What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Windows - Delayed Write Filed

23 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
The following message popped up on my computer:

Windows - Delayed Write Filed

Windows was unable to save all the data for the file \\System32\\296A8300. The data has been lost. This error may be caused by a failure of your computer hardware.

It then gives the options to Cancel, Try Again, or Continue.

I clicked Cancel to close out of the screen. The computer seems fully functional with the exception that all the files and folders are now hidden. They can still be opened and accessed, but they're still hidden.

This is the result from my HijackThis scan:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:06:45 AM, on 7/6/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
c:\program files\mcafee.com\agent\mcdetect.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\delbert selvage\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.esu9.org/webmail/src/login.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\PROGRA~1\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll
O2 - BHO: McAfee Privacy Service Popup Blocker - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20100914212344.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [cbrkjkgm] C:\DOCUME~1\DELBER~1\LOCALS~1\Temp\ucjqkveuw\bjryeoahmof.exe
O4 - HKCU\..\Run: [lxTiueHQRFVJQV] C:\Documents and Settings\All Users\Application Data\lxTiueHQRFVJQV.exe
O4 - Startup: PowerReg Scheduler.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McShield - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 11165 bytes
Post #2
Hello k_selvage and :welcome:

My name is JonTom

  • Malware Logs can sometimes take a lot of time to research and interpret.
  • Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
  • Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
  • Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
  • PLEASE NOTE: If you do not reply after 5 days your thread will be closed.

Lets take a closer look at your system with the following scans:

  • Please perform the following scan


    • Please download DDS from here and save it to your desktop.
    • Disable any script blocking protection (How to Disable your Security Programs)
    • Double click on the DDS icon to run the tool (may take up to 3 minutes to run).
    • When done, DDS.txt will open.
    • After a few moments, attach.txt will open in a second window.
    • Save both reports to your desktop.
    • Please post the contents of the DDS.txt and Attach.txt logs in your next reply.

  • Please scan your system with GMER


    [external image: Posted Image]
    Download GMER Rootkit Scanner from here or here.
    • Extract the contents of the zipped file to desktop.
    • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent.
    • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
    • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOTKIT" entries

Please post the DDS logs and the GMER log in your next reply. If you encounter any problems with the scans come back and let me know.
Post #3
I tried following the instructions on the "How to Disable your Security Programs" link, but I have McAfee Total Protection and there weren't any instructions for that specific program. I then went to the Security Center in the Control Panel, and it says that my Virus Protection is turned off, so I assume McAfee Total Protection is turned off…

Here is the information in the "dds" text document:

.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by [removed] at 21:02:16 on 2011-07-07
.
============== Running Processes ===============
.
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
c:\program files\mcafee.com\agent\mcdetect.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\delbert selvage\Desktop\dds.scr
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = https://www.esu9.org/webmail/src/login.php
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: McBrwHelper Class: {227b8aa8-daf2-4892-bd1d-73f568bcb24e} - c:\progra~1\mcafee.com\mps\mcbrhlpr.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO: McAfee Privacy Service Popup Blocker: {3ec8255f-e043-4cae-8b3b-b191550c2a22} - c:\program files\mcafee.com\mps\popupkiller.dll
BHO: McAfee AntiPhishing Filter: {41d68ed8-4cff-4115-88a6-6ebb8af19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20100914212344.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: McAfee VirusScan: {ba52b914-b692-46c4-b683-905236f6f655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [DellSupport] "c:\program files\dell support\DSAgnt.exe" /startup
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [cbrkjkgm] c:\docume~1\delber~1\locals~1\temp\ucjqkveuw\bjryeoahmof.exe
uRun: [lxTiueHQRFVJQV] c:\documents and settings\all users\application data\lxTiueHQRFVJQV.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [VSOCheckTask] "c:\progra~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
mRun: [OASClnt] c:\program files\mcafee.com\vso\oasclnt.exe
mRun: [MSKDetectorExe] c:\progra~1\mcafee\spamki~1\MSKDetct.exe /startup
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [VirusScan Online] c:\program files\mcafee.com\vso\mcvsshld.exe
mRun: [MPFExe] c:\progra~1\mcafee.com\person~1\MpfTray.exe
mRun: [DeviceDiscovery] c:\program files\hewlett-packard\digital imaging\bin\hpotdd01.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [MPSExe] c:\progra~1\mcafee.com\mps\mscifapp.exe /embedding
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [HP Software Update] c:\program files\hewlett-packard\hp software update\HPWuSchd2.exe
mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [MSKAGENTEXE] c:\progra~1\mcafee\spamki~1\MskAgent.exe
uPolicies-explorer: NoDesktop = 1 (0x1)
uPolicies-system: DisableTaskMgr = 1 (0x1)
mPolicies-system: DisableTaskMgr = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
IE: {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - {7DD73374-7187-4103-8F29-622AA25E7C40} - c:\program files\mcafee\spamkiller\mcapfbho.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
LSP: c:\windows\system32\mclsp.dll
Trusted Zone: musicmatch.com\online
DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - hxxp://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - hxxp://chat.yahoo.com/cab/yacsui.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} - hxxp://chat.yahoo.com/cab/yvwrctl.cab
TCP: DhcpNameServer = 192.168.254.254
TCP: Interfaces\{DA339A3E-62C3-44FC-9736-BFEF677DC04A} : DhcpNameServer = 192.168.254.254
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: igfxcui - igfxdev.dll
.
============= SERVICES / DRIVERS ===============
.
R? cfwids;McAfee Inc. cfwids
R? gupdate;Google Update Service (gupdate)
R? gupdatem;Google Update Service (gupdatem)
R? McOobeSv;McAfee OOBE Service
R? mcupdmgr.exe;McAfee SecurityCenter Update Manager
R? mfendisk;McAfee Core NDIS Intermediate Filter
R? mferkdet;McAfee Inc. mferkdet
S? McAfee SiteAdvisor Service;McAfee SiteAdvisor Service
S? McDetect.exe;McAfee WSC Integration
S? McNaiAnn;McAfee VirusScan Announcer
S? McProxy;McAfee Proxy Service
S? McShield;McShield
S? mfeavfk;McAfee Inc. mfeavfk
S? mfebopk;McAfee Inc. mfebopk
S? mfefire;McAfee Firewall Core Service
S? mfefirek;McAfee Inc. mfefirek
S? mfehidk;McAfee Inc. mfehidk
S? mfendiskmp;mfendiskmp
S? mfetdi2k;McAfee Inc. mfetdi2k
S? mfevtp;McAfee Validation Trust Protection Service
S? MPFIREWL;MPFIREWL
.
=============== Created Last 30 ================
.
2011-06-21 21:11:41 ——– d–h–w- c:\windows\system32\wbem\Repository
2011-06-21 21:11:41 ——– d—–w- c:\windows\system32\wbem\repository\FS
2011-06-19 15:33:26 105472 —h–w- c:\windows\system32\dllcache\mup.sys
2011-06-10 20:26:06 ——– d–h–w- c:\documents and settings\delbert selvage\local settings\application data\Oberon Games
2011-06-10 19:39:06 ——– d–h–w- c:\documents and settings\delbert selvage\Saved Games
2011-06-10 19:32:27 ——– d–h–w- c:\program files\DreamDayWedding2_at
.
==================== Find3M ====================
.
2011-06-22 12:05:40 5852 –sha-w- c:\windows\system32\KGyGaAvL.sys
2011-06-22 12:05:37 88 –sh–r- c:\windows\system32\CC71837CDE.sys
2011-06-19 15:18:25 404640 —ha-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-02 15:31:52 692736 —ha-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25:27 151552 —ha-w- c:\windows\system32\schannel.dll
2011-04-29 16:19:43 456320 —ha-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-25 16:11:12 916480 —ha-w- c:\windows\system32\wininet.dll
2011-04-25 16:11:11 43520 —ha-w- c:\windows\system32\licmgr10.dll
2011-04-25 16:11:11 1469440 —h–w- c:\windows\system32\inetcpl.cpl
2011-04-25 12:01:22 385024 —ha-w- c:\windows\system32\html.iec
2011-04-21 13:37:43 105472 —ha-w- c:\windows\system32\drivers\mup.sys
.
============= FINISH: 21:04:22.14 ===============


Here are the results for the "attach" text document:

.
==== Installed Programs ======================
.
Adobe Flash Player 10 ActiveX
Adobe Reader 7.0
AiO_Scan_CDA
AiOSoftwareNPI
America Online (Choose which version to remove)
AOL Coach Version 1.0(Build:20040229.1 en)
AOL Connectivity Services
AOLIcon
BufferChm
C5100
c5100_Help
Compatibility Pack for the 2007 Office system
Conexant D850 56K V.9x DFVc Modem
Corel Paint Shop Pro X
Corel Photo Album 6
CP_CalendarTemplates1
cp_OnlineProjectsConfig
CP_Package_Basic1
CP_Panorama1Config
cp_PosterPrintConfig
CueTour
CustomerResearchQFolder
Dell CinePlayer
Dell Digital Jukebox Driver
Dell Driver Reset Tool
Dell Game Console
Dell Support 3.1
Dell System Restore
Destinations
DeviceManagementQFolder
Digital Content Portal
Digital Line Detect
DocProc
DocProcQFolder
Documentation & Support Launcher
DocumentViewer
DocumentViewerQFolder
Dream Day Wedding 2 Free Trial
EarthLink setup files
EducateU
ELIcon
Fax_CDA
FullDPAppQFolder
Games, Music, & Photos Launcher
GdiplusUpgrade
Get High Speed Internet!
Google Earth Plug-in
Google Update Helper
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB981793)
HP Customer Participation Program 7.0
HP Document Viewer 7.0
HP Imaging Device Functions 7.0
HP Photo and Imaging 2.0 - Deskjet Series
HP Photosmart Premier Software 6.5
HP Photosmart, Officejet and Deskjet 7.0.A
hp print screen utility
HP Software Update
HP Solution Center 7.0
HPPhotoSmartExpress
HPProductAssistant
InstantShareDevices
InstantShareDevicesMFC
Intel® Extreme Graphics 2 Driver
Intel® PRO Network Adapters and Drivers
Intel® PROSet for Wired Connections
Internet Service Offers Launcher
Java 2 Runtime Environment, SE v1.4.2_03
Learn2 Player (Uninstall Only)
LiveUpdate 2.6 (Symantec Corporation)
MarketResearch
McAfee Total Protection
McAfee Uninstaller
MCU
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office File Validation Add-In
Microsoft Office Professional Edition 2003
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft Silverlight
Modem Helper
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Musicmatch® Jukebox
NetWaiting
NetZeroInstallers
NewCopy_CDA
OCR Software by I.R.I.S 7.0
Pacific Fighters
PanoStandAlone
PF+FB+AEP
PhotoGallery
ProductContextNPI
QuickTime
RandMap
Readme
RealPlayer Basic
Rhapsody Player Engine
Roxio DLA
Roxio RecordNow Audio
Roxio RecordNow Copy
Roxio RecordNow Data
Scan
ScannerCopy
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2491683)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982381)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Segoe UI
SkinsHP1
SlideShow
SolutionCenter
Sonic Activation Module
Sonic Update Manager
Sonic_PrimoSDK
Status
Toolbox
TrayApp
ubi.com
Unload
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Viewpoint Media Player
WebCyberCoach 3.2 Dell
WebFldrs XP
WebReg
WildTangent Web Driver
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Media Format Runtime
Windows Media Player 10
Windows XP Service Pack 3
WordPerfect Office 12
Yahoo! Toolbar
.
==== Event Viewer Messages From Past Week ========
.
7/2/2011 7:44:07 AM, error: Service Control Manager [7031] - The McShield service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.
7/2/2011 7:23:51 AM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000000E' while processing the file 'change.log' on the volume 'HarddiskVolume6'. It has stopped monitoring the volume.
7/2/2011 7:18:34 AM, error: Service Control Manager [7023] - The IPSEC Services service terminated with the following error: The attempted operation is not supported for the type of object referenced.
7/2/2011 7:17:15 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
7/2/2011 7:16:29 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec mfehidk mfetdi2k MPFIREWL MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip WS2IFSL
7/2/2011 7:16:29 AM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
7/2/2011 7:16:29 AM, error: Service Control Manager [7001] - The McShield service depends on the McAfee Validation Trust Protection Service service which failed to start because of the following error: The dependency service or group failed to start.
7/2/2011 7:16:29 AM, error: Service Control Manager [7001] - The McAfee Validation Trust Protection Service service depends on the McAfee Inc. mfehidk service which failed to start because of the following error: A device attached to the system is not functioning.
7/2/2011 7:16:29 AM, error: Service Control Manager [7001] - The McAfee Proxy Service service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.
7/2/2011 7:16:29 AM, error: Service Control Manager [7001] - The McAfee Network Agent service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.
7/2/2011 7:16:29 AM, error: Service Control Manager [7001] - The McAfee Firewall Core Service service depends on the McAfee Validation Trust Protection Service service which failed to start because of the following error: The dependency service or group failed to start.
7/2/2011 7:16:29 AM, error: Service Control Manager [7001] - The McAfee Anti-Spam Service service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.
7/2/2011 7:16:29 AM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
7/2/2011 7:16:29 AM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
7/2/2011 7:16:29 AM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
7/2/2011 7:16:03 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
7/2/2011 6:43:17 AM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000034' while processing the file 'Microsoft .. bility.lnk' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume.
.
==== End Of File ===========================


Finally, here are the results for the "Gmer" text document:

GMER 1.0.15.15640 - http://www.gmer.net
Rootkit scan 2011-07-07 21:19:07
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 Maxtor_6L160P0 rev.BAJ41G10
Running: gmer.exe; Driver: C:\DOCUME~1\DELBER~1\LOCALS~1\Temp\kwlyapog.sys


—- System - GMER 1.0.15 —-

Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwCreateKey [0xF8544090]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwDeleteKey [0xF85440A4]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xF85440D0]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xF8544126]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwOpenKey [0xF854407C]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwOpenProcess [0xF8544054]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwOpenThread [0xF8544068]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwRenameKey [0xF85440BA]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwSetSecurityObject [0xF85440FC]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwSetValueKey [0xF85440E6]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwTerminateProcess [0xF8544150]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xF854413C]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwYieldExecution [0xF8544110]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtMapViewOfSection
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtOpenProcess
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtOpenThread
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtSetSecurityObject

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!ZwYieldExecution 804F0EB6 7 Bytes JMP F8544114 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwOpenKey 80568F68 5 Bytes JMP F8544080 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwCreateKey 8057376F 5 Bytes JMP F8544094 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtOpenProcess 80574AA9 5 Bytes JMP F8544058 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwUnmapViewOfSection 8057A81E 5 Bytes JMP F8544140 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtMapViewOfSection 8057AC99 7 Bytes JMP F854412A mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwSetValueKey 8057BC5B 7 Bytes JMP F85440EA mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwTerminateProcess 805839B9 5 Bytes JMP F8544154 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtOpenThread 8059323B 5 Bytes JMP F854406C mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwDeleteValueKey 80595C1A 7 Bytes JMP F85440D4 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwDeleteKey 80597FFA 7 Bytes JMP F85440A8 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtSetSecurityObject 8059D2BD 5 Bytes JMP F8544100 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwRenameKey 8064F526 7 Bytes JMP F85440BE mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
init C:\WINDOWS\system32\drivers\senfilt.sys entry point in "init" section [0xF7F77F80]
? C:\DOCUME~1\DELBER~1\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Internet Explorer\iexplore.exe[216] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00150FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[216] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00150014
.text C:\Program Files\Internet Explorer\iexplore.exe[216] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00150FD4
.text C:\Program Files\Internet Explorer\iexplore.exe[216] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00270000
.text C:\Program Files\Internet Explorer\iexplore.exe[216] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 0027005B
.text C:\Program Files\Internet Explorer\iexplore.exe[216] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00270F70
.text C:\Program Files\Internet Explorer\iexplore.exe[216] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00270F8D
.text C:\Program Files\Internet Explorer\iexplore.exe[216] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00270F9E
.text C:\Program Files\Internet Explorer\iexplore.exe[216] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00270025
.text C:\Program Files\Internet Explorer\iexplore.exe[216] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00270F3F
.text C:\Program Files\Internet Explorer\iexplore.exe[216] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00270087
.text C:\Program Files\Internet Explorer\iexplore.exe[216] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00270F1A
.text C:\Program Files\Internet Explorer\iexplore.exe[216] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 002700B3
.text C:\Program Files\Internet Explorer\iexplore.exe[216] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 002700CE
.text C:\Program Files\Internet Explorer\iexplore.exe[216] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00270040
.text C:\Program Files\Internet Explorer\iexplore.exe[216] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00270FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[216] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00270076
.text C:\Program Files\Internet Explorer\iexplore.exe[216] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00270FB9
.text C:\Program Files\Internet Explorer\iexplore.exe[216] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00270FD4
.text C:\Program Files\Internet Explorer\iexplore.exe[216] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 002700A2
.text C:\Program Files\Internet Explorer\iexplore.exe[216] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00360011
.text C:\Program Files\Internet Explorer\iexplore.exe[216] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 0036004E
.text C:\Program Files\Internet Explorer\iexplore.exe[216] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00360FC0
.text C:\Program Files\Internet Explorer\iexplore.exe[216] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00360000
.text C:\Program Files\Internet Explorer\iexplore.exe[216] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00360033
.text C:\Program Files\Internet Explorer\iexplore.exe[216] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00360FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[216] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00360F9B
.text C:\Program Files\Internet Explorer\iexplore.exe[216] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [56, 88]
.text C:\Program Files\Internet Explorer\iexplore.exe[216] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00360022
.text C:\Program Files\Internet Explorer\iexplore.exe[216] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2154C5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[216] USER32.dll!SetWindowLongA 7E42C29D 5 Bytes JMP 3E3E558F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[216] USER32.dll!SetWindowLongW 7E42C2BB 5 Bytes JMP 3E3E55C0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[216] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB04 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[216] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5329 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[216] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E525B C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[216] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E52C6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[216] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E512C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[216] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E518E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[216] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E538C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[216] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E51F0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[216] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00370FB5
.text C:\Program Files\Internet Explorer\iexplore.exe[216] msvcrt.dll!system 77C293C7 5 Bytes JMP 00370036
.text C:\Program Files\Internet Explorer\iexplore.exe[216] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00370FC6
.text C:\Program Files\Internet Explorer\iexplore.exe[216] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00370000
.text C:\Program Files\Internet Explorer\iexplore.exe[216] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 0037001B
.text C:\Program Files\Internet Explorer\iexplore.exe[216] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00370FE3
.text C:\Program Files\Internet Explorer\iexplore.exe[216] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 009E0000
.text C:\Program Files\Internet Explorer\iexplore.exe[216] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 009E0011
.text C:\Program Files\Internet Explorer\iexplore.exe[216] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 009E0FE5
.text C:\Program Files\Internet Explorer\iexplore.exe[216] WININET.dll!InternetOpenUrlW 3D9A6D5F 5 Bytes JMP 009E002C
.text C:\Program Files\Internet Explorer\iexplore.exe[216] ws2_32.dll!socket 71AB4211 5 Bytes JMP 00F20FE5
.text C:\Program Files\Internet Explorer\iexplore.exe[340] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00150000
.text C:\Program Files\Internet Explorer\iexplore.exe[340] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00150FD4
.text C:\Program Files\Internet Explorer\iexplore.exe[340] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00150FE5
.text C:\Program Files\Internet Explorer\iexplore.exe[340] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00270FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[340] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00270F44
.text C:\Program Files\Internet Explorer\iexplore.exe[340] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00270F55
.text C:\Program Files\Internet Explorer\iexplore.exe[340] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00270039
.text C:\Program Files\Internet Explorer\iexplore.exe[340] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00270F7C
.text C:\Program Files\Internet Explorer\iexplore.exe[340] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00270FA8
.text C:\Program Files\Internet Explorer\iexplore.exe[340] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00270F1D
.text C:\Program Files\Internet Explorer\iexplore.exe[340] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00270065
.text C:\Program Files\Internet Explorer\iexplore.exe[340] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 0027009E
.text C:\Program Files\Internet Explorer\iexplore.exe[340] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00270EFB
.text C:\Program Files\Internet Explorer\iexplore.exe[340] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00270EEA
.text C:\Program Files\Internet Explorer\iexplore.exe[340] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00270F8D
.text C:\Program Files\Internet Explorer\iexplore.exe[340] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00270FDE
.text C:\Program Files\Internet Explorer\iexplore.exe[340] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00270054
.text C:\Program Files\Internet Explorer\iexplore.exe[340] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00270FB9
.text C:\Program Files\Internet Explorer\iexplore.exe[340] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00270014
.text C:\Program Files\Internet Explorer\iexplore.exe[340] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00270F0C
.text C:\Program Files\Internet Explorer\iexplore.exe[340] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00360FDB
.text C:\Program Files\Internet Explorer\iexplore.exe[340] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00360069
.text C:\Program Files\Internet Explorer\iexplore.exe[340] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0036002C
.text C:\Program Files\Internet Explorer\iexplore.exe[340] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0036001B
.text C:\Program Files\Internet Explorer\iexplore.exe[340] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00360FAC
.text C:\Program Files\Internet Explorer\iexplore.exe[340] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 0036000A
.text C:\Program Files\Internet Explorer\iexplore.exe[340] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00360058
.text C:\Program Files\Internet Explorer\iexplore.exe[340] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00360047
.text C:\Program Files\Internet Explorer\iexplore.exe[340] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2154C5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9A91 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD0CD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] USER32.dll!SetWindowLongA 7E42C29D 5 Bytes JMP 3E3E558F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] USER32.dll!SetWindowLongW 7E42C2BB 5 Bytes JMP 3E3E55C0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB04 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E25466E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5329 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E525B C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E52C6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E512C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E518E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E538C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E51F0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00370FA6
.text C:\Program Files\Internet Explorer\iexplore.exe[340] msvcrt.dll!system 77C293C7 5 Bytes JMP 00370031
.text C:\Program Files\Internet Explorer\iexplore.exe[340] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00370FD2
.text C:\Program Files\Internet Explorer\iexplore.exe[340] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00370FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[340] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00370FB7
.text C:\Program Files\Internet Explorer\iexplore.exe[340] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0037000C
.text C:\Program Files\Internet Explorer\iexplore.exe[340] ole32.dll!CoCreateInstance 774FF1AC 5 Bytes JMP 3E2EDB60 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] ole32.dll!OleLoadFromStream 7752981B 5 Bytes JMP 3E3E5691 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] WININET.dll!InternetReadFile 3D94654B 5 Bytes JMP 02872D20 c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (SiteAdvisor/McAfee, Inc.)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] WININET.dll!InternetCloseHandle 3D949088 5 Bytes JMP 02872C00 c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (SiteAdvisor/McAfee, Inc.)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] WININET.dll!HttpOpenRequestA 3D94D508 5 Bytes JMP 02872EC0 c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (SiteAdvisor/McAfee, Inc.)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] WININET.dll!InternetConnectA 3D94DEAE 5 Bytes JMP 02872FC0 c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (SiteAdvisor/McAfee, Inc.)
.text C:\Program Files\Internet Explorer\iexplore.exe[340] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 01CC0FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[340] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 01CC0FDE
.text C:\Program Files\Internet Explorer\iexplore.exe[340] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 01CC000A
.text C:\Program Files\Internet Explorer\iexplore.exe[340] WININET.dll!InternetOpenUrlW 3D9A6D5F 5 Bytes JMP 01CC0FB9
.text C:\Program Files\Internet Explorer\iexplore.exe[340] ws2_32.dll!socket 71AB4211 5 Bytes JMP 026D0FE5
.text C:\WINDOWS\system32\services.exe[1040] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00060000
.text C:\WINDOWS\system32\services.exe[1040] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00060FEF
.text C:\WINDOWS\system32\services.exe[1040] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0006001B
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00050FEF
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 0005009D
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 0005008C
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00050FB2
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00050FC3
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00050FD4
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00050F70
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00050F8D
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000500EE
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 000500D3
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 000500FF
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00050065
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 0005000A
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 000500AE
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00050036
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 0005001B
.text C:\WINDOWS\system32\services.exe[1040] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00050F55
.text C:\WINDOWS\system32\services.exe[1040] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00040FCA
.text C:\WINDOWS\system32\services.exe[1040] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 0004005B
.text C:\WINDOWS\system32\services.exe[1040] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0004001B
.text C:\WINDOWS\system32\services.exe[1040] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00040FE5
.text C:\WINDOWS\system32\services.exe[1040] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00040F9E
.text C:\WINDOWS\system32\services.exe[1040] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00040000
.text C:\WINDOWS\system32\services.exe[1040] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00040040
.text C:\WINDOWS\system32\services.exe[1040] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00040FB9
.text C:\WINDOWS\system32\services.exe[1040] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00740038
.text C:\WINDOWS\system32\services.exe[1040] msvcrt.dll!system 77C293C7 5 Bytes JMP 00740027
.text C:\WINDOWS\system32\services.exe[1040] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 0074000C
.text C:\WINDOWS\system32\services.exe[1040] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00740FE3
.text C:\WINDOWS\system32\services.exe[1040] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00740FB7
.text C:\WINDOWS\system32\services.exe[1040] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00740FD2
.text C:\WINDOWS\system32\services.exe[1040] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00070FEF
.text C:\WINDOWS\system32\lsass.exe[1052] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00C90FEF
.text C:\WINDOWS\system32\lsass.exe[1052] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00C90FC3
.text C:\WINDOWS\system32\lsass.exe[1052] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00C90FD4
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C80000
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C80F74
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C80073
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C80FA5
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C80062
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C80FCA
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C800BC
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C8009F
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C800FC
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C800E1
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00C80F48
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00C80051
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C80025
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00C80084
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00C80FDB
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00C80036
.text C:\WINDOWS\system32\lsass.exe[1052] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00C80F63
.text C:\WINDOWS\system32\lsass.exe[1052] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00C70FB9
.text C:\WINDOWS\system32\lsass.exe[1052] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00C70F9E
.text C:\WINDOWS\system32\lsass.exe[1052] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00C70014
.text C:\WINDOWS\system32\lsass.exe[1052] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00C70FDE
.text C:\WINDOWS\system32\lsass.exe[1052] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00C7005B
.text C:\WINDOWS\system32\lsass.exe[1052] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00C70FEF
.text C:\WINDOWS\system32\lsass.exe[1052] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00C70040
.text C:\WINDOWS\system32\lsass.exe[1052] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00C7002F
.text C:\WINDOWS\system32\lsass.exe[1052] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00FB0027
.text C:\WINDOWS\system32\lsass.exe[1052] msvcrt.dll!system 77C293C7 5 Bytes JMP 00FB0016
.text C:\WINDOWS\system32\lsass.exe[1052] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00FB0FB7
.text C:\WINDOWS\system32\lsass.exe[1052] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00FB0FEF
.text C:\WINDOWS\system32\lsass.exe[1052] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00FB0F9C
.text C:\WINDOWS\system32\lsass.exe[1052] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00FB0FDE
.text C:\WINDOWS\system32\lsass.exe[1052] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00CA0FEF
.text C:\WINDOWS\system32\svchost.exe[1224] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00FC0000
.text C:\WINDOWS\system32\svchost.exe[1224] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00FC0040
.text C:\WINDOWS\system32\svchost.exe[1224] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00FC0025
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00FB0FEF
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00FB0045
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00FB0F50
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00FB0F6B
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00FB0F7C
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00FB001E
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00FB0F07
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00FB0F24
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00FB0ED8
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00FB007B
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00FB0096
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00FB0F97
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00FB0FD4
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00FB0F35
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00FB0FA8
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00FB0FC3
.text C:\WINDOWS\system32\svchost.exe[1224] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00FB006A
.text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00FA0047
.text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00FA0FAC
.text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00FA0036
.text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00FA001B
.text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00FA0069
.text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00FA0000
.text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00FA0FC7
.text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [1A, 89]
.text C:\WINDOWS\system32\svchost.exe[1224] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00FA0058
.text C:\WINDOWS\system32\svchost.exe[1224] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00FE0F94
.text C:\WINDOWS\system32\svchost.exe[1224] msvcrt.dll!system 77C293C7 5 Bytes JMP 00FE0FAF
.text C:\WINDOWS\system32\svchost.exe[1224] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00FE0FD4
.text C:\WINDOWS\system32\svchost.exe[1224] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00FE0FEF
.text C:\WINDOWS\system32\svchost.exe[1224] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00FE0029
.text C:\WINDOWS\system32\svchost.exe[1224] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00FE000C
.text C:\WINDOWS\system32\svchost.exe[1224] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00FD000A
.text C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00CD0000
.text C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00CD0036
.text C:\WINDOWS\system32\svchost.exe[1288] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00CD001B
.text C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00CC0FEF
.text C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00CC00A5
.text C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00CC008A
.text C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00CC0FB0
.text C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00CC006F
.text C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00CC004A
.text C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00CC0F8B
.text C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00CC00D3
.text C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00CC0F66
.text C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00CC00FF
.text C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00CC011A
.text C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00CC0FCD
.text C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00CC000A
.text C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00CC00B6
.text C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00CC0FDE
.text C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00CC002F
.text C:\WINDOWS\system32\svchost.exe[1288] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00CC00EE
.text C:\WINDOWS\system32\svchost.exe[1288] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00CB001B
.text C:\WINDOWS\system32\svchost.exe[1288] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00CB0F8A
.text C:\WINDOWS\system32\svchost.exe[1288] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00CB0FCA
.text C:\WINDOWS\system32\svchost.exe[1288] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00CB0FDB
.text C:\WINDOWS\system32\svchost.exe[1288] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00CB0FA5
.text C:\WINDOWS\system32\svchost.exe[1288] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00CB0000
.text C:\WINDOWS\system32\svchost.exe[1288] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00CB0047
.text C:\WINDOWS\system32\svchost.exe[1288] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00CB0036
.text C:\WINDOWS\system32\svchost.exe[1288] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00E20FB7
.text C:\WINDOWS\system32\svchost.exe[1288] msvcrt.dll!system 77C293C7 5 Bytes JMP 00E20042
.text C:\WINDOWS\system32\svchost.exe[1288] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00E2001D
.text C:\WINDOWS\system32\svchost.exe[1288] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00E2000C
.text C:\WINDOWS\system32\svchost.exe[1288] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00E20FD2
.text C:\WINDOWS\system32\svchost.exe[1288] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00E20FEF
.text C:\WINDOWS\system32\svchost.exe[1288] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00CE0FE5
.text C:\WINDOWS\System32\svchost.exe[1424] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 05F20FEF
.text C:\WINDOWS\System32\svchost.exe[1424] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 05F20025
.text C:\WINDOWS\System32\svchost.exe[1424] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 05F2000A
.text C:\WINDOWS\System32\svchost.exe[1424] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 0511000A
.text C:\WINDOWS\System32\svchost.exe[1424] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 05110F5E
.text C:\WINDOWS\System32\svchost.exe[1424] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 05110053
.text C:\WINDOWS\System32\svchost.exe[1424] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 05110F79
.text C:\WINDOWS\System32\svchost.exe[1424] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 05110036
.text C:\WINDOWS\System32\svchost.exe[1424] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 05110FB9
.text C:\WINDOWS\System32\svchost.exe[1424] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 05110095
.text C:\WINDOWS\System32\svchost.exe[1424] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 05110F4D
.text C:\WINDOWS\System32\svchost.exe[1424] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 05110F0D
.text C:\WINDOWS\System32\svchost.exe[1424] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 05110F28
.text C:\WINDOWS\System32\svchost.exe[1424] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 051100CB
.text C:\WINDOWS\System32\svchost.exe[1424] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 05110F9E
.text C:\WINDOWS\System32\svchost.exe[1424] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 0511001B
.text C:\WINDOWS\System32\svchost.exe[1424] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 0511006E
.text C:\WINDOWS\System32\svchost.exe[1424] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 05110FCA
.text C:\WINDOWS\System32\svchost.exe[1424] kernel32.dll!CreateNamedPipeA 7C860CDC 3 Bytes JMP 05110FDB
.text C:\WINDOWS\System32\svchost.exe[1424] kernel32.dll!CreateNamedPipeA + 4 7C860CE0 1 Byte [88]
.text C:\WINDOWS\System32\svchost.exe[1424] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 051100A6
.text C:\WINDOWS\System32\svchost.exe[1424] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 05100FCD
.text C:\WINDOWS\System32\svchost.exe[1424] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 0510006F
.text C:\WINDOWS\System32\svchost.exe[1424] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 05100FDE
.text C:\WINDOWS\System32\svchost.exe[1424] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0510000A
.text C:\WINDOWS\System32\svchost.exe[1424] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 05100054
.text C:\WINDOWS\System32\svchost.exe[1424] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 05100FEF
.text C:\WINDOWS\System32\svchost.exe[1424] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 05100043
.text C:\WINDOWS\System32\svchost.exe[1424] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 05100FBC
.text C:\WINDOWS\System32\svchost.exe[1424] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 05FA0FAF
.text C:\WINDOWS\System32\svchost.exe[1424] msvcrt.dll!system 77C293C7 5 Bytes JMP 05FA0044
.text C:\WINDOWS\System32\svchost.exe[1424] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 05FA0029
.text C:\WINDOWS\System32\svchost.exe[1424] msvcrt.dll!_open 77C2F566 5 Bytes JMP 05FA000C
.text C:\WINDOWS\System32\svchost.exe[1424] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 05FA0FCA
.text C:\WINDOWS\System32\svchost.exe[1424] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 05FA0FEF
.text C:\WINDOWS\System32\svchost.exe[1424] WS2_32.dll!socket 71AB4211 5 Bytes JMP 05F90FEF
.text C:\WINDOWS\System32\svchost.exe[1424] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 05F80000
.text C:\WINDOWS\System32\svchost.exe[1424] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 05F8001B
.text C:\WINDOWS\System32\svchost.exe[1424] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 05F80FDB
.text C:\WINDOWS\System32\svchost.exe[1424] WININET.dll!InternetOpenUrlW 3D9A6D5F 5 Bytes JMP 05F80036
.text C:\WINDOWS\system32\svchost.exe[1440] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00BC0FEF
.text C:\WINDOWS\system32\svchost.exe[1440] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00BC0FC3
.text C:\WINDOWS\system32\svchost.exe[1440] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00BC0FD4
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BB0000
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BB009A
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BB0FAF
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BB0FC0
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BB007D
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BB0FDB
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BB0F72
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BB0F83
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BB0F32
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BB0F4D
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00BB0F21
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00BB006C
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00BB0011
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00BB0F94
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00BB003D
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00BB002C
.text C:\WINDOWS\system32\svchost.exe[1440] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00BB00CB
.text C:\WINDOWS\system32\svchost.exe[1440] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00BA0036
.text C:\WINDOWS\system32\svchost.exe[1440] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00BA0087
.text C:\WINDOWS\system32\svchost.exe[1440] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00BA0025
.text C:\WINDOWS\system32\svchost.exe[1440] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00BA0FEF
.text C:\WINDOWS\system32\svchost.exe[1440] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00BA0076
.text C:\WINDOWS\system32\svchost.exe[1440] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00BA0000
.text C:\WINDOWS\system32\svchost.exe[1440] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00BA0FCA
.text C:\WINDOWS\system32\svchost.exe[1440] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [DA, 88]
.text C:\WINDOWS\system32\svchost.exe[1440] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00BA0051
.text C:\WINDOWS\system32\svchost.exe[1440] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00BF0055
.text C:\WINDOWS\system32\svchost.exe[1440] msvcrt.dll!system 77C293C7 5 Bytes JMP 00BF0FCA
.text C:\WINDOWS\system32\svchost.exe[1440] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00BF0FEF
.text C:\WINDOWS\system32\svchost.exe[1440] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00BF000C
.text C:\WINDOWS\system32\svchost.exe[1440] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00BF0044
.text C:\WINDOWS\system32\svchost.exe[1440] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00BF0029
.text C:\WINDOWS\system32\svchost.exe[1440] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 00BD000A
.text C:\WINDOWS\system32\svchost.exe[1440] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 00BD0FEF
.text C:\WINDOWS\system32\svchost.exe[1440] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 00BD0FDE
.text C:\WINDOWS\system32\svchost.exe[1440] WININET.dll!InternetOpenUrlW 3D9A6D5F 5 Bytes JMP 00BD0025
.text C:\WINDOWS\system32\svchost.exe[1440] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BE0FE5
.text C:\WINDOWS\system32\svchost.exe[1568] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00BE0FEF
.text C:\WINDOWS\system32\svchost.exe[1568] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00BE0FB9
.text C:\WINDOWS\system32\svchost.exe[1568] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00BE0FDE
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BD0000
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BD0F60
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BD0F85
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BD005F
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BD004E
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BD0FB6
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BD0086
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BD0F3E
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BD0EFE
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BD0F19
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00BD00B2
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00BD0033
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00BD0FE5
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00BD0F4F
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00BD0022
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00BD0011
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00BD00A1
.text C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00BC0FC3
.text C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00BC0065
.text C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00BC0014
.text C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00BC0FD4
.text C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00BC0040
.text C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00BC0FEF
.text C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00BC0F9E
.text C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [DC, 88]
.text C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00BC002F
.text C:\WINDOWS\system32\svchost.exe[1568] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00C00F9E
.text C:\WINDOWS\system32\svchost.exe[1568] msvcrt.dll!system 77C293C7 5 Bytes JMP 00C00FC3
.text C:\WINDOWS\system32\svchost.exe[1568] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00C00022
.text C:\WINDOWS\system32\svchost.exe[1568] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00C00000
.text C:\WINDOWS\system32\svchost.exe[1568] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00C00033
.text C:\WINDOWS\system32\svchost.exe[1568] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00C00011
.text C:\WINDOWS\system32\svchost.exe[1568] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BF0FE5
.text C:\WINDOWS\system32\svchost.exe[1596] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00DF0000
.text C:\WINDOWS\system32\svchost.exe[1596] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00DF0FD1
.text C:\WINDOWS\system32\svchost.exe[1596] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00DF0011
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00DE0000
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00DE0097
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00DE0086
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00DE0FA2
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00DE005F
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00DE003D
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00DE00D9
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00DE00BE
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00DE0F62
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00DE00FB
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00DE0116
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00DE004E
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00DE0011
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00DE0F91
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00DE002C
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00DE0FDB
.text C:\WINDOWS\system32\svchost.exe[1596] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00DE00EA
.text C:\WINDOWS\system32\svchost.exe[1596] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00DD0FB9
.text C:\WINDOWS\system32\svchost.exe[1596] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00DD0F9E
.text C:\WINDOWS\system32\svchost.exe[1596] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00DD0FD4
.text C:\WINDOWS\system32\svchost.exe[1596] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00DD000A
.text C:\WINDOWS\system32\svchost.exe[1596] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00DD0051
.text C:\WINDOWS\system32\svchost.exe[1596] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00DD0FEF
.text C:\WINDOWS\system32\svchost.exe[1596] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00DD0040
.text C:\WINDOWS\system32\svchost.exe[1596] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00DD0025
.text C:\WINDOWS\system32\svchost.exe[1596] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00E10F7F
.text C:\WINDOWS\system32\svchost.exe[1596] msvcrt.dll!system 77C293C7 5 Bytes JMP 00E10FA4
.text C:\WINDOWS\system32\svchost.exe[1596] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00E10FC6
.text C:\WINDOWS\system32\svchost.exe[1596] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00E10000
.text C:\WINDOWS\system32\svchost.exe[1596] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00E10FB5
.text C:\WINDOWS\system32\svchost.exe[1596] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00E10FE3
.text C:\WINDOWS\system32\svchost.exe[1596] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00E0000A
.text C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe[1764] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 62419A20 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe[1764] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 62419AE2 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\WINDOWS\Explorer.EXE[1916] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 01900FEF
.text C:\WINDOWS\Explorer.EXE[1916] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 01900025
.text C:\WINDOWS\Explorer.EXE[1916] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 01900014
.text C:\WINDOWS\Explorer.EXE[1916] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 018F0000
.text C:\WINDOWS\Explorer.EXE[1916] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 018F0F5C
.text C:\WINDOWS\Explorer.EXE[1916] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 018F0F6D
.text C:\WINDOWS\Explorer.EXE[1916] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 018F0047
.text C:\WINDOWS\Explorer.EXE[1916] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 018F0F8A
.text C:\WINDOWS\Explorer.EXE[1916] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 018F0FAF
.text C:\WINDOWS\Explorer.EXE[1916] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 018F00A4
.text C:\WINDOWS\Explorer.EXE[1916] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 018F0087
.text C:\WINDOWS\Explorer.EXE[1916] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 018F00D0
.text C:\WINDOWS\Explorer.EXE[1916] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 018F0F41
.text C:\WINDOWS\Explorer.EXE[1916] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 018F00EB
.text C:\WINDOWS\Explorer.EXE[1916] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 018F002C
.text C:\WINDOWS\Explorer.EXE[1916] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 018F0011
.text C:\WINDOWS\Explorer.EXE[1916] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 018F0076
.text C:\WINDOWS\Explorer.EXE[1916] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 018F0FC0
.text C:\WINDOWS\Explorer.EXE[1916] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 018F0FDB
.text C:\WINDOWS\Explorer.EXE[1916] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 018F00B5
.text C:\WINDOWS\Explorer.EXE[1916] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 018E002F
.text C:\WINDOWS\Explorer.EXE[1916] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 018E007D
.text C:\WINDOWS\Explorer.EXE[1916] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 018E0FDE
.text C:\WINDOWS\Explorer.EXE[1916] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 018E0FEF
.text C:\WINDOWS\Explorer.EXE[1916] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 018E0062
.text C:\WINDOWS\Explorer.EXE[1916] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 018E000A
.text C:\WINDOWS\Explorer.EXE[1916] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 018E0051
.text C:\WINDOWS\Explorer.EXE[1916] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 018E0040
.text C:\WINDOWS\Explorer.EXE[1916] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 030A0033
.text C:\WINDOWS\Explorer.EXE[1916] msvcrt.dll!system 77C293C7 5 Bytes JMP 030A0F9E
.text C:\WINDOWS\Explorer.EXE[1916] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 030A0FD4
.text C:\WINDOWS\Explorer.EXE[1916] msvcrt.dll!_open 77C2F566 5 Bytes JMP 030A0FEF
.text C:\WINDOWS\Explorer.EXE[1916] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 030A0FC3
.text C:\WINDOWS\Explorer.EXE[1916] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 030A000C
.text C:\WINDOWS\Explorer.EXE[1916] WININET.dll!InternetOpenA 3D95D690 5 Bytes JMP 01910FEF
.text C:\WINDOWS\Explorer.EXE[1916] WININET.dll!InternetOpenW 3D95DB09 5 Bytes JMP 0191000A
.text C:\WINDOWS\Explorer.EXE[1916] WININET.dll!InternetOpenUrlA 3D95F3A4 5 Bytes JMP 01910025
.text C:\WINDOWS\Explorer.EXE[1916] WININET.dll!InternetOpenUrlW 3D9A6D5F 5 Bytes JMP 01910FD4
.text C:\WINDOWS\Explorer.EXE[1916] WS2_32.dll!socket 71AB4211 5 Bytes JMP 03090FEF
.text C:\WINDOWS\system32\svchost.exe[2212] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00BC0000
.text C:\WINDOWS\system32\svchost.exe[2212] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00BC0FE5
.text C:\WINDOWS\system32\svchost.exe[2212] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00BC001B
.text C:\WINDOWS\system32\svchost.exe[2212] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BB0000
.text C:\WINDOWS\system32\svchost.exe[2212] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BB00A9
.text C:\WINDOWS\system32\svchost.exe[2212] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BB008E
.text C:\WINDOWS\system32\svchost.exe[2212] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BB007D
.text C:\WINDOWS\system32\svchost.exe[2212] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BB006C
.text C:\WINDOWS\system32\svchost.exe[2212] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BB005B
.text C:\WINDOWS\system32\svchost.exe[2212] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BB0F7C
.text C:\WINDOWS\system32\svchost.exe[2212] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BB00C4
.text C:\WINDOWS\system32\svchost.exe[2212] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BB0104
.text C:\WINDOWS\system32\svchost.exe[2212] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BB00E9
.text C:\WINDOWS\system32\svchost.exe[2212] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00BB0F50
.text C:\WINDOWS\system32\svchost.exe[2212] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00BB0FCA
.text C:\WINDOWS\system32\svchost.exe[2212] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00BB0FEF
.text C:\WINDOWS\system32\svchost.exe[2212] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00BB0FA3
.text C:\WINDOWS\system32\svchost.exe[2212] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00BB0036
.text C:\WINDOWS\system32\svchost.exe[2212] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00BB0025
.text C:\WINDOWS\system32\svchost.exe[2212] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00BB0F61
.text C:\WINDOWS\system32\svchost.exe[2212] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00BA002C
.text C:\WINDOWS\system32\svchost.exe[2212] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00BA005B
.text C:\WINDOWS\system32\svchost.exe[2212] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00BA0FD1
.text C:\WINDOWS\system32\svchost.exe[2212] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00BA0011
.text C:\WINDOWS\system32\svchost.exe[2212] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00BA0F94
.text C:\WINDOWS\system32\svchost.exe[2212] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00BA0000
.text C:\WINDOWS\system32\svchost.exe[2212] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00BA0FAF
.text C:\WINDOWS\system32\svchost.exe[2212] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [DA, 88]
.text C:\WINDOWS\system32\svchost.exe[2212] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00BA0FC0
.text C:\WINDOWS\system32\svchost.exe[2212] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00BD0FAD
.text C:\WINDOWS\system32\svchost.exe[2212] msvcrt.dll!system 77C293C7 5 Bytes JMP 00BD0FC8
.text C:\WINDOWS\system32\svchost.exe[2212] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00BD0038
.text C:\WINDOWS\system32\svchost.exe[2212] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00BD0000
.text C:\WINDOWS\system32\svchost.exe[2212] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00BD0FE3
.text C:\WINDOWS\system32\svchost.exe[2212] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00BD0011

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip MpFirewall.sys (McAfee Personal Firewall Driver/McAfee)
AttachedDevice \Driver\Tcpip \Device\Ip ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp MpFirewall.sys (McAfee Personal Firewall Driver/McAfee)
AttachedDevice \Driver\Tcpip \Device\Tcp ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp MpFirewall.sys (McAfee Personal Firewall Driver/McAfee)
AttachedDevice \Driver\Tcpip \Device\Udp ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp MpFirewall.sys (McAfee Personal Firewall Driver/McAfee)
AttachedDevice \Driver\Tcpip \Device\RawIp ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)

Device \FileSystem\Fastfat \Fat EDE63D20

AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (McAfee Link Driver/McAfee, Inc.)

Device \FileSystem\Cdfs \Cdfs DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions)

—- EOF - GMER 1.0.15 —-


Thanks again for your help! :)
Post #4
Hello k_selvage

How to disable McAfee Total Protection

Since the program appears to already be disabled it may not be an issue as you mentioned, but lets see if the following can help us:

  • Double click the McAfee icon on your taskbar to open Security Center.
  • Click on Real Time Scanning (top).
  • Click on Real Time Scanning Settings (right).
  • You can disable Antivirus there and tell it for how long.
  • To disable the firewall, click on Firewall then Settings.

  • Combofix


  • Download ComboFix from one of the following locations:

    Link 1
    Link 2

  • VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here .
  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  • Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
  • When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
  • Notes: Do not mouse-click Combofix's window while it is running. That may cause it to stall.
  • Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
  • Should there be issues with internet afterward:

    In IE: Tools Menu -> Internet Options -> Connections Tab -> Lan Settings -> uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.

    In Firefox: Tools Menu -> Options… -> Advanced Tab -> Network Tab -> "Settings" under Connection and uncheck the proxyserver, set it to No Proxy.

Please post the ComboFix log in your next reply.
Post #5
Well…I messed up. I clicked on the Combofix window while the program was running, and it stalled out. I now have the computer shut down and will wait for further instruction since your post says not to re-run the program. Also, my Internet is no longer working, so I've been downloading the programs to a jump drive and then transferring them to my computer's desktop; would that cause the program to not work correctly? Sorry for messing up! :)
Post #6
Hello k_selvage

Sorry for messing up!

Not to worry, it happens :)

would that cause the program to not work correctly?

I do not believe so, most likely caused by clicking on the ComboFix window when it was running.

Please check your C drive to see if a log was created from the stalled run. If present, it will be called C:\ComboFix.txt

If no log was produced please run ComboFix again and post the log in your next reply.
Post #7
I checked my C drive and did not find a text document for ComboFix. However, I did find a computer icon named "ComboFix". Because the text log was not there, I tried re-running the program. Wen the program is running, how long should the blue window with the blinking cursor be on the screen? I let it stay that way for 3 hours before deciding that it wasn't doing anything and thus shut down the computer. Do you have any advice for me?
Post #8
Hello k_selvage

Do you have any advice for me?

Three hours is a long time for a ComboFix run. It is unusual for ComboFix to struggle, but not completely unheard of.

You should still have DDS on your machine. Please run DDS again as you did in post number 2 and post the log created for me to review. Once I have seen the log we'll go from there :)
Post #9
Here's the second DDS log:

.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by [removed] at 16:40:31 on 2011-07-12
.
============== Running Processes ===============
.
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
c:\program files\mcafee.com\agent\mcdetect.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\System32\alg.exe
C:\Documents and Settings\delbert selvage\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = https://www.esu9.org/webmail/src/login.php
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: McBrwHelper Class: {227b8aa8-daf2-4892-bd1d-73f568bcb24e} - c:\progra~1\mcafee.com\mps\mcbrhlpr.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO: McAfee Privacy Service Popup Blocker: {3ec8255f-e043-4cae-8b3b-b191550c2a22} - c:\program files\mcafee.com\mps\popupkiller.dll
BHO: McAfee AntiPhishing Filter: {41d68ed8-4cff-4115-88a6-6ebb8af19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20100914212344.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: McAfee VirusScan: {ba52b914-b692-46c4-b683-905236f6f655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [DellSupport] "c:\program files\dell support\DSAgnt.exe" /startup
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [cbrkjkgm] c:\docume~1\delber~1\locals~1\temp\ucjqkveuw\bjryeoahmof.exe
uRun: [lxTiueHQRFVJQV] c:\documents and settings\all users\application data\lxTiueHQRFVJQV.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [VSOCheckTask] "c:\progra~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
mRun: [OASClnt] c:\program files\mcafee.com\vso\oasclnt.exe
mRun: [MSKDetectorExe] c:\progra~1\mcafee\spamki~1\MSKDetct.exe /startup
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [VirusScan Online] c:\program files\mcafee.com\vso\mcvsshld.exe
mRun: [MPFExe] c:\progra~1\mcafee.com\person~1\MpfTray.exe
mRun: [DeviceDiscovery] c:\program files\hewlett-packard\digital imaging\bin\hpotdd01.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [MPSExe] c:\progra~1\mcafee.com\mps\mscifapp.exe /embedding
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [HP Software Update] c:\program files\hewlett-packard\hp software update\HPWuSchd2.exe
mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [MSKAGENTEXE] c:\progra~1\mcafee\spamki~1\MskAgent.exe
uPolicies-explorer: NoDesktop = 1 (0x1)
mPolicies-system: DisableTaskMgr = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
IE: {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - {7DD73374-7187-4103-8F29-622AA25E7C40} - c:\program files\mcafee\spamkiller\mcapfbho.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
LSP: c:\windows\system32\mclsp.dll
Trusted Zone: musicmatch.com\online
DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - hxxp://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - hxxp://chat.yahoo.com/cab/yacsui.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} - hxxp://chat.yahoo.com/cab/yvwrctl.cab
TCP: DhcpNameServer = 192.168.254.254
TCP: Interfaces\{DA339A3E-62C3-44FC-9736-BFEF677DC04A} : DhcpNameServer = 192.168.254.254
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: igfxcui - igfxdev.dll
.
============= SERVICES / DRIVERS ===============
.
R? cfwids;McAfee Inc. cfwids
R? gupdate;Google Update Service (gupdate)
R? gupdatem;Google Update Service (gupdatem)
R? McOobeSv;McAfee OOBE Service
R? mcupdmgr.exe;McAfee SecurityCenter Update Manager
R? mfebopk;McAfee Inc. mfebopk
R? mfendisk;McAfee Core NDIS Intermediate Filter
R? mferkdet;McAfee Inc. mferkdet
S? McAfee SiteAdvisor Service;McAfee SiteAdvisor Service
S? McDetect.exe;McAfee WSC Integration
S? McNaiAnn;McAfee VirusScan Announcer
S? McProxy;McAfee Proxy Service
S? McShield;McShield
S? mfeavfk;McAfee Inc. mfeavfk
S? mfefire;McAfee Firewall Core Service
S? mfefirek;McAfee Inc. mfefirek
S? mfehidk;McAfee Inc. mfehidk
S? mfendiskmp;mfendiskmp
S? mfetdi2k;McAfee Inc. mfetdi2k
S? mfevtp;McAfee Validation Trust Protection Service
S? MPFIREWL;MPFIREWL
.
=============== Created Last 30 ================
.
2011-07-11 21:44:43 ——– d-s—w- C:\ComboFix
2011-06-21 21:11:41 ——– d–h–w- c:\windows\system32\wbem\Repository
2011-06-21 21:11:41 ——– d—–w- c:\windows\system32\wbem\repository\FS
2011-06-19 15:33:26 105472 —h–w- c:\windows\system32\dllcache\mup.sys
.
==================== Find3M ====================
.
2011-06-22 12:05:40 5852 –sha-w- c:\windows\system32\KGyGaAvL.sys
2011-06-22 12:05:37 88 –sh–r- c:\windows\system32\CC71837CDE.sys
2011-06-19 15:18:25 404640 —ha-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-02 15:31:52 692736 —ha-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25:27 151552 —ha-w- c:\windows\system32\schannel.dll
2011-04-29 16:19:43 456320 —ha-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-25 16:11:12 916480 —ha-w- c:\windows\system32\wininet.dll
2011-04-25 16:11:11 43520 —ha-w- c:\windows\system32\licmgr10.dll
2011-04-25 16:11:11 1469440 —h–w- c:\windows\system32\inetcpl.cpl
2011-04-25 12:01:22 385024 —ha-w- c:\windows\system32\html.iec
2011-04-21 13:37:43 105472 —ha-w- c:\windows\system32\drivers\mup.sys
.
============= FINISH: 16:41:57.95 ===============


When I ran DDS, it also created a second "attach" log. Do you want me to post those results also?
Post #10
Hello k_selvage

When I ran DDS, it also created a second "attach" log. Do you want me to post those results also?

There is no need to post the attach log again (but thanks for asking :) ).

Please read through all of the instructions below before beginning. If you have any questions just ask.

I've been downloading the programs to a jump drive and then transferring them to my computer's desktop

If the machine you are using to download the required tools runs on XP, please download and run the following tool first to reduce the chances of cross infection:

  • Please download Flash Disinfector


    • Click here to download Flash Disinfector and save the file (called Flash_Disinfector.exe) to your desktop.
    • Double click on the Flash_Disinfector.exe icon to run the program and follow any prompts that may appear.
    • The program may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so if prompted.
    • Wait until Flash disinfector has finished scanning and then exit the program.
    • Reboot your computer.

    If it runs on Vista/ Win7, use this one instead:

  • AutoRun Eater


    • Download Autorun Eater and save it to your desktop.
    • Plug all of your removable storage devices into the machine (USB sticks etc) and run the tool.

  • Please make a backup of your Registry


    • The following fix requires altering your Windows Registry. Therefore we need to back it up in case we run into problems:
    • Download ERUNT to your Desktop (Right click the link, select "Save Link/Target As"…, select your Desktop and press Save).
    • Transfer the downloaded zip file to the desktop of the infected machine.
    • Right click erunt.zip, choose "Extract All…" and follow the prompts to unzip the program.
    • Open the ERUNT folder on your Desktop and double click ERUNT.exe to start the program.
    • Click OK for all the prompts to back up your registry to the default location.
    • Note: if it becomes necessary to restore the registry, open the backup folder and start ERDNT.exe.

  • Trusted Zones:


    • I can see that you have a web site stored in the "Trusted Zones" section of your log. The only advantage to having a domain stored in your Trusted Zones, is that the domain will not prompt you for any permission before installing software or updates from the "trusted" site. This also means however, that if a malware exploit comes out where a site can spoof their domain name to match one stored in your Trusted Zones, then you will never know when (or what) they install on your machine.
    • If you remove this entry, these sites will still be able to install software, but only after receiving permission from you to do so, putting you back in control.
    • I suggest you remove the following entries:

    • Trusted Zone: musicmatch.com\online


    • You can remove sites from your Trusted Zones via:
    • IE > Tools > Internet Options > Security tab > Trusted Zone > Sites.

  • Please download OTM


    • Please download OTM by OldTimer by clicking here.
    • Save the file (called OTM.exe) to your desktop.

    • Next
    • Open Notepad (Click on "Start", then on "Run" and type "notepad" (without quotations) in the Open field, then click on "OK").
    • Copy and Paste the text in the codebox below into the open Notepad window (DO NOT include the word code):

      :Processes 
explorer.exe

:Files
c:\docume~1\delber~1\locals~1\temp\ucjqkveuw\bjryeoahmof.exe
c:\documents and settings\all users\application data\lxTiueHQRFVJQV.exe

:Reg
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cbrkjkgm"=-
"lxTiueHQRFVJQV"=-

:Commands
[Purity]
[Emptyflash]
[Start Explorer]
[Reboot]
    • Save this as OTMFix.txt, change the "Save as type" to "All Files" and save it to your desktop.
    • Once you have done that, transfer OTM.exe and OTMFix.txt to the infected machine.
    • Once transfered to the infected system, Double click on the OTM.exe icon to run the program and then open OTMFix.txt
    • Copy the lines from OTMFix.txt to your clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
    • In the open OTM.exe window, Right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
    • Click the Moveit! button.
    • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and save it as a notepad document.
    • Close OTM.
    • Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File -> Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

    Please post the OTM log in your next reply along with a new DDS log (just the DDS.txt).
Post #11
Come to think of it, I actually have all my files and folders backed up on an external drive. Is there any way to skip all this troubleshooting and have the computer backdated to its original state when it was originally bought? Would that get rid of the virus? I'm starting to run into a time crunch because I'm moving in about a week and have been stressing out trying to find time to pack. :)
Post #12
Hello k_selvage

Sorry for the delay - I only just got a notification of your post :unsure:

You could perform a system restore to a date before the infection occurred (provided no restore points have been infected) or alternatively your could go through a reformat and re-installation of XP which would wipe everything from the machine. You could then put all of your saved files back onto the system. Provided none of those files are infected things ought to be okay.

I am happy to leave your thread open for longer if you need more time.

Let me know what you decide to do.
Post #13
Since I inserted a jump drive into my infected computer while I was working on running the programs you suggested, do you have any advice for "cleaning" the jump drive? I don't want to keep using the jump drive and infecting the other computers that I use it on. Also, do you have instructions on how to backdate and re-format/reinstall Windows XP? I think I could probably figure out how to do it on my own, but sometimes it's faster when you have the instructions right in front of you. :)
Post #14
Hello k_selvage

any advice for "cleaning" the jump drive

Flash disinfector would have disabled the autorun facility on the drive but as for cleaning it, if it were me I would throw it out it and get a new one.

If you do not need the data stored on the drive you could try a quick format:

  • Insert your USB drive ino the machine.
  • Click on Start > My Computer > Right click your USB drive > choose Format > Quick format.

re-format/reinstall Windows XP?

For information about performing a Clean install of XP click the following link:

http://forums.whatthetech.com/How_Reformat…tem_t91962.html


If you have a set of recovery disks or a recovery partition installed, the following links contain information about how to return your machine back to factory settings:

Lenovo Machines: http://www.pc.ibm.com/us/think/thinkvantag…uerecovery.html

HP Machines: http://h10010.www1.hp.com/ewfrf/wc/documen…&dlc=en#N81

Hope this helps :)
Post #15
I decided to follow your instructions from Post #10 because now my external hide drive seems to be having problems; when I plug it into an uninfected computer, the first files and folders appear fine. However, when I go a little deeper by clicking on an immediate file, the remaining files and folders are hidden (just like they are on my infected computer). Therefore, I'm leery that my "backup" files are indeed uninfected, and I don't want to restore my computer without that backup. :)

A couple of things about my infected computer:

1. In my antivirus (McAfee Total Protection), the Firewall says it's on, but when I go into the "Settings" portion, it actually says that it's off. When I click "Turn On", it automatically shuts back off. Also, in the Windows Security Center, it again says that my Virus Protection is turned off.

2. I checked my Trusted Sites, and I did not find musicmatch.com\online. Actually, there wasn't anythiing listed there as a trusted site.


Here is the result for the OTM log:

========== PROCESSES ==========
Process explorer.exe killed successfully!
========== FILES ==========
File/Folder c:\docume~1\delber~1\locals~1\temp\ucjqkveuw\bjryeoahmof.exe not found.
File/Folder c:\documents and settings\all users\application data\lxTiueHQRFVJQV.exe not found.
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\cbrkjkgm deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\lxTiueHQRFVJQV deleted successfully.
========== COMMANDS ==========

OTM by OldTimer - Version 3.1.18.0 log created on 07182011_171317


Here is the result for another DDS log:

.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by [removed] at 17:17:43 on 2011-07-18
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.80 [GMT -5:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Firewall *Enabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
c:\program files\mcafee.com\agent\mcagent.exe
svchost.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
c:\program files\mcafee.com\agent\mcdetect.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\WINDOWS\system32\wscntfy.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = https://www.esu9.org/webmail/src/login.php
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: McBrwHelper Class: {227b8aa8-daf2-4892-bd1d-73f568bcb24e} - c:\progra~1\mcafee.com\mps\mcbrhlpr.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO: McAfee Privacy Service Popup Blocker: {3ec8255f-e043-4cae-8b3b-b191550c2a22} - c:\program files\mcafee.com\mps\popupkiller.dll
BHO: McAfee AntiPhishing Filter: {41d68ed8-4cff-4115-88a6-6ebb8af19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20100914212344.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: McAfee VirusScan: {ba52b914-b692-46c4-b683-905236f6f655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [DellSupport] "c:\program files\dell support\DSAgnt.exe" /startup
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [VSOCheckTask] "c:\progra~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
mRun: [OASClnt] c:\program files\mcafee.com\vso\oasclnt.exe
mRun: [MSKDetectorExe] c:\progra~1\mcafee\spamki~1\MSKDetct.exe /startup
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [VirusScan Online] c:\program files\mcafee.com\vso\mcvsshld.exe
mRun: [MPFExe] c:\progra~1\mcafee.com\person~1\MpfTray.exe
mRun: [DeviceDiscovery] c:\program files\hewlett-packard\digital imaging\bin\hpotdd01.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [MPSExe] c:\progra~1\mcafee.com\mps\mscifapp.exe /embedding
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [HP Software Update] c:\program files\hewlett-packard\hp software update\HPWuSchd2.exe
mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [MSKAGENTEXE] c:\progra~1\mcafee\spamki~1\MskAgent.exe
StartupFolder: c:\documents and settings\delbert selvage\start menu\programs\startup\PowerReg Scheduler.exe
uPolicies-explorer: NoDesktop = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
IE: {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - {7DD73374-7187-4103-8F29-622AA25E7C40} - c:\program files\mcafee\spamkiller\mcapfbho.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
LSP: c:\windows\system32\mclsp.dll
Trusted Zone: musicmatch.com\online
DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - hxxp://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - hxxp://chat.yahoo.com/cab/yacsui.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} - hxxp://chat.yahoo.com/cab/yvwrctl.cab
TCP: DhcpNameServer = 192.168.254.254
TCP: Interfaces\{DA339A3E-62C3-44FC-9736-BFEF677DC04A} : DhcpNameServer = 192.168.254.254
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: igfxcui - igfxdev.dll
.
============= SERVICES / DRIVERS ===============
.
R?2 McShield;McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2010-9-14 171168]
R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-9-14 386712]
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [2010-9-14 84072]
R1 MPFIREWL;MPFIREWL;c:\windows\system32\drivers\MpFirewall.sys [2006-4-26 80640]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-9-14 271480]
R2 McDetect.exe;McAfee WSC Integration;c:\program files\mcafee.com\agent\Mcdetect.exe [2006-4-26 126976]
R2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-9-14 271480]
R2 McProxy;McAfee Proxy Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-9-14 271480]
R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2010-9-14 188136]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\common files\mcafee\systemcore\mfevtps.exe [2010-9-14 141792]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-9-14 152992]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-9-14 312904]
R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [2010-9-14 88544]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-1-28 136176]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-9-14 55840]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-1-28 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-7-15 39984]
S3 mcupdmgr.exe;McAfee SecurityCenter Update Manager;c:\progra~1\mcafee.com\agent\mcupdmgr.exe [2006-4-26 245760]
S3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-9-14 52104]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [2010-9-14 88544]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-9-14 84264]
S4 McOobeSv;McAfee OOBE Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-9-14 271480]
.
=============== Created Last 30 ================
.
2011-07-18 22:13:17 ——– d—–w- C:\_OTM
2011-07-16 06:53:47 ——– d—–w- c:\documents and settings\delbert selvage\application data\Malwarebytes
2011-07-15 21:19:30 39984 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-15 21:19:27 ——– d—–w- c:\documents and settings\all users\application data\Malwarebytes
2011-07-15 21:19:24 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-07-15 21:19:24 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-07-11 21:44:43 ——– d-s—w- C:\ComboFix
2011-06-21 21:11:41 ——– d–h–w- c:\windows\system32\wbem\Repository
2011-06-21 21:11:41 ——– d—–w- c:\windows\system32\wbem\repository\FS
2011-06-19 15:33:26 105472 —h–w- c:\windows\system32\dllcache\mup.sys
.
==================== Find3M ====================
.
2011-06-22 12:05:40 5852 –sha-w- c:\windows\system32\KGyGaAvL.sys
2011-06-22 12:05:37 88 –sh–r- c:\windows\system32\CC71837CDE.sys
2011-06-19 15:18:25 404640 —ha-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-02 15:31:52 692736 —ha-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25:27 151552 —ha-w- c:\windows\system32\schannel.dll
2011-04-29 16:19:43 456320 —ha-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-25 16:11:12 916480 —ha-w- c:\windows\system32\wininet.dll
2011-04-25 16:11:11 43520 —ha-w- c:\windows\system32\licmgr10.dll
2011-04-25 16:11:11 1469440 —h–w- c:\windows\system32\inetcpl.cpl
2011-04-25 12:01:22 385024 —ha-w- c:\windows\system32\html.iec
2011-04-21 13:37:43 105472 —ha-w- c:\windows\system32\drivers\mup.sys
.
============= FINISH: 17:21:49.29 ===============

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI