trojan virus 16375588.exe- please help remove

whatsup Topic Starter

Post #1June 7, 2011, 3:29 PM UTC

I somehow contracted the above-mentioned trojan. I tried to run malwarebytes off a thumb drive in safe mode, but it didn't find anything. And when I tried to update it, it wouldn't let me save the update on the hard drive. I also can't see any of my file or program folders. There's just a black screen and when I click start menu and look for programs, it's empty. I tried to show hidden files/folder, but that didn't do anything. I also tried starting normally, still can't see and programs, but was able to run viruscan off the toolbar and it found that virus, but it was taking so long to scan that I stopped before the whole scan finished. Any advice you can give would be greatly appreciated. Thanks.

Conspire

Post #2June 8, 2011, 11:06 AM UTC

**In any case where you happen to be busy or unable to give us a reply, we would be grateful if you keep us informed in advance and we will be more than happy to wait. Failure to do so we will have your thread closed in THREE(3) days.

Hello there, whatsup

I'm Conspire, I'll be glad to help you with your computer problems.

Please observe these rules while we work:

Read the entire procedure
It is important to perform ALL actions in sequence.
If you don't know, stop and ask! Don't keep going on.
Please reply to this thread. Do not start a new topic.
Stick with me till you're given the all clear.
Remember, absence of symptoms does not mean the infection is all gone.
Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.

IMPORTANT NOTE : Please do not delete anything unless instructed to.

—————————————————————————————————

This should show up your program files.

Please download Unhide.exe to your desktop:

Double-click on the Unhide.exe icon on your desktop and allow the program to run.
This program will remove the hidden attributes from all the files on your system.
Note: If you had purposely hidden any files, then you will need to hide them again after this tool has run.

—————————————————————————————————

Hello there,

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click on Minimal Output at the top
Download the following file scan.txt to your Desktop. Click here to download it. You may need to right click on it and select "Save"
Double click inside the Custom Scan box at the bottom
A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel"
Click the OK button and navigate to the file scan.txt which we just saved to your desktop
Select scan.txt and click Open. Writing will now appear under the Custom Scan box
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

===================================================

[external image: Posted Image]

Please download GMER from one of the following locations, and save it to your desktop:
Main Mirror
This version will download a randomly named file (Recommended)
Zip Mirror
This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

Extract the contents of the zipped file to desktop (applicable only to Zip mirror) .
Double click [external image: Posted Image] or [external image: Posted Image] on your desktop.
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
[external image: Posted Image]

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

===================================================

Download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

===================================================

On your next reply please post :
OTL log
GMER log
Checkup log

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

whatsup

Post #3June 9, 2011, 6:32 PM UTC

Hi Conspire, thanks for helping me. Here's the OTL logs, GMER log and Check up log…let me know what's next::

OTL Txt:

OTL logfile created on: 6/9/2011 11:00:20 AM - Run 2
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Jared Goodman\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.01 Gb Available Physical Memory | 50.76% Memory free
1.84 Gb Paging File | 1.08 Gb Available in Paging File | 58.68% Paging File free
Paging file location(s): [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 82.82 Gb Total Space | 27.14 Gb Free Space | 32.77% Space Free | Partition Type: NTFS
Drive D: | 61.29 Gb Total Space | 61.16 Gb Free Space | 99.78% Space Free | Partition Type: NTFS

Computer Name: GOODMAN_NY | User Name: Jared Goodman | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Jared Goodman\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe ()
PRC - C:\Program Files\AVG\AVG10\avgsrmax.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\VERIZONDM\bin\tgsrvc.exe (SupportSoft, Inc.)
PRC - C:\Program Files\VERIZONDM\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\Program Files\VERIZONDM\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Java\jre6\bin\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe (ASUSTeK Computer Inc.)
PRC - C:\Program Files\EeePC\ACPI\AsTray.exe (ASUSTeK Computer Inc.)
PRC - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe (McAfee, Inc.)
PRC - C:\Program Files\EeePC\ACPI\AsEPCMon.exe (ASUSTeK Computer Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Brother\Brmfcmon\BrMfimon.exe (Brother Industries, Ltd.)
PRC - C:\Program Files\McAfee\Common Framework\Mctray.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\Common Framework\naPrdMgr.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\Common Framework\UdaterUI.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\Common Framework\FrameworkService.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Jared Goodman\Desktop\OTL.exe (OldTimer Tools)
MOD - c:\Program Files\McAfee\SiteAdvisor\sahook.dll (McAfee, Inc.)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – File not found
SRV - (AVG Security Toolbar Service) – C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe ()
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (avgwd) – C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (tgsrvc_verizondm) SupportSoft Repair Service (verizondm) – C:\Program Files\VERIZONDM\bin\tgsrvc.exe (SupportSoft, Inc.)
SRV - (sprtsvc_verizondm) SupportSoft Sprocket Service (verizondm) – C:\Program Files\VERIZONDM\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (McShield) – C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe (McAfee, Inc.)
SRV - (McTaskManager) – C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe (McAfee, Inc.)
SRV - (McAfeeFramework) – C:\Program Files\McAfee\Common Framework\FrameworkService.exe (McAfee, Inc.)
SRV - (IviRegMgr) – C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) – C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) – C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSFilter) – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (L1e) – C:\WINDOWS\system32\drivers\l1e51x86.sys (Atheros Communications, Inc.)
DRV - (AR5416) – C:\WINDOWS\system32\drivers\athw.sys (Atheros Communications, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (BTKRNL) – C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (BTWDNDIS) – C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.)
DRV - (btaudio) – C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.)
DRV - (mfehidk) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\WINDOWS\system32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mfetdik) – C:\WINDOWS\system32\drivers\mfetdik.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys (McAfee, Inc.)
DRV - (AsusACPI) – C:\WINDOWS\system32\drivers\ASUSACPI.SYS (ASUSTeK Computer Inc.)
DRV - (btwhid) – C:\WINDOWS\system32\drivers\btwhid.sys (Broadcom Corporation.)
DRV - (BTDriver) – C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - HKLM\software\mozilla\eMusic Download Manager\Extensions\\Components: C:\Program Files\eMusic Download Manager\xulrunner\components [2010/07/31 15:09:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\eMusic Download Manager\Extensions\\Plugins: C:\Program Files\eMusic Download Manager\xulrunner\plugins [2011/02/21 12:33:25 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared [2011/06/07 18:35:09 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2011/05/24 21:44:07 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/06/07 12:19:27 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/24 19:54:28 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/06 17:24:58 | 000,000,000 | —D | M]

[2009/03/23 23:00:10 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Jared Goodman\Application Data\Mozilla\Extensions
[2009/03/23 23:00:10 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Jared Goodman\Application Data\Mozilla\Extensions\[removed]
[2011/06/06 10:22:32 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Jared Goodman\Application Data\Mozilla\Firefox\Profiles\9x1w6o64.default\extensions
[2011/03/15 20:05:43 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Jared Goodman\Application Data\Mozilla\Firefox\Profiles\9x1w6o64.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/06/06 10:22:32 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/02/20 23:40:53 | 000,000,000 | —D | M] (eMusic - Apple iTunes Support) – C:\PROGRAM FILES\EMUSIC DOWNLOAD MANAGER\XULRUNNER\EXTENSIONS\[removed]
[2010/02/20 23:40:53 | 000,000,000 | —D | M] (eMusic - Nullsoft Winamp Support) – C:\PROGRAM FILES\EMUSIC DOWNLOAD MANAGER\XULRUNNER\EXTENSIONS\[removed]
[2010/02/20 23:40:54 | 000,000,000 | —D | M] (eMusic - Microsoft Media Player Support) – C:\PROGRAM FILES\EMUSIC DOWNLOAD MANAGER\XULRUNNER\EXTENSIONS\[removed]
[2009/11/19 18:16:28 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2009/11/19 18:16:29 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
[2007/04/16 13:07:12 | 000,180,293 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll
[2010/11/20 11:02:32 | 000,002,024 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\McSiteAdvisor.xml

O1 HOSTS File: ([2009/08/13 12:59:30 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [AsusACPIServer] C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [AsusEPCMonitor] C:\Program Files\EeePC\ACPI\AsEPCMon.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [AsusTray] C:\Program Files\EeePC\ACPI\AsTray.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Program Files\McAfee\Common Framework\UdaterUI.exe (McAfee, Inc.)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [ShStatEXE] C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE (McAfee, Inc.)
O4 - HKLM..\Run: [VERIZONDM] C:\Program Files\VERIZONDM\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\RunOnce: [spchecker] C:\Program Files\AVG\AVG10\Notification\SPCheckerTE.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Send to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_15.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - File not found
O24 - Desktop WallPaper: C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/01/09 02:47:53 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17183584330711040)

========== Files/Folders - Created Within 30 Days ==========

[2011/06/09 10:43:56 | 000,580,096 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Jared Goodman\Desktop\OTL.exe
[2011/06/07 22:57:59 | 000,607,222 | R— | C] (Swearware) – C:\Documents and Settings\Jared Goodman\Desktop\dds.scr
[2011/06/07 20:13:51 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\hey
[2011/06/07 20:13:46 | 000,000,000 | —D | C] – C:\Program Files\whatsup
[2011/06/07 20:12:00 | 009,435,312 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Jared Goodman\Desktop\mbam-setup-1.51.0.1200.exe
[2011/06/07 19:02:58 | 000,000,000 | —D | C] – C:\$AVG
[2011/06/07 18:36:00 | 000,000,000 | —D | C] – C:\Documents and Settings\Jared Goodman\Application Data\AVG10
[2011/06/07 18:35:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\AVG 2011
[2011/06/07 12:19:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/06/07 12:19:19 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\AVG
[2011/06/07 11:55:31 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/06/07 11:44:55 | 005,568,944 | —- | C] (AVG Technologies) – C:\Documents and Settings\Jared Goodman\Desktop\avg_free_stb_all_2011_1382_cnet.exe
[2011/06/07 11:10:48 | 000,000,000 | R–D | C] – C:\Documents and Settings\Jared Goodman\Recent
[2011/06/06 23:12:45 | 000,000,000 | —D | C] – C:\Documents and Settings\Jared Goodman\Start Menu\Programs\Windows XP Restore
[2009/01/08 04:47:05 | 015,523,560 | —- | C] (Macrovision Corporation) – C:\Program Files\U1 Setup.exe
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[11 C:\Documents and Settings\Jared Goodman\Desktop\*.tmp files -> C:\Documents and Settings\Jared Goodman\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/09 10:43:42 | 000,580,096 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Jared Goodman\Desktop\OTL.exe
[2011/06/09 10:36:07 | 000,001,010 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-382615644-1615748766-3516731530-1006UA.job
[2011/06/09 10:33:34 | 117,775,838 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/06/09 10:31:34 | 000,606,105 | —- | M] () – C:\Documents and Settings\Jared Goodman\Desktop\unhide.exe
[2011/06/08 10:53:58 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/06/08 10:52:02 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\At11.job
[2011/06/08 10:51:40 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\At5.job
[2011/06/08 10:51:40 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\At24.job
[2011/06/08 10:51:40 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\At23.job
[2011/06/08 10:51:40 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\At1.job
[2011/06/08 10:51:34 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/06/08 01:36:07 | 000,000,958 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-382615644-1615748766-3516731530-1006Core.job
[2011/06/07 23:10:10 | 000,302,592 | —- | M] () – C:\Documents and Settings\Jared Goodman\Desktop\EHZ3HXFQ.EXE
[2011/06/07 22:57:34 | 000,607,222 | R— | M] (Swearware) – C:\Documents and Settings\Jared Goodman\Desktop\dds.scr
[2011/06/07 22:55:30 | 000,000,000 | —- | M] () – C:\Documents and Settings\Jared Goodman\defogger_reenable
[2011/06/07 22:54:34 | 000,050,477 | —- | M] () – C:\Documents and Settings\Jared Goodman\Desktop\Defogger.exe
[2011/06/07 22:11:34 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\At22.job
[2011/06/07 22:11:34 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\At21.job
[2011/06/07 20:11:59 | 009,435,312 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Jared Goodman\Desktop\mbam-setup-1.51.0.1200.exe
[2011/06/07 18:35:04 | 000,000,690 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2011/06/07 11:44:55 | 005,568,944 | —- | M] (AVG Technologies) – C:\Documents and Settings\Jared Goodman\Desktop\avg_free_stb_all_2011_1382_cnet.exe
[2011/06/06 23:28:46 | 000,445,164 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/06/06 23:28:46 | 000,072,708 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/06/06 23:25:33 | 000,000,040 | —- | M] () – C:\Documents and Settings\All Users\Application Data\~16375588
[2011/06/06 23:12:47 | 000,000,817 | —- | M] () – C:\Documents and Settings\Jared Goodman\Desktop\Windows XP Restore.lnk
[2011/06/06 23:11:48 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\At19.job
[2011/06/06 23:11:48 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\At18.job
[2011/06/06 23:11:48 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\At17.job
[2011/06/06 23:11:48 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\At16.job
[2011/06/06 23:11:48 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\At15.job
[2011/06/06 23:11:48 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\At13.job
[2011/06/06 23:11:48 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\At12.job
[2011/06/05 12:41:48 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/06/05 12:29:54 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\At20.job
[2011/06/04 19:03:43 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\At14.job
[2011/06/02 11:05:28 | 000,102,369 | —- | M] () – C:\Documents and Settings\Jared Goodman\Desktop\golf-club-at-chelsea-piers-new-york-city-1.pdf
[2011/06/02 10:54:53 | 000,014,743 | —- | M] () – C:\Documents and Settings\Jared Goodman\Desktop\JOB.pdf
[2011/06/02 10:43:21 | 000,006,413 | —- | M] () – C:\Documents and Settings\Jared Goodman\Desktop\Qualifications.pdf
[2011/06/01 23:13:27 | 000,002,497 | —- | M] () – C:\Documents and Settings\Jared Goodman\Desktop\Microsoft Office Word 2003.lnk
[2011/05/29 09:11:30 | 000,039,984 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/28 12:20:17 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\At10.job
[2011/05/16 11:51:00 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\At4.job
[2011/05/13 02:18:20 | 000,019,968 | —- | M] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/11 13:11:38 | 000,000,792 | —- | M] () – C:\Documents and Settings\Jared Goodman\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Office Outlook.lnk
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[11 C:\Documents and Settings\Jared Goodman\Desktop\*.tmp files -> C:\Documents and Settings\Jared Goodman\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/09 10:41:33 | 000,001,620 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/06/09 10:41:33 | 000,000,792 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Office Outlook.lnk
[2011/06/09 10:41:33 | 000,000,777 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\Microsoft\Internet Explorer\Quick Launch\Picasa 3.lnk
[2011/06/09 10:41:33 | 000,000,079 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/06/09 10:41:32 | 000,002,137 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/06/09 10:41:32 | 000,001,602 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/06/09 10:41:32 | 000,000,815 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/06/09 10:41:32 | 000,000,778 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Full Tilt Poker.lnk
[2011/06/09 10:41:32 | 000,000,104 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\Microsoft\Internet Explorer\Quick Launch\E-mail.lnk
[2011/06/09 10:33:34 | 117,775,838 | —- | C] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/06/09 10:31:55 | 000,606,105 | —- | C] () – C:\Documents and Settings\Jared Goodman\Desktop\unhide.exe
[2011/06/07 23:10:09 | 000,302,592 | —- | C] () – C:\Documents and Settings\Jared Goodman\Desktop\EHZ3HXFQ.EXE
[2011/06/07 22:55:30 | 000,000,000 | —- | C] () – C:\Documents and Settings\Jared Goodman\defogger_reenable
[2011/06/07 22:54:43 | 000,050,477 | —- | C] () – C:\Documents and Settings\Jared Goodman\Desktop\Defogger.exe
[2011/06/07 18:35:04 | 000,000,690 | —- | C] () – C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2011/06/06 23:19:09 | 000,000,040 | —- | C] () – C:\Documents and Settings\All Users\Application Data\~16375588
[2011/06/06 23:12:47 | 000,000,817 | —- | C] () – C:\Documents and Settings\Jared Goodman\Desktop\Windows XP Restore.lnk
[2011/06/06 18:41:41 | 010,437,269 | —- | C] () – C:\Documents and Settings\Jared Goodman\Desktop\14 King (Bonus Track).m4a
[2011/06/06 18:10:21 | 006,367,825 | —- | C] () – C:\Documents and Settings\Jared Goodman\Desktop\21 You are the Rake (Greenpoint Vers.m4a
[2011/06/02 11:05:28 | 000,102,369 | —- | C] () – C:\Documents and Settings\Jared Goodman\Desktop\golf-club-at-chelsea-piers-new-york-city-1.pdf
[2011/06/02 10:43:20 | 000,006,413 | —- | C] () – C:\Documents and Settings\Jared Goodman\Desktop\Qualifications.pdf
[2011/06/02 10:42:58 | 000,014,743 | —- | C] () – C:\Documents and Settings\Jared Goodman\Desktop\JOB.pdf
[2011/03/14 10:44:32 | 000,000,090 | —- | C] () – C:\WINDOWS\QBChanUtil_Trigger.ini
[2010/06/30 09:11:38 | 000,000,056 | —- | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/02/20 23:29:04 | 000,045,984 | —- | C] () – C:\WINDOWS\System32\mlfcache.dat
[2010/02/13 23:12:50 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4906.dll
[2010/02/13 23:12:41 | 000,001,746 | —- | C] () – C:\WINDOWS\Language_trs.ini
[2010/02/13 12:55:39 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/08/12 03:12:32 | 000,162,304 | —- | C] () – C:\WINDOWS\System32\ztvunrar36.dll
[2009/08/12 03:12:32 | 000,153,088 | —- | C] () – C:\WINDOWS\System32\unrar3.dll
[2009/08/12 03:12:32 | 000,077,312 | —- | C] () – C:\WINDOWS\System32\ztvunace26.dll
[2009/08/12 03:12:32 | 000,075,264 | —- | C] () – C:\WINDOWS\System32\unacev2.dll
[2009/08/11 14:55:43 | 000,016,395 | —- | C] () – C:\WINDOWS\System32\ilifyteda.exe
[2009/08/11 14:55:43 | 000,012,327 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\xocyd._sy
[2009/08/11 14:55:43 | 000,012,061 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\hydy.bat
[2009/08/11 14:55:43 | 000,011,805 | —- | C] () – C:\WINDOWS\icafuqafoz.com
[2009/08/11 14:55:43 | 000,010,245 | —- | C] () – C:\WINDOWS\System32\pekujuse.exe
[2009/08/11 14:55:43 | 000,010,211 | —- | C] () – C:\WINDOWS\System32\itocu.dat
[2009/08/11 14:55:42 | 000,019,551 | —- | C] () – C:\Program Files\Common Files\nowylibura.lib
[2009/08/11 14:55:42 | 000,019,312 | —- | C] () – C:\Program Files\Common Files\nusojofy.exe
[2009/08/11 14:55:42 | 000,017,513 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\adikakeka.db
[2009/08/11 14:55:42 | 000,016,794 | —- | C] () – C:\Program Files\Common Files\kuji.dll
[2009/08/11 14:55:42 | 000,016,714 | —- | C] () – C:\Documents and Settings\All Users\Application Data\ejako.ban
[2009/08/11 14:55:42 | 000,016,054 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\sojoq.bat
[2009/08/11 14:55:42 | 000,015,083 | —- | C] () – C:\WINDOWS\igymax.com
[2009/08/11 14:55:42 | 000,014,116 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\robuqywuk.ban
[2009/08/11 14:55:42 | 000,013,107 | —- | C] () – C:\Documents and Settings\All Users\Application Data\lowenyp.lib
[2009/08/11 14:55:41 | 000,010,189 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\fulyjug.dll
[2009/08/11 14:42:02 | 000,019,435 | —- | C] () – C:\Program Files\Common Files\sovacyl.exe
[2009/08/11 14:42:02 | 000,017,516 | —- | C] () – C:\Program Files\Common Files\ofolahax.reg
[2009/08/11 14:42:02 | 000,017,475 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\zakynoz.dll
[2009/08/11 14:42:02 | 000,017,129 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\hanezo.exe
[2009/08/11 14:42:02 | 000,016,084 | —- | C] () – C:\WINDOWS\System32\iwoximyd.com
[2009/08/11 14:42:02 | 000,016,013 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\oxeler.exe
[2009/08/11 14:42:02 | 000,015,565 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\ehunicoxu.dat
[2009/08/11 14:42:02 | 000,014,846 | —- | C] () – C:\Program Files\Common Files\ofyxunuz.dl
[2009/08/11 14:42:02 | 000,014,752 | —- | C] () – C:\WINDOWS\System32\ykag.exe
[2009/08/11 14:42:02 | 000,010,064 | —- | C] () – C:\Documents and Settings\All Users\Application Data\dowy.bat
[2009/08/11 13:43:18 | 000,019,524 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\ypysyn.dat
[2009/08/11 13:43:18 | 000,019,470 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\ufajicu.inf
[2009/08/11 13:43:18 | 000,018,288 | —- | C] () – C:\WINDOWS\System32\padizep.sys
[2009/08/11 13:43:18 | 000,018,178 | —- | C] () – C:\Program Files\Common Files\vuzumuhap.sys
[2009/08/11 13:43:18 | 000,017,569 | —- | C] () – C:\WINDOWS\ysimab.bin
[2009/08/11 13:43:18 | 000,016,856 | —- | C] () – C:\Program Files\Common Files\ikytuka.db
[2009/08/11 13:43:18 | 000,016,355 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\lizocalazo.reg
[2009/08/11 13:43:18 | 000,014,138 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\yquvuwy.dl
[2009/08/11 13:43:18 | 000,013,884 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\itocudu.ban
[2009/08/11 13:43:18 | 000,013,506 | —- | C] () – C:\WINDOWS\xoqy.bin
[2009/08/11 13:43:18 | 000,013,034 | —- | C] () – C:\WINDOWS\System32\nygimeguz.dll
[2009/08/11 13:43:18 | 000,010,388 | —- | C] () – C:\Program Files\Common Files\ebifuvimyg.bat
[2009/08/10 14:33:54 | 000,019,982 | —- | C] () – C:\WINDOWS\hajo.bin
[2009/08/10 14:33:54 | 000,019,386 | —- | C] () – C:\Program Files\Common Files\xapirija._sy
[2009/08/10 14:33:54 | 000,019,041 | —- | C] () – C:\Program Files\Common Files\zejagexa.com
[2009/08/10 14:33:54 | 000,017,636 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\mizokumy.sys
[2009/08/10 14:33:54 | 000,016,503 | —- | C] () – C:\Program Files\Common Files\miwehyko.exe
[2009/08/10 14:33:54 | 000,015,662 | —- | C] () – C:\Program Files\Common Files\imymynonym.scr
[2009/08/10 14:33:54 | 000,014,407 | —- | C] () – C:\WINDOWS\widy.dat
[2009/08/10 14:33:54 | 000,014,343 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\tevew.bat
[2009/08/10 14:33:54 | 000,013,668 | —- | C] () – C:\Program Files\Common Files\xikyburivo.lib
[2009/08/10 14:33:54 | 000,013,463 | —- | C] () – C:\Program Files\Common Files\exepub.sys
[2009/08/10 14:33:54 | 000,013,313 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\luto.bin
[2009/08/10 14:33:54 | 000,013,148 | —- | C] () – C:\Documents and Settings\All Users\Application Data\sulaci.bin
[2009/08/10 14:33:54 | 000,012,794 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\ynipi.bat
[2009/08/10 14:33:54 | 000,010,023 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\kyqyroloqa.vbs
[2009/08/08 04:27:15 | 000,019,679 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\qikulyc.lib
[2009/08/08 04:27:15 | 000,018,475 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\acahinu.pif
[2009/08/08 04:27:15 | 000,018,390 | —- | C] () – C:\WINDOWS\imil.exe
[2009/08/08 04:27:15 | 000,018,175 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\usij.dll
[2009/08/08 04:27:15 | 000,017,863 | —- | C] () – C:\WINDOWS\System32\utabi.bin
[2009/08/08 04:27:15 | 000,017,736 | —- | C] () – C:\Program Files\Common Files\nifev.scr
[2009/08/08 04:27:15 | 000,017,018 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\ixew.dat
[2009/08/08 04:27:15 | 000,016,937 | —- | C] () – C:\Program Files\Common Files\quhoz.inf
[2009/08/08 04:27:15 | 000,016,904 | —- | C] () – C:\Documents and Settings\All Users\Application Data\okijylov.exe
[2009/08/08 04:27:15 | 000,016,415 | —- | C] () – C:\Program Files\Common Files\uhaxew.sys
[2009/08/08 04:27:15 | 000,015,742 | —- | C] () – C:\WINDOWS\kibereb.sys
[2009/08/08 04:27:15 | 000,015,725 | —- | C] () – C:\Documents and Settings\All Users\Application Data\azevitedek._dl
[2009/08/08 04:27:15 | 000,015,009 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\zuju.dll
[2009/08/08 04:27:15 | 000,014,883 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\hoviwapyc.dl
[2009/08/08 04:27:15 | 000,014,355 | —- | C] () – C:\WINDOWS\ifuf.dll
[2009/08/08 04:27:15 | 000,014,075 | —- | C] () – C:\Documents and Settings\All Users\Application Data\ysuxawy.dll
[2009/08/08 04:27:15 | 000,014,041 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\upekugirep.dl
[2009/08/08 04:27:15 | 000,012,904 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\qami._dl
[2009/08/08 04:27:15 | 000,011,254 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\geriv.exe
[2009/08/08 04:27:15 | 000,010,196 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\jyxul.bat
[2009/08/08 04:27:15 | 000,010,066 | —- | C] () – C:\Program Files\Common Files\ahykove.dll
[2009/08/08 03:40:45 | 000,019,136 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\nehyhip.lib
[2009/08/08 03:40:45 | 000,019,059 | —- | C] () – C:\Program Files\Common Files\gaka.reg
[2009/08/08 03:40:45 | 000,016,408 | —- | C] () – C:\Program Files\Common Files\ureky.db
[2009/08/08 03:40:45 | 000,015,204 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\nuti.pif
[2009/08/08 03:40:45 | 000,014,983 | —- | C] () – C:\Documents and Settings\All Users\Application Data\gopa.dl
[2009/08/08 03:40:45 | 000,014,921 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hyruhyrexe._sy
[2009/08/08 03:40:45 | 000,013,295 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\pipox._dl
[2009/08/08 03:40:44 | 000,018,648 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\ciwywoce.ban
[2009/08/08 03:40:44 | 000,018,626 | —- | C] () – C:\Documents and Settings\All Users\Application Data\wimit.sys
[2009/08/08 03:40:44 | 000,016,453 | —- | C] () – C:\WINDOWS\ivinerotov.sys
[2009/08/08 03:40:44 | 000,015,540 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\bogi.bat
[2009/08/08 03:40:44 | 000,014,074 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\lede.exe
[2009/08/08 03:40:44 | 000,010,397 | —- | C] () – C:\Documents and Settings\Jared Goodman\Application Data\aropaj.dl
[2009/08/07 19:32:13 | 000,017,430 | —- | C] () – C:\Documents and Settings\All Users\Application Data\uroqek.pif
[2009/08/07 19:32:13 | 000,017,017 | —- | C] () – C:\Documents and Settings\All Users\Application Data\uzilyfa.vbs
[2009/08/07 19:32:13 | 000,015,161 | —- | C] () – C:\WINDOWS\System32\ulawonek.dat
[2009/08/07 19:32:13 | 000,014,559 | —- | C] () – C:\WINDOWS\System32\tyrubah.exe
[2009/08/07 19:32:13 | 000,013,741 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\cikijosa.exe
[2009/08/07 19:32:13 | 000,012,591 | —- | C] () – C:\Documents and Settings\All Users\Application Data\ynicu.db
[2009/08/07 19:32:13 | 000,011,899 | —- | C] () – C:\Documents and Settings\All Users\Application Data\muxuxike.scr
[2009/08/07 19:32:13 | 000,011,565 | —- | C] () – C:\Documents and Settings\All Users\Application Data\xelysuxa.db
[2009/07/20 12:18:15 | 000,019,968 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/07/08 21:25:26 | 000,000,746 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2009/07/08 21:25:26 | 000,000,094 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2009/07/08 21:25:08 | 000,000,419 | —- | C] () – C:\WINDOWS\BRWMARK.INI
[2009/07/08 21:25:08 | 000,000,027 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2009/07/08 21:24:10 | 000,000,050 | —- | C] () – C:\WINDOWS\System32\bridf08b.dat
[2009/07/08 21:23:57 | 000,000,086 | —- | C] () – C:\WINDOWS\Brfaxrx.ini
[2009/07/08 21:23:56 | 000,000,000 | —- | C] () – C:\WINDOWS\brdfxspd.dat
[2009/07/08 21:23:55 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\BrMuSNMP.dll
[2009/03/11 18:00:09 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2009/03/11 13:42:34 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/03/11 03:56:25 | 000,000,280 | —- | C] () – C:\WINDOWS\System32\epoPGPsdk.dll.sig
[2009/03/11 03:41:05 | 000,000,136 | —- | C] () – C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\fusioncache.dat
[2009/01/09 02:50:28 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2009/01/09 02:45:25 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/01/09 01:31:17 | 000,005,312 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2009/01/09 01:31:07 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2009/01/09 01:31:06 | 000,445,164 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2009/01/09 01:31:06 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2009/01/09 01:31:06 | 000,072,708 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2009/01/09 01:31:06 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2009/01/09 01:31:05 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2009/01/09 01:31:05 | 000,004,562 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2009/01/09 01:31:05 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2009/01/09 01:31:03 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2009/01/09 01:31:03 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2009/01/09 01:31:01 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2009/01/09 01:30:59 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2009/01/08 18:38:45 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2009/01/08 18:37:48 | 000,218,448 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/01/08 06:15:39 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2009/01/08 05:12:53 | 000,000,520 | —- | C] () – C:\WINDOWS\System32\drivers\SamSfPa.dat
[2009/01/08 04:50:39 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2009/01/08 04:50:39 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2009/01/08 04:50:39 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2009/01/08 04:50:39 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2009/01/08 04:50:39 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2009/01/08 04:50:39 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2008/11/14 19:12:56 | 000,012,208 | —- | C] () – C:\WINDOWS\AsTrayLang.ini
[2008/09/02 08:25:26 | 002,854,912 | —- | C] () – C:\WINDOWS\System32\btwicons.dll
[2008/08/27 23:10:24 | 000,000,173 | —- | C] () – C:\WINDOWS\explorer.exe.config
[2008/07/30 20:31:52 | 000,021,864 | —- | C] () – C:\WINDOWS\AsAcpiSvrLang.ini
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2001/11/14 14:56:00 | 001,802,240 | —- | C] () – C:\WINDOWS\System32\lcppn21.dll

========== Custom Scans ==========

< >

< %SYSTEMDRIVE%\*.* >
[2009/01/09 02:47:53 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2009/08/11 14:32:48 | 000,000,211 | —- | M] () – C:\Boot.bak
[2009/08/13 12:51:02 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | —- | M] () – C:\cmldr
[2009/08/13 13:04:17 | 000,023,935 | —- | M] () – C:\ComboFix.txt
[2009/01/09 02:47:53 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2009/01/09 02:47:53 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/08/16 15:25:54 | 000,000,460 | —- | M] () – C:\IPH.PH
[2009/01/09 02:47:53 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2008/04/14 08:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/04/14 08:00:00 | 000,250,048 | RHS- | M] () – C:\ntldr
[2009/08/09 16:43:50 | 000,002,968 | —- | M] () – C:\report.txt
[2009/08/12 13:13:31 | 000,011,736 | —- | M] () – C:\RootRepeal report 08-12-09 (13-13-31).txt
[2009/08/13 11:25:55 | 000,004,184 | —- | M] () – C:\RootRepeal report 08-13-09 (11-25-55).txt
[2009/08/13 11:44:42 | 000,001,702 | —- | M] () – C:\RootRepeal report 08-13-09 (11-44-42).txt
[2009/11/28 01:50:47 | 000,000,016 | —- | M] () – C:\RootRepeal report 11-28-09 (00-50-47).txt

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/01/09 02:47:17 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2007/04/09 13:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 06:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2009/08/08 03:40:44 | 000,016,875 | —- | M] () – C:\WINDOWS\olyrofena.scr
[2009/08/10 14:33:54 | 000,015,393 | —- | M] () – C:\WINDOWS\tyliju.scr
[2009/08/11 14:55:43 | 000,018,160 | —- | M] () – C:\WINDOWS\uzec.scr
[2009/08/08 04:27:15 | 000,014,951 | —- | M] () – C:\WINDOWS\ycoqopaqu.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2009/05/03 23:59:04 | 000,001,754 | —- | M] () – C:\Documents and Settings\Jared Goodman\Application Data\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >
[2008/05/07 04:34:00 | 015,523,560 | —- | M] (Macrovision Corporation) – C:\Program Files\U1 Setup.exe

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2009/01/08 18:37:23 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2009/01/08 18:37:23 | 001,064,960 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2009/01/08 18:37:23 | 000,909,312 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >
[2008/08/27 23:10:24 | 000,000,173 | —- | M] () – C:\WINDOWS\explorer.exe.config

< %systemroot%\system32\*.db >
[2008/06/25 07:18:46 | 000,004,608 | —- | M] () – C:\WINDOWS\system32\THUMBS.DB
[2009/08/08 04:27:15 | 000,013,770 | —- | M] () – C:\WINDOWS\system32\xirivu.db
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/01/09 02:51:54 | 000,000,079 | —- | M] () – C:\Documents and Settings\Jared Goodman\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/06/07 11:44:55 | 005,568,944 | —- | M] (AVG Technologies) – C:\Documents and Settings\Jared Goodman\Desktop\avg_free_stb_all_2011_1382_cnet.exe
[2011/06/07 22:54:34 | 000,050,477 | —- | M] () – C:\Documents and Settings\Jared Goodman\Desktop\Defogger.exe
[2011/06/07 23:10:10 | 000,302,592 | —- | M] () – C:\Documents and Settings\Jared Goodman\Desktop\EHZ3HXFQ.EXE
[2011/06/07 20:11:59 | 009,435,312 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Jared Goodman\Desktop\mbam-setup-1.51.0.1200.exe
[2011/06/09 10:43:42 | 000,580,096 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Jared Goodman\Desktop\OTL.exe
[2011/06/09 10:31:34 | 000,606,105 | —- | M] () – C:\Documents and Settings\Jared Goodman\Desktop\unhide.exe
[11 C:\Documents and Settings\Jared Goodman\Desktop\*.tmp files -> C:\Documents and Settings\Jared Goodman\Desktop\*.tmp -> ]

< %PROGRAMFILES%\Common Files\*.* >
[2009/08/08 04:27:15 | 000,010,066 | —- | M] () – C:\Program Files\Common Files\ahykove.dll
[2009/08/11 13:43:18 | 000,010,388 | —- | M] () – C:\Program Files\Common Files\ebifuvimyg.bat
[2009/08/10 14:33:54 | 000,013,463 | —- | M] () – C:\Program Files\Common Files\exepub.sys
[2009/08/08 03:40:45 | 000,019,059 | —- | M] () – C:\Program Files\Common Files\gaka.reg
[2009/08/11 13:43:18 | 000,016,856 | —- | M] () – C:\Program Files\Common Files\ikytuka.db
[2009/08/10 14:33:54 | 000,015,662 | —- | M] () – C:\Program Files\Common Files\imymynonym.scr
[2009/08/11 14:55:42 | 000,016,794 | —- | M] () – C:\Program Files\Common Files\kuji.dll
[2009/08/10 14:33:54 | 000,016,503 | —- | M] () – C:\Program Files\Common Files\miwehyko.exe
[2009/08/08 04:27:15 | 000,017,736 | —- | M] () – C:\Program Files\Common Files\nifev.scr
[2009/08/11 14:55:42 | 000,019,551 | —- | M] () – C:\Program Files\Common Files\nowylibura.lib
[2009/08/11 14:55:42 | 000,019,312 | —- | M] () – C:\Program Files\Common Files\nusojofy.exe
[2009/08/11 14:42:02 | 000,017,516 | —- | M] () – C:\Program Files\Common Files\ofolahax.reg
[2009/08/11 14:42:02 | 000,014,846 | —- | M] () – C:\Program Files\Common Files\ofyxunuz.dl
[2009/08/08 04:27:15 | 000,016,937 | —- | M] () – C:\Program Files\Common Files\quhoz.inf
[2009/08/11 14:42:02 | 000,019,435 | —- | M] () – C:\Program Files\Common Files\sovacyl.exe
[2009/08/08 04:27:15 | 000,016,415 | —- | M] () – C:\Program Files\Common Files\uhaxew.sys
[2009/08/08 03:40:45 | 000,016,408 | —- | M] () – C:\Program Files\Common Files\ureky.db
[2009/08/11 13:43:18 | 000,018,178 | —- | M] () – C:\Program Files\Common Files\vuzumuhap.sys
[2009/08/10 14:33:54 | 000,019,386 | —- | M] () – C:\Program Files\Common Files\xapirija._sy
[2009/08/10 14:33:54 | 000,013,668 | —- | M] () – C:\Program Files\Common Files\xikyburivo.lib
[2009/08/10 14:33:54 | 000,019,041 | —- | M] () – C:\Program Files\Common Files\zejagexa.com

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-06-03 14:36:59

========== Alternate Data Streams ==========

@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

< End of report >

Extras:

OTL Extras logfile created on: 6/9/2011 10:45:01 AM - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Jared Goodman\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.07 Gb Available Physical Memory | 53.93% Memory free
1.84 Gb Paging File | 1.14 Gb Available in Paging File | 62.10% Paging File free
Paging file location(s): [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 82.82 Gb Total Space | 27.14 Gb Free Space | 32.77% Space Free | Partition Type: NTFS
Drive D: | 61.29 Gb Total Space | 61.16 Gb Free Space | 99.78% Space Free | Partition Type: NTFS

Computer Name: GOODMAN_NY | User Name: Jared Goodman | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"54925:UDP" = 54925:UDP:*:Disabled:BrotherNetwork Scanner
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
"C:\Program Files\Windows Live\Messenger\livecall.exe" = C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AVG\AVG8\avgnsx.exe" = C:\Program Files\AVG\AVG8\avgnsx.exe:*:Disabled:avgnsx.exe
"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Disabled:avgupd.exe
"C:\Program Files\Brother\Brmfl08b\FAXRX.exe" = C:\Program Files\Brother\Brmfl08b\FAXRX.exe:*:Disabled:FAXRX.EXE – ()
"C:\Program Files\McAfee\Common Framework\FrameworkService.exe" = C:\Program Files\McAfee\Common Framework\FrameworkService.exe:*:Disabled:McAfee Framework Service – (McAfee, Inc.)
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader
"C:\Program Files\AIM6\aim6.exe" = C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM
"C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe" = C:\Documents and Settings\Jared Goodman\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin – (Google)
"C:\Program Files\AVG\AVG10\avgnsx.exe" = C:\Program Files\AVG\AVG10\avgnsx.exe:*:Enabled:Online Shield – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG10\avgmfapx.exe" = C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:AVG Installer – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG10\avgemcx.exe" = C:\Program Files\AVG\AVG10\avgemcx.exe:*:Enabled:Personal E-mail Scanner – (AVG Technologies CZ, s.r.o.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{184E7118-0295-43C4-B72C-1D54AA75AAF7}" = Windows Live Mail
"{19F5658D-92E8-4A08-8657-D38ABB1574B2}" = Asus ACPI Driver
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{23DA4222-E517-42B3-8F97-9CFD49E2A732}" = AVG 2011
"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java™ 6 Update 15
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.® AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35C03C04-3F1F-42C2-A989-A757EE691F65}" = McAfee VirusScan Enterprise
"{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}" = McAfee SiteAdvisor
"{388E4B09-3E71-4649-8921-F44A3A2954A7}" = Microsoft Visual Studio 2005 Tools for Office Runtime
"{3D9892BB-A751-4E48-ADC8-E4289956CE1D}" = QuickTime
"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate for Eee PC
"{69333A04-5134-40A5-A055-9166A7AA1EC8}" =
"{6E4DAE31-7CF3-441A-B6E5-B014D63C80CD}" = Eee Instant Key
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{88F08F98-12BC-4613-81A2-8F9B88CFC73E}" = Super Hybrid Engine
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}" = Azurewave Wireless LAN
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{91490409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Primary Interop Assemblies
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{91D2C605-AD2B-44C8-A0A1-9B116B3C91CB}" = AVG 2011
"{91F7F3F3-CE80-48C3-8327-7D24A0A5716A}" = iTunes
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.4
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF0EDB56-BBF6-3C9F-9C50-2E3B3D444641}" = Google Talk Plugin
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{D547A594-AA85-4B92-80EB-47B371B98C68}" = Verizon Download Manager
"{D9461574-5FC0-4641-BBDC-D1038B196F55}" = Brother MFL-Pro Suite MFC-490CW
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F18DB86D-BC16-4E01-BCCE-63F62B931D82}" = InterVideo Register Manager
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AVG" = AVG 2011
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"Eee Storage" = Eee Storage 1.2.16.309
"eMusic Download Manager" = eMusic Download Manager 4.1.4
"HDMI" = Intel® Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.0.1200
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Visual Studio 2005 Tools for Office Runtime" = Microsoft Visual Studio 2005 Tools for Office Runtime
"Mozilla Firefox (3.6.17)" = Mozilla Firefox (3.6.17)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Picasa 3" = Picasa 3
"SpywareBlaster_is1" = SpywareBlaster 4.2
"ViewpointMediaPlayer" = Viewpoint Media Player
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

Gmer:

GMER 1.0.15.15640 - http://www.gmer.net
Rootkit scan 2011-06-09 14:26:15
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 ST9160310AS rev.0303
Running: EHZ3HXFQ.EXE; Driver: C:\DOCUME~1\JAREDG~1\LOCALS~1\Temp\awloifob.sys

—- System - GMER 1.0.15 —-

SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xBA4B1738]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xBA4B17DC]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xBA4B1878]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xBA4B1914]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xA76C5ABB]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateKey [0xA76C5A3B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xA76C5AE5]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xA76C5A4F]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xA76C5A7B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xA76C5B0F]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xA76C5A27]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xA76C5ACF]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xA76C5A65]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetValueKey [0xA76C5A91]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xA76C5B25]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xA76C5AF9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwYieldExecution 80504B08 7 Bytes JMP A76C5AFD \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtCreateFile 805790A8 5 Bytes JMP A76C5ABF \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtMapViewOfSection 805B203A 7 Bytes JMP A76C5B13 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwUnmapViewOfSection 805B2E48 5 Bytes JMP A76C5B29 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwProtectVirtualMemory 805B841E 7 Bytes JMP A76C5AD3 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwCreateProcess 805D1230 5 Bytes JMP A76C5AE9 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwSetValueKey 80622662 7 Bytes JMP A76C5A95 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwRenameKey 80623B12 7 Bytes JMP A76C5A69 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwCreateKey 806240F0 5 Bytes JMP A76C5A3F \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwDeleteKey 8062458C 7 Bytes JMP A76C5A53 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwDeleteValueKey 8062475C 7 Bytes JMP A76C5A7F \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwOpenKey 806254CE 5 Bytes JMP A76C5A2B \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
? C:\DOCUME~1\JAREDG~1\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\system32\services.exe[996] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00D50000
.text C:\WINDOWS\system32\services.exe[996] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00D50082
.text C:\WINDOWS\system32\services.exe[996] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00D50F97
.text C:\WINDOWS\system32\services.exe[996] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00D50FA8
.text C:\WINDOWS\system32\services.exe[996] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00D50065
.text C:\WINDOWS\system32\services.exe[996] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00D50039
.text C:\WINDOWS\system32\services.exe[996] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00D50F66
.text C:\WINDOWS\system32\services.exe[996] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00D500AE
.text C:\WINDOWS\system32\services.exe[996] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00D50F44
.text C:\WINDOWS\system32\services.exe[996] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00D50F55
.text C:\WINDOWS\system32\services.exe[996] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00D50F29
.text C:\WINDOWS\system32\services.exe[996] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00D5004A
.text C:\WINDOWS\system32\services.exe[996] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00D50FEF
.text C:\WINDOWS\system32\services.exe[996] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00D5009D
.text C:\WINDOWS\system32\services.exe[996] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00D50FC3
.text C:\WINDOWS\system32\services.exe[996] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00D50FDE
.text C:\WINDOWS\system32\services.exe[996] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00D500C9
.text C:\WINDOWS\system32\services.exe[996] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00070036
.text C:\WINDOWS\system32\services.exe[996] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00070FB6
.text C:\WINDOWS\system32\services.exe[996] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0007001B
.text C:\WINDOWS\system32\services.exe[996] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0007000A
.text C:\WINDOWS\system32\services.exe[996] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00070073
.text C:\WINDOWS\system32\services.exe[996] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00070FEF
.text C:\WINDOWS\system32\services.exe[996] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00070062
.text C:\WINDOWS\system32\services.exe[996] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00070047
.text C:\WINDOWS\system32\services.exe[996] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 0006005A
.text C:\WINDOWS\system32\services.exe[996] msvcrt.dll!system 77C293C7 5 Bytes JMP 00060049
.text C:\WINDOWS\system32\services.exe[996] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 0006001D
.text C:\WINDOWS\system32\services.exe[996] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00060FEF
.text C:\WINDOWS\system32\services.exe[996] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00060038
.text C:\WINDOWS\system32\services.exe[996] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0006000C
.text C:\WINDOWS\system32\services.exe[996] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00050000
.text C:\WINDOWS\system32\lsass.exe[1008] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00FD0FEF
.text C:\WINDOWS\system32\lsass.exe[1008] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00FD0F44
.text C:\WINDOWS\system32\lsass.exe[1008] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00FD0F5F
.text C:\WINDOWS\system32\lsass.exe[1008] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00FD0F70
.text C:\WINDOWS\system32\lsass.exe[1008] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00FD0F8D
.text C:\WINDOWS\system32\lsass.exe[1008] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00FD0FAF
.text C:\WINDOWS\system32\lsass.exe[1008] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00FD0F16
.text C:\WINDOWS\system32\lsass.exe[1008] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00FD0F33
.text C:\WINDOWS\system32\lsass.exe[1008] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00FD0EE0
.text C:\WINDOWS\system32\lsass.exe[1008] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00FD0EF1
.text C:\WINDOWS\system32\lsass.exe[1008] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00FD008A
.text C:\WINDOWS\system32\lsass.exe[1008] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00FD0F9E
.text C:\WINDOWS\system32\lsass.exe[1008] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00FD0000
.text C:\WINDOWS\system32\lsass.exe[1008] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00FD005E
.text C:\WINDOWS\system32\lsass.exe[1008] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00FD001B
.text C:\WINDOWS\system32\lsass.exe[1008] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00FD0FCA
.text C:\WINDOWS\system32\lsass.exe[1008] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00FD0079
.text C:\WINDOWS\system32\lsass.exe[1008] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00FC0FCD
.text C:\WINDOWS\system32\lsass.exe[1008] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00FC0FA1
.text C:\WINDOWS\system32\lsass.exe[1008] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00FC0014
.text C:\WINDOWS\system32\lsass.exe[1008] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00FC0FDE
.text C:\WINDOWS\system32\lsass.exe[1008] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00FC0054
.text C:\WINDOWS\system32\lsass.exe[1008] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00FC0FEF
.text C:\WINDOWS\system32\lsass.exe[1008] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00FC0039
.text C:\WINDOWS\system32\lsass.exe[1008] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00FC0FB2
.text C:\WINDOWS\system32\lsass.exe[1008] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00FB0036
.text C:\WINDOWS\system32\lsass.exe[1008] msvcrt.dll!system 77C293C7 5 Bytes JMP 00FB0FAB
.text C:\WINDOWS\system32\lsass.exe[1008] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00FB0FD7
.text C:\WINDOWS\system32\lsass.exe[1008] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00FB0000
.text C:\WINDOWS\system32\lsass.exe[1008] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00FB0FBC
.text C:\WINDOWS\system32\lsass.exe[1008] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00FB0011
.text C:\WINDOWS\system32\lsass.exe[1008] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00FA0000
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00F8000A
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00F800AE
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00F80093
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00F80076
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00F80FC3
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00F80FD4
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00F800EB
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00F800DA
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00F80121
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00F80106
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00F80132
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00F80065
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00F8001B
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00F800BF
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00F80040
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00F80FEF
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00F80F88
.text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00F70025
.text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00F7006C
.text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00F7000A
.text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00F70FD4
.text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00F7005B
.text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00F70FE5
.text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00F70FAF
.text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [17, 89]
.text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00F70036
.text C:\WINDOWS\system32\svchost.exe[1176] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00F60F86
.text C:\WINDOWS\system32\svchost.exe[1176] msvcrt.dll!system 77C293C7 5 Bytes JMP 00F60F97
.text C:\WINDOWS\system32\svchost.exe[1176] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00F60FCD
.text C:\WINDOWS\system32\svchost.exe[1176] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00F60FEF
.text C:\WINDOWS\system32\svchost.exe[1176] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00F60FBC
.text C:\WINDOWS\system32\svchost.exe[1176] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00F60FDE
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00F5000A
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00DD000A
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00DD0FC0
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00DD00BF
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00DD00A4
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00DD007D
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00DD0062
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00DD00DC
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00DD0F94
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00DD0112
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00DD0F79
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00DD0123
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00DD0FDB
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00DD001B
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00DD0FA5
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00DD0051
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00DD0036
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00DD00ED
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00DC0FCA
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00DC0F8A
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00DC0FE5
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00DC0011
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00DC0051
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00DC0000
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00DC0036
.text C:\WINDOWS\system32\svchost.exe[1244] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00DC0FB9
.text C:\WINDOWS\system32\svchost.exe[1244] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00DB0FAD
.text C:\WINDOWS\system32\svchost.exe[1244] msvcrt.dll!system 77C293C7 5 Bytes JMP 00DB0038
.text C:\WINDOWS\system32\svchost.exe[1244] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00DB0FD9
.text C:\WINDOWS\system32\svchost.exe[1244] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00DB0000
.text C:\WINDOWS\system32\svchost.exe[1244] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00DB0FC8
.text C:\WINDOWS\system32\svchost.exe[1244] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00DB001D
.text C:\WINDOWS\system32\svchost.exe[1244] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00DA0FEF
.text C:\WINDOWS\System32\svchost.exe[1352] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 03E10FEF
.text C:\WINDOWS\System32\svchost.exe[1352] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 03E1004A
.text C:\WINDOWS\System32\svchost.exe[1352] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 03E10F55
.text C:\WINDOWS\System32\svchost.exe[1352] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 03E10F66
.text C:\WINDOWS\System32\svchost.exe[1352] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 03E10F83
.text C:\WINDOWS\System32\svchost.exe[1352] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 03E10FB9
.text C:\WINDOWS\System32\svchost.exe[1352] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 03E10082
.text C:\WINDOWS\System32\svchost.exe[1352] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 03E10F3A
.text C:\WINDOWS\System32\svchost.exe[1352] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 03E100C9
.text C:\WINDOWS\System32\svchost.exe[1352] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 03E100B8
.text C:\WINDOWS\System32\svchost.exe[1352] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 03E10F15
.text C:\WINDOWS\System32\svchost.exe[1352] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 03E10F9E
.text C:\WINDOWS\System32\svchost.exe[1352] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 03E10014
.text C:\WINDOWS\System32\svchost.exe[1352] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 03E1005B
.text C:\WINDOWS\System32\svchost.exe[1352] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 03E10025
.text C:\WINDOWS\System32\svchost.exe[1352] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 03E10FDE
.text C:\WINDOWS\System32\svchost.exe[1352] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 03E1009D
.text C:\WINDOWS\System32\svchost.exe[1352] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 03D8003D
.text C:\WINDOWS\System32\svchost.exe[1352] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 03D8008E
.text C:\WINDOWS\System32\svchost.exe[1352] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 03D8002C
.text C:\WINDOWS\System32\svchost.exe[1352] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 03D80011
.text C:\WINDOWS\System32\svchost.exe[1352] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 03D80073
.text C:\WINDOWS\System32\svchost.exe[1352] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 03D80000
.text C:\WINDOWS\System32\svchost.exe[1352] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 03D80FD1
.text C:\WINDOWS\System32\svchost.exe[1352] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [F8, 8B]
.text C:\WINDOWS\System32\svchost.exe[1352] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 03D80058
.text C:\WINDOWS\System32\svchost.exe[1352] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 03D70042
.text C:\WINDOWS\System32\svchost.exe[1352] msvcrt.dll!system 77C293C7 5 Bytes JMP 03D70027
.text C:\WINDOWS\System32\svchost.exe[1352] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 03D7000C
.text C:\WINDOWS\System32\svchost.exe[1352] msvcrt.dll!_open 77C2F566 5 Bytes JMP 03D70FEF
.text C:\WINDOWS\System32\svchost.exe[1352] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 03D70FB7
.text C:\WINDOWS\System32\svchost.exe[1352] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 03D70FDE
.text C:\WINDOWS\System32\svchost.exe[1352] WS2_32.dll!socket 71AB4211 5 Bytes JMP 03D60000
.text C:\WINDOWS\System32\svchost.exe[1352] WININET.dll!InternetOpenA 3D953081 5 Bytes JMP 032F0FE5
.text C:\WINDOWS\System32\svchost.exe[1352] WININET.dll!InternetOpenW 3D9536B1 5 Bytes JMP 032F0FCA
.text C:\WINDOWS\System32\svchost.exe[1352] WININET.dll!InternetOpenUrlA 3D956F5A 5 Bytes JMP 032F0FAF
.text C:\WINDOWS\System32\svchost.exe[1352] WININET.dll!InternetOpenUrlW 3D998471 5 Bytes JMP 032F000A
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 01890FEF
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 01890F7B
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 01890F96
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 01890070
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 0189005F
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0189003D
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 01890F3B
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 01890081
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 01890F08
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 01890F19
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 01890EF7
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 0189004E
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 01890000
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 01890F56
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 0189002C
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 01890011
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 01890F2A
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 011F0014
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 011F004D
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 011F0FC3
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 011F0FD4
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 011F0F90
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 011F0FEF
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 011F0FA1
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [3F, 89]
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 011F0FB2
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 011E0F9C
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] msvcrt.dll!system 77C293C7 5 Bytes JMP 011E0027
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 011E0FD2
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] msvcrt.dll!_open 77C2F566 5 Bytes JMP 011E0FEF
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 011E0FC1
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 011E0000
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] WS2_32.dll!socket 71AB4211 5 Bytes JMP 011D000A
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] WinInet.dll!InternetOpenA 3D953081 5 Bytes JMP 010E0FEF
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] WinInet.dll!InternetOpenW 3D9536B1 5 Bytes JMP 010E0FD4
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] WinInet.dll!InternetOpenUrlA 3D956F5A 5 Bytes JMP 010E0000
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1380] WinInet.dll!InternetOpenUrlW 3D998471 5 Bytes JMP 010E0FAF
.text C:\WINDOWS\system32\svchost.exe[1468] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00660000
.text C:\WINDOWS\system32\svchost.exe[1468] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00660073
.text C:\WINDOWS\system32\svchost.exe[1468] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00660F7E
.text C:\WINDOWS\system32\svchost.exe[1468] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00660062
.text C:\WINDOWS\system32\svchost.exe[1468] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00660051
.text C:\WINDOWS\system32\svchost.exe[1468] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00660FAF
.text C:\WINDOWS\system32\svchost.exe[1468] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00660F35
.text C:\WINDOWS\system32\svchost.exe[1468] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00660F52
.text C:\WINDOWS\system32\svchost.exe[1468] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00660EF5
.text C:\WINDOWS\system32\svchost.exe[1468] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 0066008E
.text C:\WINDOWS\system32\svchost.exe[1468] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 006600A9
.text C:\WINDOWS\system32\svchost.exe[1468] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00660036
.text C:\WINDOWS\system32\svchost.exe[1468] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00660FEF
.text C:\WINDOWS\system32\svchost.exe[1468] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00660F63
.text C:\WINDOWS\system32\svchost.exe[1468] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00660FCA
.text C:\WINDOWS\system32\svchost.exe[1468] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 0066001B
.text C:\WINDOWS\system32\svchost.exe[1468] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00660F10
.text C:\WINDOWS\system32\svchost.exe[1468] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00650FBC
.text C:\WINDOWS\system32\svchost.exe[1468] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00650032
.text C:\WINDOWS\system32\svchost.exe[1468] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00650FCD
.text C:\WINDOWS\system32\svchost.exe[1468] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00650FDE
.text C:\WINDOWS\system32\svchost.exe[1468] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00650F7F
.text C:\WINDOWS\system32\svchost.exe[1468] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00650FEF
.text C:\WINDOWS\system32\svchost.exe[1468] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00650F90
.text C:\WINDOWS\system32\svchost.exe[1468] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [85, 88]
.text C:\WINDOWS\system32\svchost.exe[1468] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00650FAB
.text C:\WINDOWS\system32\svchost.exe[1468] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00640FC1
.text C:\WINDOWS\system32\svchost.exe[1468] msvcrt.dll!system 77C293C7 5 Bytes JMP 00640FD2
.text C:\WINDOWS\system32\svchost.exe[1468] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 0064002E
.text C:\WINDOWS\system32\svchost.exe[1468] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00640000
.text C:\WINDOWS\system32\svchost.exe[1468] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00640FE3
.text C:\WINDOWS\system32\svchost.exe[1468] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00640011
.text C:\WINDOWS\system32\svchost.exe[1468] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00630000
.text C:\WINDOWS\system32\svchost.exe[1544] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00A50FEF
.text C:\WINDOWS\system32\svchost.exe[1544] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00A50073
.text C:\WINDOWS\system32\svchost.exe[1544] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00A50062
.text C:\WINDOWS\system32\svchost.exe[1544] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00A50F8A
.text C:\WINDOWS\system32\svchost.exe[1544] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00A50047
.text C:\WINDOWS\system32\svchost.exe[1544] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00A5002C
.text C:\WINDOWS\system32\svchost.exe[1544] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00A5008E
.text C:\WINDOWS\system32\svchost.exe[1544] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00A50F46
.text C:\WINDOWS\system32\svchost.exe[1544] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00A50F10
.text C:\WINDOWS\system32\svchost.exe[1544] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00A500B3
.text C:\WINDOWS\system32\svchost.exe[1544] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00A500C4
.text C:\WINDOWS\system32\svchost.exe[1544] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00A50FA5
.text C:\WINDOWS\system32\svchost.exe[1544] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00A50000
.text C:\WINDOWS\system32\svchost.exe[1544] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00A50F63
.text C:\WINDOWS\system32\svchost.exe[1544] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00A50FCA
.text C:\WINDOWS\system32\svchost.exe[1544] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00A5001B
.text C:\WINDOWS\system32\svchost.exe[1544] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00A50F2B
.text C:\WINDOWS\system32\svchost.exe[1544] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00A40022
.text C:\WINDOWS\system32\svchost.exe[1544] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00A40FA2
.text C:\WINDOWS\system32\svchost.exe[1544] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00A40FDB
.text C:\WINDOWS\system32\svchost.exe[1544] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00A40011
.text C:\WINDOWS\system32\svchost.exe[1544] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00A4005F
.text C:\WINDOWS\system32\svchost.exe[1544] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00A40000
.text C:\WINDOWS\system32\svchost.exe[1544] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00A40044
.text C:\WINDOWS\system32\svchost.exe[1544] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00A40033
.text C:\WINDOWS\system32\svchost.exe[1544] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00A30FCA
.text C:\WINDOWS\system32\svchost.exe[1544] msvcrt.dll!system 77C293C7 5 Bytes JMP 00A3005F
.text C:\WINDOWS\system32\svchost.exe[1544] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00A30FEF
.text C:\WINDOWS\system32\svchost.exe[1544] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00A30000
.text C:\WINDOWS\system32\svchost.exe[1544] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00A30044
.text C:\WINDOWS\system32\svchost.exe[1544] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00A3001D
.text C:\WINDOWS\system32\svchost.exe[1544] WS2_32.dll!socket 71AB4211 5 Bytes JMP 006C0FEF
.text C:\WINDOWS\system32\svchost.exe[1896] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C20000
.text C:\WINDOWS\system32\svchost.exe[1896] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C20F81
.text C:\WINDOWS\system32\svchost.exe[1896] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C2006C
.text C:\WINDOWS\system32\svchost.exe[1896] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C2005B
.text C:\WINDOWS\system32\svchost.exe[1896] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C20F9E
.text C:\WINDOWS\system32\svchost.exe[1896] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C20FAF
.text C:\WINDOWS\system32\svchost.exe[1896] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C2009B
.text C:\WINDOWS\system32\svchost.exe[1896] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C20F5F
.text C:\WINDOWS\system32\svchost.exe[1896] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C20F2E
.text C:\WINDOWS\system32\svchost.exe[1896] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C200C7
.text C:\WINDOWS\system32\svchost.exe[1896] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00C20F13
.text C:\WINDOWS\system32\svchost.exe[1896] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00C20036
.text C:\WINDOWS\system32\svchost.exe[1896] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C20FE5
.text C:\WINDOWS\system32\svchost.exe[1896] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00C20F70
.text C:\WINDOWS\system32\svchost.exe[1896] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00C2001B
.text C:\WINDOWS\system32\svchost.exe[1896] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00C20FCA
.text C:\WINDOWS\system32\svchost.exe[1896] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00C200B6
.text C:\WINDOWS\system32\svchost.exe[1896] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00C10FB9
.text C:\WINDOWS\system32\svchost.exe[1896] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00C10F9E
.text C:\WINDOWS\system32\svchost.exe[1896] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00C10FD4
.text C:\WINDOWS\system32\svchost.exe[1896] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00C10FE5
.text C:\WINDOWS\system32\svchost.exe[1896] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00C1005B
.text C:\WINDOWS\system32\svchost.exe[1896] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00C10000
.text C:\WINDOWS\system32\svchost.exe[1896] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00C10040
.text C:\WINDOWS\system32\svchost.exe[1896] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00C1002F
.text C:\WINDOWS\system32\svchost.exe[1896] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00C00FA3
.text C:\WINDOWS\system32\svchost.exe[1896] msvcrt.dll!system 77C293C7 5 Bytes JMP 00C0002E
.text C:\WINDOWS\system32\svchost.exe[1896] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00C00FD2
.text C:\WINDOWS\system32\svchost.exe[1896] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00C00FEF
.text C:\WINDOWS\system32\svchost.exe[1896] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00C0001D
.text C:\WINDOWS\system32\svchost.exe[1896] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00C0000C
.text C:\WINDOWS\system32\svchost.exe[1896] WININET.dll!InternetOpenA 3D953081 5 Bytes JMP 00BE000A
.text C:\WINDOWS\system32\svchost.exe[1896] WININET.dll!InternetOpenW 3D9536B1 5 Bytes JMP 00BE001B
.text C:\WINDOWS\system32\svchost.exe[1896] WININET.dll!InternetOpenUrlA 3D956F5A 5 Bytes JMP 00BE0FDB
.text C:\WINDOWS\system32\svchost.exe[1896] WININET.dll!InternetOpenUrlW 3D998471 5 Bytes JMP 00BE0FCA
.text C:\WINDOWS\system32\svchost.exe[1896] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BF0FEF
.text C:\WINDOWS\Explorer.EXE[2012] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 017C0FEF
.text C:\WINDOWS\Explorer.EXE[2012] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 017C0F8A
.text C:\WINDOWS\Explorer.EXE[2012] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 017C007F
.text C:\WINDOWS\Explorer.EXE[2012] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 017C006E
.text C:\WINDOWS\Explorer.EXE[2012] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 017C0047
.text C:\WINDOWS\Explorer.EXE[2012] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 017C0FA5
.text C:\WINDOWS\Explorer.EXE[2012] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 017C0F48
.text C:\WINDOWS\Explorer.EXE[2012] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 017C0F6F
.text C:\WINDOWS\Explorer.EXE[2012] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 017C00C6
.text C:\WINDOWS\Explorer.EXE[2012] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 017C0F37
.text C:\WINDOWS\Explorer.EXE[2012] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 017C0F08
.text C:\WINDOWS\Explorer.EXE[2012] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 017C0036
.text C:\WINDOWS\Explorer.EXE[2012] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 017C0FDE
.text C:\WINDOWS\Explorer.EXE[2012] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 017C009A
.text C:\WINDOWS\Explorer.EXE[2012] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 017C001B
.text C:\WINDOWS\Explorer.EXE[2012] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 017C000A
.text C:\WINDOWS\Explorer.EXE[2012] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 017C00AB
.text C:\WINDOWS\Explorer.EXE[2012] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 017B001B
.text C:\WINDOWS\Explorer.EXE[2012] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 017B005B
.text C:\WINDOWS\Explorer.EXE[2012] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 017B0FCA
.text C:\WINDOWS\Explorer.EXE[2012] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 017B0FE5
.text C:\WINDOWS\Explorer.EXE[2012] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 017B0040
.text C:\WINDOWS\Explorer.EXE[2012] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 017B0000
.text C:\WINDOWS\Explorer.EXE[2012] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 017B0FA8
.text C:\WINDOWS\Explorer.EXE[2012] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [9B, 89]
.text C:\WINDOWS\Explorer.EXE[2012] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 017B0FB9
.text C:\WINDOWS\Explorer.EXE[2012] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 0175004E
.text C:\WINDOWS\Explorer.EXE[2012] msvcrt.dll!system 77C293C7 5 Bytes JMP 01750033
.text C:\WINDOWS\Explorer.EXE[2012] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 01750018
.text C:\WINDOWS\Explorer.EXE[2012] msvcrt.dll!_open 77C2F566 5 Bytes JMP 01750FEF
.text C:\WINDOWS\Explorer.EXE[2012] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 01750FC3
.text C:\WINDOWS\Explorer.EXE[2012] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 01750FDE
.text C:\WINDOWS\Explorer.EXE[2012] WININET.dll!InternetOpenA 3D953081 5 Bytes JMP 013D0FE5
.text C:\WINDOWS\Explorer.EXE[2012] WININET.dll!InternetOpenW 3D9536B1 5 Bytes JMP 013D0FD4
.text C:\WINDOWS\Explorer.EXE[2012] WININET.dll!InternetOpenUrlA 3D956F5A 5 Bytes JMP 013D0000
.text C:\WINDOWS\Explorer.EXE[2012] WININET.dll!InternetOpenUrlW 3D998471 5 Bytes JMP 013D0011
.text C:\WINDOWS\Explorer.EXE[2012] WS2_32.dll!socket 71AB4211 5 Bytes JMP 01400000
.text C:\WINDOWS\system32\svchost.exe[2116] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 010F0FEF
.text C:\WINDOWS\system32\svchost.exe[2116] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 010F0082
.text C:\WINDOWS\system32\svchost.exe[2116] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 010F0F8D
.text C:\WINDOWS\system32\svchost.exe[2116] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 010F0FA8
.text C:\WINDOWS\system32\svchost.exe[2116] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 010F005B
.text C:\WINDOWS\system32\svchost.exe[2116] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 010F0FC3
.text C:\WINDOWS\system32\svchost.exe[2116] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 010F00AE
.text C:\WINDOWS\system32\svchost.exe[2116] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 010F009D
.text C:\WINDOWS\system32\svchost.exe[2116] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 010F00F5
.text C:\WINDOWS\system32\svchost.exe[2116] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 010F00E4
.text C:\WINDOWS\system32\svchost.exe[2116] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 010F0110
.text C:\WINDOWS\system32\svchost.exe[2116] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 010F004A
.text C:\WINDOWS\system32\svchost.exe[2116] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 010F000A
.text C:\WINDOWS\system32\svchost.exe[2116] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 010F0F72
.text C:\WINDOWS\system32\svchost.exe[2116] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 010F0039
.text C:\WINDOWS\system32\svchost.exe[2116] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 010F0FDE
.text C:\WINDOWS\system32\svchost.exe[2116] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 010F00C9
.text C:\WINDOWS\system32\svchost.exe[2116] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 010E0FD4
.text C:\WINDOWS\system32\svchost.exe[2116] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 010E0F94
.text C:\WINDOWS\system32\svchost.exe[2116] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 010E0025
.text C:\WINDOWS\system32\svchost.exe[2116] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 010E0FE5
.text C:\WINDOWS\system32\svchost.exe[2116] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 010E005B
.text C:\WINDOWS\system32\svchost.exe[2116] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 010E000A
.text C:\WINDOWS\system32\svchost.exe[2116] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 010E0FB9
.text C:\WINDOWS\system32\svchost.exe[2116] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [2E, 89]
.text C:\WINDOWS\system32\svchost.exe[2116] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 010E004A
.text C:\WINDOWS\system32\svchost.exe[2116] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 010D0FA1
.text C:\WINDOWS\system32\svchost.exe[2116] msvcrt.dll!system 77C293C7 5 Bytes JMP 010D0FBC
.text C:\WINDOWS\system32\svchost.exe[2116] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 010D0FDE
.text C:\WINDOWS\system32\svchost.exe[2116] msvcrt.dll!_open 77C2F566 5 Bytes JMP 010D000C
.text C:\WINDOWS\system32\svchost.exe[2116] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 010D0FCD
.text C:\WINDOWS\system32\svchost.exe[2116] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 010D0FEF
.text C:\WINDOWS\system32\svchost.exe[2116] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00FF0FEF
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00CD0FEF
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00CD0FB2
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00CD0FC3
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00CD0091
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00CD0076
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00CD004A
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00CD0F90
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00CD00CC
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00CD0F64
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00CD00FD
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00CD0122
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00CD0065
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00CD0FDE
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00CD0FA1
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00CD0039
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00CD0014
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00CD0F7F
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00CC0FB2
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00CC0F61
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00CC0FC3
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00CC0FDE
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00CC0F72
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00CC0FEF
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00CC0014
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00CC0F97
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00CB0040
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] msvcrt.dll!system 77C293C7 5 Bytes JMP 00CB0025
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00CB0FB5
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] msvcrt.dll!_open 77C2F566 3 Bytes JMP 00CB0FE3
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] msvcrt.dll!_open + 4 77C2F56A 1 Byte [89]
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00CB000A
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00CB0FD2
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[2368] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00CA0000
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00260000
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00260089
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00260F94
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00260FA5
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00260FC0
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00260051
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 002600D0
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 002600B5
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00260F63
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 002600FC
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00260F52
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00260062
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00260FE5
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 002600A4
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 0026002C
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 0026001B
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 002600EB
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 0035002C
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00350F9B
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0035001B
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00350FE5
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00350058
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 0035000A
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00350047
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00350FC0
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E1DF4D9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3527F6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E352777 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3527BB C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E352703 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E35273D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E352831 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E20178A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00360038
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] msvcrt.dll!system 77C293C7 5 Bytes JMP 00360027
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00360FD2
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00360000
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00360FB7
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00360FE3
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] ole32.dll!OleLoadFromStream 7752981B 5 Bytes JMP 3E3529F3 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] WININET.dll!InternetCloseHandle 3D944261 5 Bytes JMP 024A2C00 c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (SiteAdvisor/McAfee, Inc.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] WININET.dll!HttpOpenRequestA 3D94AA5B 5 Bytes JMP 024A2EC0 c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (SiteAdvisor/McAfee, Inc.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] WININET.dll!InternetConnectA 3D94B0B2 5 Bytes JMP 024A2FC0 c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (SiteAdvisor/McAfee, Inc.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] WININET.dll!InternetReadFile 3D9513D4 5 Bytes JMP 024A2D20 c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (SiteAdvisor/McAfee, Inc.)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] WININET.dll!InternetOpenA 3D953081 5 Bytes JMP 01BC0FE5
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] WININET.dll!InternetOpenW 3D9536B1 5 Bytes JMP 01BC0FD4
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] WININET.dll!InternetOpenUrlA 3D956F5A 5 Bytes JMP 01BC0000
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] WININET.dll!InternetOpenUrlW 3D998471 5 Bytes JMP 01BC0FB9
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2580] ws2_32.dll!socket 71AB4211 5 Bytes JMP 01E3000A

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

Device \FileSystem\Fastfat \Fat A707ED20

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys@start 1
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACrnirrsklvm.sys
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules@UACd \\?\globalroot\systemroot\system32\drivers\UACrnirrsklvm.sys
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules@UACc \\?\globalroot\systemroot\system32\UACkmssblntyx.dll
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules@uacbbr \\?\globalroot\systemroot\system32\UACvkonqrvrjx.dll
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules@uacsr \\?\globalroot\systemroot\system32\UACbtdelrumup.dat
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules@uacmal \\?\globalroot\systemroot\system32\UACqpxwippatf.db
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules@uacrem \\?\globalroot\systemroot\system32\UACupdpyvymxf.dll
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules@uacmask \\?\globalroot\systemroot\system32\UACqpwtkvvxai.dll
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules@uacserf \\?\globalroot\systemroot\system32\UACdethwixoro.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@start 1
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACrnirrsklvm.sys
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@UACd \\?\globalroot\systemroot\system32\drivers\UACrnirrsklvm.sys
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@UACc \\?\globalroot\systemroot\system32\UACkmssblntyx.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacbbr \\?\globalroot\systemroot\system32\UACvkonqrvrjx.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacsr \\?\globalroot\systemroot\system32\UACbtdelrumup.dat
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacmal \\?\globalroot\systemroot\system32\UACqpxwippatf.db
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacrem \\?\globalroot\systemroot\system32\UACupdpyvymxf.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacmask \\?\globalroot\systemroot\system32\UACqpwtkvvxai.dll
Reg HKLM\SYSTEM\ControlSet002\Services\UACd.sys\modules@uacserf \\?\globalroot\systemroot\system32\UACdethwixoro.dll

—- EOF - GMER 1.0.15 —-

Checkup Log:
Results of screen317's Security Check version 0.99.13
Windows XP Service Pack 3
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
AVG 2011
McAfee VirusScan Enterprise
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
HijackThis 2.0.2
Java™ 6 Update 15
Out of date Java installed!
Flash Player Out of Date!
Adobe Flash Player 10.0.32.18
Adobe Reader 8.1.4
Out of date Adobe Reader installed!
Mozilla Firefox (3.6.17) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
McAfee VirusScan Enterprise Mcshield.exe
McAfee VirusScan Enterprise VsTskMgr.exe
``````````End of Log````````````

Conspire

Post #4June 10, 2011, 3:20 AM UTC

Hello,

Please read through these instructions to familarize yourself with what to expect when this tool runs

Refer to the ComboFix User's Guide

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs

Regarding AVG - Due to recent changes in AVG and how it interacts with ComboFix, before running ComboFix, AVG must be uninstalled via Start>Control Panel>Add or Remove programs panel.

If you have difficulty uninstalling AVG, download Opswat AppRemover for AVG. The download for the AVG uninstaller can be found here > http://www.appremover.com/get/appremover.exe

**********************************************
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

whatsup

Post #5June 11, 2011, 9:57 PM UTC

Conspire, here's the Combofix log, thanks for the help:

ComboFix 11-06-11.01 - Jared Goodman 06/11/2011 17:37:36.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2039.1360 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: McAfee VirusScan Enterprise *Disabled/Updated* {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Jared Goodman\Cookies\aqofulopu.ban
c:\documents and settings\Jared Goodman\Cookies\dizyb.dll
c:\documents and settings\Jared Goodman\Cookies\ihemovyqil.bat
c:\documents and settings\Jared Goodman\Cookies\obytedu.pif
c:\documents and settings\Jared Goodman\Cookies\suvyg.bin
c:\documents and settings\Jared Goodman\Cookies\urotid.dll
c:\documents and settings\Jared Goodman\Cookies\wezivevano.reg
c:\documents and settings\Jared Goodman\GoToAssistDownloadHelper.exe
c:\documents and settings\Jared Goodman\WINDOWS
c:\program files\Common Files\ikytuka.db
c:\program files\Common Files\ofyxunuz.dl
c:\program files\Common Files\ureky.db
c:\windows\ifuf.dll
c:\windows\imil.exe
c:\windows\olyrofena.scr
c:\windows\system32\Thumbs.db
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
c:\windows\tyliju.scr
c:\windows\uzec.scr
c:\windows\ycoqopaqu.scr
.
.
((((((((((((((((((((((((( Files Created from 2011-05-11 to 2011-06-11 )))))))))))))))))))))))))))))))
.
.
2011-06-11 20:56 . 2011-05-09 20:46 6962000 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{09808835-E431-41A9-99D2-1F761A2BA8E4}\mpengine.dll
2011-06-08 00:13 . 2011-06-08 00:13 ——– d—–w- c:\program files\whatsup
2011-06-07 23:02 . 2011-06-07 23:02 ——– d—–w- C:\$AVG
2011-06-07 22:36 . 2011-06-07 22:36 ——– d—–w- c:\documents and settings\Jared Goodman\Application Data\AVG10
2011-06-07 16:19 . 2011-06-11 20:35 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG10
2011-06-07 16:19 . 2011-06-11 20:13 ——– d—–w- c:\windows\system32\drivers\AVG
2011-06-07 15:55 . 2011-06-11 21:29 ——– d—–w- c:\documents and settings\All Users\Application Data\MFAData
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-29 13:11 . 2009-08-10 18:08 39984 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-09 20:46 . 2009-08-11 22:14 6962000 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-04-13 22:40 . 2011-04-13 22:40 4284416 —-a-w- c:\windows\system32\GPhotos.scr
2011-03-15 16:12 . 2011-03-15 16:12 398760 —-a-r- c:\windows\system32\cpnprt2.cid
2009-08-11 18:55 . 2009-08-11 18:55 19312 —-a-w- c:\program files\Common Files\nusojofy.exe
2009-08-11 18:55 . 2009-08-11 18:55 16794 —-a-w- c:\program files\Common Files\kuji.dll
2009-08-11 18:42 . 2009-08-11 18:42 19435 —-a-w- c:\program files\Common Files\sovacyl.exe
2009-08-11 18:42 . 2009-08-11 18:42 17516 —-a-w- c:\program files\Common Files\ofolahax.reg
2009-08-11 17:43 . 2009-08-11 17:43 18178 —-a-w- c:\program files\Common Files\vuzumuhap.sys
2009-08-11 17:43 . 2009-08-11 17:43 10388 —-a-w- c:\program files\Common Files\ebifuvimyg.bat
2009-08-10 18:33 . 2009-08-10 18:33 19041 —-a-w- c:\program files\Common Files\zejagexa.com
2009-08-10 18:33 . 2009-08-10 18:33 16503 —-a-w- c:\program files\Common Files\miwehyko.exe
2009-08-10 18:33 . 2009-08-10 18:33 15662 —-a-w- c:\program files\Common Files\imymynonym.scr
2009-08-10 18:33 . 2009-08-10 18:33 13463 —-a-w- c:\program files\Common Files\exepub.sys
2009-08-08 08:27 . 2009-08-08 08:27 17736 —-a-w- c:\program files\Common Files\nifev.scr
2009-08-08 08:27 . 2009-08-08 08:27 16415 —-a-w- c:\program files\Common Files\uhaxew.sys
2009-08-08 08:27 . 2009-08-08 08:27 10066 —-a-w- c:\program files\Common Files\ahykove.dll
2009-08-08 07:40 . 2009-08-08 07:40 19059 —-a-w- c:\program files\Common Files\gaka.reg
2008-05-07 08:34 . 2009-01-08 08:47 15523560 —-a-w- c:\program files\U1 Setup.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2008-09-26 2356088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [2008-12-04 114688]
"AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2008-12-18 622592]
"AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2008-05-21 94208]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2008-05-23 111952]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2007-10-25 136512]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2008-05-29 1085440]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-12-21 86016]
"RTHDCPL"="RTHDCPL.EXE" [2008-09-18 16855040]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-12 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-20 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-20 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-20 131072]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-19 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]
"VERIZONDM"="c:\program files\VERIZONDM\bin\sprtcmd.exe" [2011-02-01 206120]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-9-2 604776]
SuperHybridEngine.lnk - c:\program files\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe [2009-1-8 376832]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-3-11 118784]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Brother\\Brmfl08b\\FAXRX.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\Jared Goodman\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"54925:UDP"= 54925:UDP:*:Disabled:BrotherNetwork Scanner
.
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [8/16/2009 12:23 PM 88176]
R2 sprtsvc_verizondm;SupportSoft Sprocket Service (verizondm);c:\program files\VERIZONDM\bin\sprtsvc.exe [2/1/2011 5:54 AM 206120]
R2 tgsrvc_verizondm;SupportSoft Repair Service (verizondm);c:\program files\VERIZONDM\bin\tgsrvc.exe [2/1/2011 5:54 AM 185640]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [8/16/2009 3:25 PM 24652]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S0 vumfwpra;vumfwpra;c:\windows\system32\drivers\jrmicu.sys –> c:\windows\system32\drivers\jrmicu.sys [?]
S2 rvmnhbhp;rvmnhbhp;c:\windows\system32\drivers\girqcqr.sys –> c:\windows\system32\drivers\girqcqr.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-03-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 15:50]
.
2011-06-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-382615644-1615748766-3516731530-1006Core.job
- c:\documents and settings\Jared Goodman\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-12 04:25]
.
2011-06-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-382615644-1615748766-3516731530-1006UA.job
- c:\documents and settings\Jared Goodman\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-12 04:25]
.
2011-06-11 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p;=%s%s
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth; Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 10.0.0.1
FF - ProfilePath - c:\documents and settings\Jared Goodman\Application Data\Mozilla\Firefox\Profiles\9x1w6o64.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p;=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - c:\program files\McAfee\SiteAdvisor
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
Notify-avgrsstarter - avgrsstx.dll
MSConfigStartUp-braviax - braviax.exe
MSConfigStartUp-Monopod - c:\docume~1\JAREDG~1\LOCALS~1\Temp\b.exe
MSConfigStartUp-MsnMsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe
MSConfigStartUp-PC Antispyware 2010 - c:\program files\PC_Antispyware2010\PC_Antispyware2010.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-11 17:46
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2011-06-11 17:49:01
ComboFix-quarantined-files.txt 2011-06-11 21:48
ComboFix2.txt 2009-08-13 17:04
.
Pre-Run: 30,474,801,152 bytes free
Post-Run: 31,784,775,680 bytes free
.
Current=4 Default=4 Failed=3 LastKnownGood=5 Sets=1,2,3,4,5
- - End Of File - - 5E2D30DA3CA4D9D5AEFCB029A99B053A

Conspire

Post #6June 12, 2011, 2:57 AM UTC

Hi,

You're welcome

Please follow all previous instructions regarding security programs.

Open a new Notepad session

Click the Start button, click run
in the run box type notepad
click ok
In the notepad, Click "Format" and be certain that Word Wrap is not checked.
Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

File::
c:\program files\Common Files\nusojofy.exe
c:\program files\Common Files\kuji.dll
c:\program files\Common Files\sovacyl.exe
c:\program files\Common Files\ofolahax.reg
c:\program files\Common Files\vuzumuhap.sys
c:\program files\Common Files\ebifuvimyg.bat
c:\program files\Common Files\zejagexa.com
c:\program files\Common Files\miwehyko.exe
c:\program files\Common Files\imymynonym.scr
c:\program files\Common Files\exepub.sys
c:\program files\Common Files\nifev.scr
c:\program files\Common Files\uhaxew.sys
c:\program files\Common Files\ahykove.dll
c:\program files\Common Files\gaka.reg
c:\windows\system32\drivers\girqcqr.sys
c:\windows\system32\drivers\jrmicu.sys

Driver::
vumfwpra
rvmnhbhp

In the notepad

Click File, Save as…, and set the Save in to your Desktop
In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

===================================================

On your next reply please post :
Combofix log
Advice on system behaviour

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

Conspire

Post #7June 15, 2011, 12:00 PM UTC

Do you still need help?

Conspire

Post #8June 17, 2011, 3:24 AM UTC

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic

✨ Ask AI

Ask AI