardlock.sys (Aladdin Knowledge Systems)
DRV - (Haspnt) – C:\WINDOWS\system32\drivers\Haspnt.sys (Aladdin Knowledge Systems)
DRV - (ISODrive) – C:\Program Files\UltraISO\drivers\ISODrive.sys (EZB Systems, Inc.)
DRV - (mcdbus) – C:\WINDOWS\system32\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (LVUSBSta) – C:\WINDOWS\system32\drivers\LVUSBSta.sys (Labtec Inc.)
DRV - (LVMVDrv) – C:\WINDOWS\system32\drivers\LVMVdrv.sys (Labtec Inc.)
DRV - (LVcKap) – C:\WINDOWS\system32\drivers\Lvckap.sys ()
DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) – C:\WINDOWS\system32\drivers\LV302V32.SYS (Labtec Inc.)
DRV - (pepifilter) – C:\WINDOWS\system32\drivers\lv302af.sys (Labtec Inc.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (asuskbnt) – C:\WINDOWS\system32\drivers\atkkbnt.sys (ASUSTeK COMPUTER INC.)
DRV - (EIO) – C:\WINDOWS\system32\drivers\EIO.sys (ASUSTeK Computer Inc.)
DRV - (Video3D) – C:\WINDOWS\system32\drivers\Video3D32.sys (ASUSTeK COMPUTER INC.)
DRV - (WinDriver) – C:\WINDOWS\system32\drivers\windrvr.sys (Jungo)
DRV - (SenFiltService) – C:\WINDOWS\system32\drivers\senfilt.sys (Sensaura)
DRV - (DSproct) – C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys (GTek Technologies Ltd.)
DRV - (PBADRV) – C:\WINDOWS\system32\drivers\pbadrv.sys (Dell Inc)
DRV - (atidgllk) – C:\WINDOWS\atidgllk.sys (Overclocking Tool)
DRV - (vax347b) – C:\WINDOWS\system32\DRIVERS\vax347b.sys ( )
DRV - (Sentinel) – C:\WINDOWS\System32\Drivers\SENTINEL.SYS ()
DRV - (vax347s) – C:\WINDOWS\System32\Drivers\vax347s.sys ( )

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.90
FF - prefs.js..network.proxy.backup.ftp: "proxy.grf.bg.ac.rs"
FF - prefs.js..network.proxy.backup.ftp_port: 8080
FF - prefs.js..network.proxy.backup.gopher: "proxy.grf.bg.ac.rs"
FF - prefs.js..network.proxy.backup.gopher_port: 8080
FF - prefs.js..network.proxy.backup.socks: "proxy.grf.bg.ac.rs"
FF - prefs.js..network.proxy.backup.socks_port: 8080
FF - prefs.js..network.proxy.backup.ssl: "proxy.grf.bg.ac.rs"
FF - prefs.js..network.proxy.backup.ssl_port: 8080
FF - prefs.js..network.proxy.ftp: "proxy.rcub.bg.ac.rs"
FF - prefs.js..network.proxy.ftp_port: 8080
FF - prefs.js..network.proxy.gopher: "proxy.rcub.bg.ac.rs"
FF - prefs.js..network.proxy.gopher_port: 8080
FF - prefs.js..network.proxy.http: "proxy.rcub.bg.ac.rs"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "proxy.rcub.bg.ac.rs"
FF - prefs.js..network.proxy.socks_port: 8080
FF - prefs.js..network.proxy.ssl: "proxy.rcub.bg.ac.rs"
FF - prefs.js..network.proxy.ssl_port: 8080
FF - prefs.js..network.proxy.type: 1

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/29 10:21:08 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/29 10:21:08 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.3\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010/09/08 11:55:27 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.3\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/09/08 11:55:31 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Anja Randjelovic\Application Data\Mozilla\Extensions
[2010/09/08 11:55:31 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Anja Randjelovic\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011/05/12 11:33:28 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Anja Randjelovic\Application Data\Mozilla\Firefox\Profiles\gm6666fl.default\extensions
[2011/04/11 10:02:19 | 000,000,000 | —D | M] (BitDefender QuickScan) – C:\Documents and Settings\Anja Randjelovic\Application Data\Mozilla\Firefox\Profiles\gm6666fl.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2011/02/08 13:58:06 | 000,000,000 | —D | M] (EBrary Reader Plugin) – C:\Documents and Settings\Anja Randjelovic\Application Data\Mozilla\Firefox\Profiles\gm6666fl.default\extensions\[removed]
[2011/05/12 11:33:28 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/02/17 11:12:25 | 000,000,000 | —D | M] (Skype extension) – C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/06/28 14:52:49 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/11/09 10:35:19 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/06/28 14:52:34 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010/09/15 05:50:38 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/01/14 00:46:00 | 000,063,488 | —- | M] (Nullsoft, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npwachk.dll

O1 HOSTS File: ([2004/08/04 12:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 7.0] C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe ()
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [CorelDRAW Graphics Suite 11b] File not found
O4 - HKLM..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe (Google)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe (Labtec Inc,)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Labtec\WebCam10\WebCam10.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [StatusClient 2.6] C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe (Hewlett-Packard)
O4 - HKLM..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe (Hewlett-Packard)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] File not found
O4 - HKCU..\Run: [DellSupport] C:\Program Files\Dell Support\DSAgnt.exe (Gteko Ltd.)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk = C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe ()
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe (Autodesk, Inc)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe (Wave Systems Corp.)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\NetHASP License Manager.lnk = C:\Program Files\Aladdin\NetHASP LM\NHSRVW32.EXE (Aladdin Knowledge Systems.)
O4 - Startup: C:\Documents and Settings\Anja Randjelovic\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 36
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF [binary data]
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1265292694468 (WUWebControl Class)
O16 - DPF: {76326493-E84F-4D4B-939C-1E07B50037F2} https://online.bancaintesabeograd.com/RetailDLL/SGCMSCCD.DLL (ProxyModule Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {A7C346A3-B076-46B3-97F0-D00F6B479451} https://online.bancaintesabeograd.com/RetailDLL/FSINT.dll (FileInterface Class)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (wxvault.dll) - C:\WINDOWS\System32\wxvault.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O30 - LSA: Authentication Packages - (wvauth) - C:\WINDOWS\System32\wvauth.dll (Wave Systems Corp.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/02/02 14:42:06 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2011/05/12 17:54:11 | 000,000,000 | RHSD | M] - C:\autorun.inf – [ NTFS ]
O32 - AutoRun File - [2011/05/12 17:54:11 | 000,000,000 | RHSD | M] - D:\autorun.inf – [ NTFS ]
O33 - MountPoints2\{0fea642c-4c72-11df-b387-001aa0b17a07}\Shell\AutoRun\command - "" = F:\GORDANA///lakitj.exe
O33 - MountPoints2\{0fea642c-4c72-11df-b387-001aa0b17a07}\Shell\open\command - "" = F:\GORDANA///lakitj.exe
O33 - MountPoints2\{684476ff-feba-11df-b425-001aa0b17a07}\Shell\AutoRun\command - "" = H:\avira.exe
O33 - MountPoints2\{68447705-feba-11df-b425-001aa0b17a07}\Shell\AutoRun\command - "" = I:\urDrive.exe
O33 - MountPoints2\{7488d178-2c3d-11df-b36e-001aa0b17a07}\Shell\AutoRun\command - "" = RECYCLING\autorun.exe
O33 - MountPoints2\{7488d178-2c3d-11df-b36e-001aa0b17a07}\Shell\open\command - "" = RECYCLING\autorun.exe
O33 - MountPoints2\{dd120fd8-2ddd-11df-b370-001aa0b17a07}\Shell\AutoRun\command - "" = GORDANA///lakitj.exe
O33 - MountPoints2\{dd120fd8-2ddd-11df-b370-001aa0b17a07}\Shell\open\command - "" = GORDANA///lakitj.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/05/12 17:54:11 | 000,000,000 | RHSD | C] – C:\autorun.inf
[2011/05/12 13:34:36 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe
[2011/05/12 13:27:51 | 000,000,000 | —D | C] – C:\Documents and Settings\Anja Randjelovic\Desktop\backups
[2011/05/12 09:59:43 | 000,000,000 | —D | C] – C:\Documents and Settings\Anja Randjelovic\Desktop\Visual Studio 2008
[2011/05/09 15:13:32 | 000,000,000 | —D | C] – C:\Documents and Settings\Anja Randjelovic\Desktop\HidroloskiGodisnjaci
[2011/05/09 15:13:21 | 000,000,000 | —D | C] – C:\Documents and Settings\Anja Randjelovic\Desktop\MeteoroloskiGodisnjaci
[2011/05/09 14:57:33 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Anja Randjelovic\Desktop\HiJackThis.exe
[2011/04/27 09:48:09 | 000,000,000 | —D | C] – C:\Documents and Settings\Anja Randjelovic\Desktop\Za reizbor
[2011/04/26 15:22:37 | 000,000,000 | —D | C] – C:\Program Files\Interactive Groundwater 3.5.8.2
[2011/04/19 12:52:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Anja Randjelovic\Desktop\Rad-jahorina
[2011/01/13 12:52:55 | 000,159,616 | —- | C] ( ) – C:\WINDOWS\System32\drivers\vax347b.sys
[2011/01/13 12:52:55 | 000,005,248 | —- | C] ( ) – C:\WINDOWS\System32\drivers\vax347s.sys
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/12 17:59:16 | 000,000,902 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/05/12 17:59:01 | 000,002,335 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
[2011/05/12 17:58:46 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/05/12 17:50:45 | 000,132,597 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Flash_Disinfector.exe
[2011/05/12 17:47:36 | 000,012,863 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\gmer.rar
[2011/05/12 17:34:00 | 000,000,906 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/05/12 13:43:25 | 000,293,775 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\gmer.zip
[2011/05/12 13:34:58 | 000,000,401 | —- | M] () – C:\WINDOWS\hpbafd.ini
[2011/05/12 13:34:37 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Anja Randjelovic\Desktop\OTL.exe
[2011/05/12 13:31:17 | 000,013,738 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/05/12 13:29:47 | 000,000,228 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\defogger_reenable
[2011/05/12 13:28:58 | 000,050,477 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Defogger.exe
[2011/05/10 11:44:45 | 006,432,919 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\fao56.pdf
[2011/05/10 11:31:43 | 000,002,500 | —- | M] () – C:\WINDOWS\wincmd.ini
[2011/05/10 11:20:32 | 000,967,373 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\20.pdf
[2011/05/09 15:34:13 | 000,031,744 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/09 14:57:34 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Anja Randjelovic\Desktop\HiJackThis.exe
[2011/05/04 13:15:07 | 000,156,493 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 11 cas-otpad uvod-2010.pdf
[2011/05/04 13:15:04 | 000,175,602 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 10 i 11 cas 2010.pdf
[2011/04/27 11:27:44 | 005,006,007 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\OEI 10 predavanje Buka.pdf
[2011/04/27 10:42:43 | 000,114,769 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 10 cas Buka.pdf
[2011/04/27 10:42:40 | 000,125,518 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 8 cas Energija.pdf
[2011/04/26 15:36:05 | 000,474,877 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Novo7.igw
[2011/04/26 15:25:21 | 001,254,214 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\zhbackground.bmp
[2011/04/26 15:22:08 | 010,565,931 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\igw3.5.8.nomovie.zip
[2011/04/21 11:49:44 | 002,719,329 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\OrtoFoto-podloga.jpg
[2011/04/19 14:49:45 | 000,168,660 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 9 cas.pdf
[2011/04/19 12:46:09 | 000,133,033 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\2.pdf
[2011/04/19 12:41:52 | 000,107,438 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\OEI 2011.pdf
[2011/04/14 13:23:55 | 001,827,455 | —- | M] () – C:\Documents and Settings\Anja Randjelovic\Desktop\OEI4_Povrsinske vode_NJ.pdf
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/12 17:50:45 | 000,132,597 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Flash_Disinfector.exe
[2011/05/12 17:47:36 | 000,012,863 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\gmer.rar
[2011/05/12 13:43:25 | 000,293,775 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\gmer.zip
[2011/05/12 13:29:39 | 000,000,228 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\defogger_reenable
[2011/05/12 13:28:58 | 000,050,477 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Defogger.exe
[2011/05/10 11:40:22 | 006,432,919 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\fao56.pdf
[2011/05/10 11:20:32 | 000,967,373 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\20.pdf
[2011/05/04 13:15:07 | 000,156,493 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 11 cas-otpad uvod-2010.pdf
[2011/05/04 13:15:03 | 000,175,602 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 10 i 11 cas 2010.pdf
[2011/04/27 11:27:42 | 005,006,007 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\OEI 10 predavanje Buka.pdf
[2011/04/27 10:42:43 | 000,114,769 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 10 cas Buka.pdf
[2011/04/27 10:42:39 | 000,125,518 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 8 cas Energija.pdf
[2011/04/26 15:25:21 | 001,254,214 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\zhbackground.bmp
[2011/04/26 15:20:31 | 010,565,931 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\igw3.5.8.nomovie.zip
[2011/04/26 15:18:58 | 002,719,329 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\OrtoFoto-podloga.jpg
[2011/04/26 15:18:58 | 000,474,877 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Novo7.igw
[2011/04/19 14:49:44 | 000,168,660 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\Zadaci 9 cas.pdf
[2011/04/19 12:46:09 | 000,133,033 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\2.pdf
[2011/04/19 12:41:52 | 000,107,438 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\OEI 2011.pdf
[2011/04/14 13:23:54 | 001,827,455 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Desktop\OEI4_Povrsinske vode_NJ.pdf
[2011/03/03 16:17:56 | 000,150,919 | —- | C] () – C:\WINDOWS\hpwins11.dat
[2011/03/03 16:17:56 | 000,000,522 | —- | C] () – C:\WINDOWS\hpwmdl11.dat
[2010/11/02 10:31:56 | 004,153,404 | —- | C] () – C:\WINDOWS\System32\stoat32.dll
[2010/11/02 10:31:56 | 000,024,642 | —- | C] () – C:\WINDOWS\System32\stoat_user.dll
[2010/11/01 17:00:59 | 000,024,630 | —- | C] () – C:\WINDOWS\System32\niva.dll
[2010/09/24 10:18:39 | 000,051,370 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2010/05/11 13:02:12 | 000,000,383 | —- | C] () – C:\WINDOWS\System32\haspdos.sys
[2010/04/09 12:42:52 | 000,000,152 | —- | C] () – C:\WINDOWS\wcx_ftp.ini
[2010/04/08 12:55:33 | 000,000,056 | RHS- | C] () – C:\WINDOWS\System32\5F166C4BE3.sys
[2010/04/08 12:55:08 | 000,003,350 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2010/03/31 13:38:23 | 000,000,207 | —- | C] () – C:\WINDOWS\TecplotL.ini
[2010/03/05 11:17:57 | 000,064,512 | —- | C] () – C:\WINDOWS\System32\drivers\SENTINEL.SYS
[2010/03/05 11:17:57 | 000,038,400 | —- | C] () – C:\WINDOWS\System32\SNTI386.DLL
[2010/03/05 11:17:57 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\RNBOVDD.DLL
[2010/02/22 11:36:29 | 000,031,744 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/11 13:00:16 | 000,000,169 | —- | C] () – C:\WINDOWS\ODBC.INI
[2010/02/10 16:43:33 | 000,000,394 | —- | C] () – C:\WINDOWS\capture.ini
[2010/02/10 16:42:15 | 000,000,088 | RHS- | C] () – C:\Documents and Settings\All Users.WINDOWS\Application Data\E34B6C165F.sys
[2010/02/10 16:42:14 | 000,002,516 | -HS- | C] () – C:\Documents and Settings\All Users.WINDOWS\Application Data\KGyGaAvL.sys
[2010/02/08 12:12:11 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2010/02/05 16:14:15 | 000,002,500 | —- | C] () – C:\WINDOWS\wincmd.ini
[2010/02/05 15:55:32 | 000,000,401 | —- | C] () – C:\WINDOWS\hpbafd.ini
[2010/02/05 15:52:59 | 000,074,752 | —- | C] () – C:\WINDOWS\System32\jst.dll
[2010/02/05 15:52:59 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\PMLJNI.dll
[2010/02/05 15:52:02 | 000,003,399 | —- | C] () – C:\WINDOWS\System32\hptcpmon.ini
[2010/02/05 15:52:02 | 000,000,267 | —- | C] () – C:\WINDOWS\System32\AddPort.ini
[2010/02/05 15:50:16 | 000,000,103 | —- | C] () – C:\WINDOWS\System32\hptrace.ini
[2010/02/05 15:49:56 | 000,023,191 | —- | C] () – C:\WINDOWS\hpclj5550.ini
[2010/02/05 15:12:44 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/02/05 13:00:48 | 000,013,312 | —- | C] () – C:\WINDOWS\System32\BASSMOD.dll
[2010/02/04 16:13:08 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2010/02/04 15:49:32 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2010/02/04 15:48:34 | 000,383,224 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/02/04 15:33:49 | 000,143,360 | —- | C] () – C:\WINDOWS\System32\bioapi_mds300.dll
[2010/02/04 15:33:49 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\bioapi100.dll
[2010/02/04 15:33:28 | 000,000,139 | —- | C] () – C:\Documents and Settings\Anja Randjelovic\Local Settings\Application Data\fusioncache.dat
[2010/02/04 15:08:17 | 000,639,046 | —- | C] () – C:\WINDOWS\aticlocklib.dll
[2010/02/04 15:08:17 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\drivers\nVivid.bin
[2010/02/04 15:08:17 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\drivers\nStandard.bin
[2010/02/04 15:08:17 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\drivers\nAsmedia.bin
[2010/02/04 15:08:17 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\drivers\nAdvanced.bin
[2010/02/04 15:08:17 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\drivers\aVivid.bin
[2010/02/04 15:08:17 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\drivers\aStandard.bin
[2010/02/04 15:08:17 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\drivers\aAsmedia.bin
[2010/02/04 15:08:17 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\drivers\aAdvanced.bin
[2010/02/04 15:08:17 | 000,110,592 | —- | C] () – C:\WINDOWS\R5ClkLib.dll
[2010/02/04 15:08:17 | 000,046,080 | —- | C] () – C:\WINDOWS\System32\aseng.dll
[2010/02/04 15:08:17 | 000,020,480 | —- | C] () – C:\WINDOWS\HyperDrive.exe
[2010/02/04 15:08:17 | 000,011,136 | —- | C] () – C:\WINDOWS\System32\ATKOSDMini.DLL
[2010/02/04 15:08:17 | 000,000,018 | —- | C] () – C:\WINDOWS\System32\atkid.ini
[2010/02/04 15:03:38 | 003,107,788 | R— | C] () – C:\WINDOWS\System32\ativvaxx.dat
[2010/02/04 15:03:37 | 000,138,101 | R— | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2010/02/04 14:59:12 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2010/02/04 14:54:39 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2008/10/22 04:25:32 | 000,094,274 | —- | C] () – C:\WINDOWS\System32\HPBHEALR.DLL
[2007/03/06 17:50:30 | 001,669,664 | —- | C] () – C:\WINDOWS\System32\drivers\Lvckap.sys
[2006/09/12 13:07:36 | 000,184,320 | —- | C] () – C:\WINDOWS\System32\AmRes_en.dll
[2006/09/12 13:01:48 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\AmRes_es.dll
[2006/09/12 13:01:42 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\AmRes_ko.dll
[2006/09/12 13:01:34 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\AmRes_de.dll
[2006/09/12 13:01:28 | 000,184,320 | —- | C] () – C:\WINDOWS\System32\AmRes_pt-BR.dll
[2006/09/12 13:01:20 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\AmRes_fr.dll
[2006/09/12 13:01:12 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\AmRes_ja.dll
[2006/09/12 13:01:06 | 000,208,896 | —- | C] () – C:\WINDOWS\System32\AmRes_ru.dll
[2006/09/12 13:00:58 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\AmRes_it.dll
[2006/09/12 13:00:52 | 000,176,128 | —- | C] () – C:\WINDOWS\System32\AmRes_zh-CHS.dll
[2006/09/12 13:00:44 | 000,172,032 | —- | C] () – C:\WINDOWS\System32\AmRes_zh-CHT.dll
[2006/09/08 09:32:02 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\wxvault.dll
[2006/09/08 09:30:44 | 000,004,096 | —- | C] () – C:\WINDOWS\System32\detoured.dll
[2006/09/05 11:05:32 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\Internationalization_en.dll
[2006/09/05 10:26:06 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\Internationalization_pt.dll
[2006/09/05 10:25:54 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\Internationalization_zh-CHT.dll
[2006/09/05 10:25:42 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\Internationalization_ko.dll
[2006/09/05 10:25:32 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\Internationalization_es.dll
[2006/09/05 10:25:20 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\Internationalization_ru.dll
[2006/09/05 10:25:10 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\Internationalization_ja.dll
[2006/09/05 10:24:58 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_it.dll
[2006/09/05 10:24:48 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_de.dll
[2006/09/05 10:24:36 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\Internationalization_fr.dll
[2006/09/05 10:24:26 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\Internationalization_zh-CHS.dll
[2006/06/12 11:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_RUS.dll
[2006/06/12 11:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_ITA.dll
[2006/06/12 11:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_FRA.dll
[2006/06/12 11:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_ESN.dll
[2006/06/12 11:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_ENU.dll
[2006/06/12 11:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_DEU.dll
[2006/06/12 11:01:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\TspPopup_CHS.dll
[2006/06/12 11:01:16 | 000,348,160 | —- | C] () – C:\WINDOWS\System32\Tsp.dll
[2006/03/02 18:13:36 | 000,143,872 | —- | C] () – C:\WINDOWS\System32\am_tlmd.exe
[2005/12/01 15:41:20 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\pbadrvdll.dll
[2005/09/20 14:36:06 | 000,798,720 | —- | C] () – C:\WINDOWS\System32\DemoLicense.dll
[2005/03/22 01:48:05 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2005/03/22 01:48:05 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 12:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 12:00:00 | 000,443,588 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 12:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 12:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 12:00:00 | 000,071,846 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 12:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 12:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 12:00:00 | 000,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys
[2004/08/04 12:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 12:00:00 | 000,001,788 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2004/08/04 12:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/07/21 16:03:14 | 000,917,504 | —- | C] () – C:\WINDOWS\System32\lmgr10.dll
[2004/07/20 15:27:52 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\ADsSecurity.dll
[2004/03/18 19:01:20 | 000,072,192 | —- | C] () – C:\WINDOWS\System32\xltZlib.dll
[2003/09/17 17:50:19 | 000,929,280 | —- | C] () – C:\WINDOWS\System32\vtkHybrid.dll
[2003/08/05 12:28:14 | 001,798,656 | —- | C] () – C:\WINDOWS\System32\vtkRendering.dll
[2003/08/05 12:28:10 | 001,998,848 | —- | C] () – C:\WINDOWS\System32\vtkIO.dll
[2003/08/05 12:28:06 | 002,162,688 | —- | C] () – C:\WINDOWS\System32\vtkGraphics.dll
[2003/08/05 12:28:02 | 002,234,368 | —- | C] () – C:\WINDOWS\System32\vtkImaging.dll
[2003/08/05 12:27:59 | 000,329,216 | —- | C] () – C:\WINDOWS\System32\vtkFiltering.dll
[2003/08/05 12:27:57 | 001,463,808 | —- | C] () – C:\WINDOWS\System32\vtkCommon.dll
[2003/08/05 12:27:54 | 000,096,768 | —- | C] () – C:\WINDOWS\System32\vtkjpeg.dll
[2003/08/05 12:27:52 | 000,103,936 | —- | C] () – C:\WINDOWS\System32\vtkpng.dll
[2003/08/05 12:27:51 | 000,046,592 | —- | C] () – C:\WINDOWS\System32\vtkzlib.dll
[2003/01/30 08:04:00 | 000,618,496 | —- | C] () – C:\WINDOWS\System32\stlpmt45.dll

========== Custom Scans ==========

< :Services >

< >

< :OTL >

< FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 >

< FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 >

< O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22) >
Invalid Switch: jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)

< O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.) >
Invalid Switch: jinstall-…indows-i586.cab (Reg Error: Key error.)

< O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22) >
Invalid Switch: jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)

< O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22) >
Invalid Switch: jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)

< O33 - MountPoints2\{0fea642c-4c72-11df-b387-001aa0b17a07}\Shell\AutoRun\command - "" = F:\GORDANA///lakitj.exe >

< O33 - MountPoints2\{0fea642c-4c72-11df-b387-001aa0b17a07}\Shell\open\command - "" = F:\GORDANA///lakitj.exe >

< O33 - MountPoints2\{684476ff-feba-11df-b425-001aa0b17a07}\Shell\AutoRun\command - "" = H:\avira.exe >

< O33 - MountPoints2\{68447705-feba-11df-b425-001aa0b17a07}\Shell\AutoRun\command - "" = I:\urDrive.exe >

< O33 - MountPoints2\{7488d178-2c3d-11df-b36e-001aa0b17a07}\Shell\AutoRun\command - "" = RECYCLING\autorun.exe >

< O33 - MountPoints2\{7488d178-2c3d-11df-b36e-001aa0b17a07}\Shell\open\command - "" = RECYCLING\autorun.exe >

< O33 - MountPoints2\{dd120fd8-2ddd-11df-b370-001aa0b17a07}\Shell\AutoRun\command - "" = GORDANA///lakitj.exe >

< O33 - MountPoints2\{dd120fd8-2ddd-11df-b370-001aa0b17a07}\Shell\open\command - "" = GORDANA///lakitj.exe >

< >

< :Files >

< >

< :Commands >

< [purity] >

< [emptytemp] >

< [Reboot] >

========== Files - Unicode (All) ==========
[2011/04/26 16:52:11 | 000,022,651 | —- | M] ()(C:\Documents and Settings\Anja Randjelovic\Desktop\Izvestaj-????.docx) – C:\Documents and Settings\Anja Randjelovic\Desktop\Izvestaj-Анја.docx
[2011/03/21 14:20:40 | 000,022,651 | —- | C] ()(C:\Documents and Settings\Anja Randjelovic\Desktop\Izvestaj-????.docx) – C:\Documents and Settings\Anja Randjelovic\Desktop\Izvestaj-Анја.docx

< End of report >

Satchfan

Post #13May 12, 2011, 4:28 PM UTC

Hi Anya

Thanks for the Gmer logs.

Unfortunately the OTL fix didn’t happen: I think you clicked “Run scan” instead of “Run Fix”

Please run it again following the instructions below.

Run OTL

Double click on the icon to run it.

Copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22) O33 - MountPoints2\{0fea642c-4c72-11df-b387-001aa0b17a07}\Shell\AutoRun\command - "" = F:\GORDANA///lakitj.exe O33 - MountPoints2\{0fea642c-4c72-11df-b387-001aa0b17a07}\Shell\open\command - "" = F:\GORDANA///lakitj.exe O33 - MountPoints2\{684476ff-feba-11df-b425-001aa0b17a07}\Shell\AutoRun\command - "" = H:\avira.exe O33 - MountPoints2\{68447705-feba-11df-b425-001aa0b17a07}\Shell\AutoRun\command - "" = I:\urDrive.exe O33 - MountPoints2\{7488d178-2c3d-11df-b36e-001aa0b17a07}\Shell\AutoRun\command - "" = RECYCLING\autorun.exe O33 - MountPoints2\{7488d178-2c3d-11df-b36e-001aa0b17a07}\Shell\open\command - "" = RECYCLING\autorun.exe O33 - MountPoints2\{dd120fd8-2ddd-11df-b370-001aa0b17a07}\Shell\AutoRun\command - "" = GORDANA///lakitj.exe O33 - MountPoints2\{dd120fd8-2ddd-11df-b370-001aa0b17a07}\Shell\open\command - "" = GORDANA///lakitj.exe :Files :Commands [purity] [emptytemp] [Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

Thanks

Have to get tea & things now but will get back later

Satchfan

Anya

Post #14May 13, 2011, 9:32 AM UTC

You are right! I believe I clicked on RUN SCAN instead of RUN FIX Now I have another problem - Microsoft Windows is reporting that it has restored from a serious system error (and I cannot get rid of the notification box - if I click send report - it reports that it is corrupted, and I get back to the first box - if I click don't send - it appears again with options: send report or don't send…) This is the OTL fix log All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== Prefs.js: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 removed from extensions.enabledItems Prefs.js: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 removed from extensions.enabledItems Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Starting removal of ActiveX control {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0fea642c-4c72-11df-b387-001aa0b17a07}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0fea642c-4c72-11df-b387-001aa0b17a07}\ not found. File F:\GORDANA///lakitj.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0fea642c-4c72-11df-b387-001aa0b17a07}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0fea642c-4c72-11df-b387-001aa0b17a07}\ not found. File F:\GORDANA///lakitj.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{684476ff-feba-11df-b425-001aa0b17a07}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{684476ff-feba-11df-b425-001aa0b17a07}\ not found. File H:\avira.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{68447705-feba-11df-b425-001aa0b17a07}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{68447705-feba-11df-b425-001aa0b17a07}\ not found. File I:\urDrive.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7488d178-2c3d-11df-b36e-001aa0b17a07}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7488d178-2c3d-11df-b36e-001aa0b17a07}\ not found. File RECYCLING\autorun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7488d178-2c3d-11df-b36e-001aa0b17a07}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7488d178-2c3d-11df-b36e-001aa0b17a07}\ not found. File RECYCLING\autorun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd120fd8-2ddd-11df-b370-001aa0b17a07}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dd120fd8-2ddd-11df-b370-001aa0b17a07}\ not found. File GORDANA///lakitj.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd120fd8-2ddd-11df-b370-001aa0b17a07}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dd120fd8-2ddd-11df-b370-001aa0b17a07}\ not found. File GORDANA///lakitj.exe not found. ========== FILES ========== ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 56924748 bytes ->Temporary Internet Files folder emptied: 29662318 bytes ->FireFox cache emptied: 43925558 bytes ->Flash cache emptied: 834 bytes User: All Users User: All Users.WINDOWS User: Anja Randjelovic ->Temp folder emptied: 192385209 bytes ->Temporary Internet Files folder emptied: 34437365 bytes ->Java cache emptied: 554780 bytes ->FireFox cache emptied: 62510353 bytes ->Google Chrome cache emptied: 5933605 bytes ->Flash cache emptied: 26055 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Default User.WINDOWS ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService.NT AUTHORITY ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 402 bytes User: NetworkService.NT AUTHORITY ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 820354 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2175612 bytes %systemroot%\System32 .tmp files removed: 2577 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 244118077 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 58927682 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 2809273373 bytes Total Files Cleaned = 3,378.00 mb OTL by OldTimer - Version 3.2.22.3 log created on 05132011_111326 Files\Folders moved on Reboot… File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot. Registry entries deleted on Reboot…

Satchfan

Post #15May 13, 2011, 3:20 PM UTC

Hello again Anya

This could be a rogue program giving false warnings. Please note the following:
• Print out these instructions as we may need to close every window that is open later in the fix.

It is possible that the infection you are trying to remove will not allow you to download files on the infected computer. If this is the case, then you will need to download the files requested in this guide on another computer and then transfer them to the infected computer. You can transfer the files via a CD/DVD, external drive, or USB flash drive.
===================================================

Download/run Rkill:

Before we can do anything we must first end the processes that belong to the rogue program so that it does not interfere with the cleaning procedure.

please download Rkill from one of the following links and save to your Desktop:

Link One
Link Two
Link Three
Link Four
double click on Rkill.
a command window will open then disappear upon completion, this is normal.
please leave Rkill on the Desktop until otherwise advised.

Note: If your security software warns about Rkill, please ignore and allow the download to continue.

Run rkill repeatedly if neccesary until it's able to do its job. This may take a few attempts.

You'll be able to tell when rkill has done its job when your desktop (explorer.exe) cycles off and then on again.

===================================================

Download Malwarebytes-Anti-Malware

Click here

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware. and Launch Malwarebytes' Anti-Malware, then click Finish..
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

===================================================

This infection family will also hide all the files on your computer from being seen. To make your files visible again, please download the following program to your desktop:

Unhide.exe

Once the program has been downloaded, double-click on the Unhide.exe icon on your desktop and allow the program to run. This program will remove the +H, or hidden, attribute from all the files on your hard drives. If there are any files that were purposely hidden by you, you will need to hide them again after this tool is run.

Please include the Mbam.txt log with next post and tell me how things are

Thanks

Satchfan

✨ Ask AI

Ask AI