GMER 1.0.12.12244 -
http://www.gmer.net
Rootkit scan 2007-04-16 15:03:15
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.12 ----
Code \SystemRoot\system32\drivers\mfehidk.sys ZwCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys ZwCreateKey
Code \SystemRoot\system32\drivers\mfehidk.sys ZwCreateProcess
Code \SystemRoot\system32\drivers\mfehidk.sys ZwDeleteKey
Code \SystemRoot\system32\drivers\mfehidk.sys ZwDeleteValueKey
Code \SystemRoot\system32\drivers\mfehidk.sys ZwMapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys ZwOpenKey
Code \SystemRoot\system32\drivers\mfehidk.sys ZwProtectVirtualMemory
Code \SystemRoot\system32\drivers\mfehidk.sys ZwRenameKey
Code \SystemRoot\system32\drivers\mfehidk.sys ZwSetValueKey
Code \SystemRoot\system32\drivers\mfehidk.sys ZwTerminateProcess
Code \SystemRoot\system32\drivers\mfehidk.sys ZwUnmapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys ZwYieldExecution
Code \SystemRoot\system32\drivers\mfehidk.sys NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys NtMapViewOfSection
---- Kernel code sections - GMER 1.0.12 ----
.text ntkrnlpa.exe!ZwYieldExecution 8050189C 7 Bytes JMP A95A35BD \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntkrnlpa.exe!NtCreateFile 8056D3CA 5 Bytes JMP A95A357F \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntkrnlpa.exe!NtMapViewOfSection 805A6206 7 Bytes JMP A95A35D3 \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntkrnlpa.exe!ZwUnmapViewOfSection 805A701C 5 Bytes JMP A95A35E9 \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntkrnlpa.exe!ZwProtectVirtualMemory 805AC78E 7 Bytes JMP A95A3593 \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntkrnlpa.exe!ZwCreateProcess 805C5F8E 5 Bytes JMP A95A35A9 \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntkrnlpa.exe!ZwTerminateProcess 805C776C 5 Bytes JMP A95A356B \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntkrnlpa.exe!ZwSetValueKey 80617546 7 Bytes JMP A95A3555 \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntkrnlpa.exe!ZwRenameKey 806188AC 7 Bytes JMP A95A3529 \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntkrnlpa.exe!ZwCreateKey 80618E86 5 Bytes JMP A95A34FF \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntkrnlpa.exe!ZwDeleteKey 80619316 7 Bytes JMP A95A3513 \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntkrnlpa.exe!ZwDeleteValueKey 806194E6 7 Bytes JMP A95A353F \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntkrnlpa.exe!ZwOpenKey 8061A21C 5 Bytes JMP A95A34EB \SystemRoot\system32\drivers\mfehidk.sys
? C:\WINDOWS\system32\DRIVERS\update.sys
? C:\WINDOWS\TEMP\mc25.tmp The system cannot find the file specified.
---- User code sections - GMER 1.0.12 ----
.text C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe[264] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe[264] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe[264] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe[264] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe[264] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe[264] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes [ 45, 54, 7F, E2 ]
.text C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe[264] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe[264] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe[264] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\EXPLORER.EXE[576] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\EXPLORER.EXE[576] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 11, 5F ]
.text C:\WINDOWS\EXPLORER.EXE[576] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 02B40000
.text C:\WINDOWS\EXPLORER.EXE[576] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 02B400B3
.text C:\WINDOWS\EXPLORER.EXE[576] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 02B40098
.text C:\WINDOWS\EXPLORER.EXE[576] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 02B40087
.text C:\WINDOWS\EXPLORER.EXE[576] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 02B4006C
.text C:\WINDOWS\EXPLORER.EXE[576] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 02B4005B
.text C:\WINDOWS\EXPLORER.EXE[576] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 02B40F88
.text C:\WINDOWS\EXPLORER.EXE[576] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 02B40FA3
.text C:\WINDOWS\EXPLORER.EXE[576] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 02B40F55
.text C:\WINDOWS\EXPLORER.EXE[576] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 02B40F66
.text C:\WINDOWS\EXPLORER.EXE[576] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 02B40109
.text C:\WINDOWS\EXPLORER.EXE[576] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 02B40FCA
.text C:\WINDOWS\EXPLORER.EXE[576] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 02B4001B
.text C:\WINDOWS\EXPLORER.EXE[576] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 02B400C4
.text C:\WINDOWS\EXPLORER.EXE[576] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 02B40040
.text C:\WINDOWS\EXPLORER.EXE[576] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 02B40FE5
.text C:\WINDOWS\EXPLORER.EXE[576] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 02B40F77
.text C:\WINDOWS\EXPLORER.EXE[576] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 02B30011
.text C:\WINDOWS\EXPLORER.EXE[576] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 02B30F76
.text C:\WINDOWS\EXPLORER.EXE[576] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 02B30000
.text C:\WINDOWS\EXPLORER.EXE[576] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 02B30FCA
.text C:\WINDOWS\EXPLORER.EXE[576] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 02B30F91
.text C:\WINDOWS\EXPLORER.EXE[576] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 02B3003D
.text C:\WINDOWS\EXPLORER.EXE[576] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 02B30FEF
.text C:\WINDOWS\EXPLORER.EXE[576] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 02B30022
.text C:\WINDOWS\EXPLORER.EXE[576] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F130F5A
.text C:\WINDOWS\EXPLORER.EXE[576] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F1B0F5A
.text C:\WINDOWS\EXPLORER.EXE[576] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F170F5A
.text C:\WINDOWS\EXPLORER.EXE[576] WININET.dll!InternetOpenA 771CC859 5 Bytes JMP 02A0000A
.text C:\WINDOWS\EXPLORER.EXE[576] WININET.dll!InternetOpenW 771CCE91 5 Bytes JMP 02A00025
.text C:\WINDOWS\EXPLORER.EXE[576] WININET.dll!InternetOpenUrlA 771D06CD 5 Bytes JMP 02A00036
.text C:\WINDOWS\EXPLORER.EXE[576] WININET.dll!InternetOpenUrlW 7721A881 5 Bytes JMP 02A00FE5
.text C:\WINDOWS\EXPLORER.EXE[576] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 02B90000
.text C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe[704] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe[704] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe[704] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe[704] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe[704] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe[704] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe[704] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe[704] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe[748] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe[748] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe[748] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe[748] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe[748] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe[748] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe[748] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe[748] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\PROGRA~1\COMMON~1\McAfee\RedirSvc\RedirSvc.exe[836] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\COMMON~1\McAfee\RedirSvc\RedirSvc.exe[836] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\PROGRA~1\COMMON~1\McAfee\RedirSvc\RedirSvc.exe[836] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\PROGRA~1\COMMON~1\McAfee\RedirSvc\RedirSvc.exe[836] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\PROGRA~1\COMMON~1\McAfee\RedirSvc\RedirSvc.exe[836] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\PROGRA~1\COMMON~1\McAfee\RedirSvc\RedirSvc.exe[836] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\PROGRA~1\COMMON~1\McAfee\RedirSvc\RedirSvc.exe[836] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\PROGRA~1\COMMON~1\McAfee\RedirSvc\RedirSvc.exe[836] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\SYSTEM32\CSRSS.EXE[852] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\SYSTEM32\CSRSS.EXE[852] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\WINDOWS\SYSTEM32\CSRSS.EXE[852] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\SYSTEM32\CSRSS.EXE[852] KERNEL32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\SYSTEM32\CSRSS.EXE[852] KERNEL32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\SYSTEM32\CSRSS.EXE[852] KERNEL32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\SYSTEM32\CSRSS.EXE[852] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\WINDOWS\SYSTEM32\CSRSS.EXE[852] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\WINDOWS\SYSTEM32\WINLOGON.EXE[876] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\SYSTEM32\WINLOGON.EXE[876] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\WINDOWS\SYSTEM32\WINLOGON.EXE[876] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\SYSTEM32\WINLOGON.EXE[876] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\SYSTEM32\WINLOGON.EXE[876] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\SYSTEM32\WINLOGON.EXE[876] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\WINDOWS\SYSTEM32\WINLOGON.EXE[876] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\WINDOWS\SYSTEM32\WINLOGON.EXE[876] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 11, 5F ]
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 010A0FE5
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 010A005B
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 010A0F66
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 010A004A
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 010A002F
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 010A0F97
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 010A0091
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 010A0080
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 010A0EF8
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 010A0F13
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 010A0EE7
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 010A001E
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 010A0FD4
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 010A0F55
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 010A0FB2
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 010A0FC3
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 010A0F2E
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 0096002F
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 0096006C
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00960FDE
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00960FEF
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 0096005B
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 0096004A
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 0096000A
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00960FC3
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F1B0F5A
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F170F5A
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F130F5A
.text C:\WINDOWS\SYSTEM32\SERVICES.EXE[920] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00930FEF
.text C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe[1048] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe[1048] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe[1048] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe[1048] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe[1048] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe[1048] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe[1048] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe[1048] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe[1188] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe[1188] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe[1188] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe[1188] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe[1188] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe[1188] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe[1188] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe[1188] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\Program Files\Apoint\Apoint.exe[1264] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Apoint\Apoint.exe[1264] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\Program Files\Apoint\Apoint.exe[1264] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Apoint\Apoint.exe[1264] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Apoint\Apoint.exe[1264] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Apoint\Apoint.exe[1264] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\Program Files\Apoint\Apoint.exe[1264] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\Program Files\Apoint\Apoint.exe[1264] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 11, 5F ]
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 01B40FEF
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 01B40FA8
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 01B40093
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 01B40FB9
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 01B40076
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 01B40FD4
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 01B40F8D
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 01B400D5
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 01B40F3C
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 01B40F57
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 01B40F21
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 01B4005B
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 01B40014
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 01B400B8
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 01B40040
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 01B40025
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 01B40F72
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 01B30F94
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 01B30025
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 01B30FAF
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 01B30FD4
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 01B3000A
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 01B30F68
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 01B30FEF
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 01B30F83
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F1B0F5A
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F170F5A
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F130F5A
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 01B0000A
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] WININET.dll!InternetOpenA 771CC859 5 Bytes JMP 01B10000
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] WININET.dll!InternetOpenW 771CCE91 5 Bytes JMP 01B10FDB
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] WININET.dll!InternetOpenUrlA 771D06CD 5 Bytes JMP 01B10011
.text C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1284] WININET.dll!InternetOpenUrlW 7721A881 5 Bytes JMP 01B10FC0
.text C:\WINDOWS\SYSTEM32\WLTRAY.EXE[1316] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\SYSTEM32\WLTRAY.EXE[1316] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\WINDOWS\SYSTEM32\WLTRAY.EXE[1316] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\SYSTEM32\WLTRAY.EXE[1316] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\SYSTEM32\WLTRAY.EXE[1316] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\SYSTEM32\WLTRAY.EXE[1316] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\SYSTEM32\WLTRAY.EXE[1316] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\WINDOWS\SYSTEM32\WLTRAY.EXE[1316] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\Program Files\Common Files\AOL\1121872257\EE\aolsoftware.exe[1364] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Common Files\AOL\1121872257\EE\aolsoftware.exe[1364] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\Program Files\Common Files\AOL\1121872257\EE\aolsoftware.exe[1364] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\AOL\1121872257\EE\aolsoftware.exe[1364] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Common Files\AOL\1121872257\EE\aolsoftware.exe[1364] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Common Files\AOL\1121872257\EE\aolsoftware.exe[1364] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\Program Files\Common Files\AOL\1121872257\EE\aolsoftware.exe[1364] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\Program Files\Common Files\AOL\1121872257\EE\aolsoftware.exe[1364] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\Program Files\QuickTime\qttask.exe[1516] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\QuickTime\qttask.exe[1516] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\Program Files\QuickTime\qttask.exe[1516] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\QuickTime\qttask.exe[1516] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\QuickTime\qttask.exe[1516] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\QuickTime\qttask.exe[1516] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\Program Files\QuickTime\qttask.exe[1516] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\Program Files\QuickTime\qttask.exe[1516] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\Program Files\Spyware Doctor\swdoctor.exe[1596] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Spyware Doctor\swdoctor.exe[1596] USER32.dll!DispatchMessageA 7E4196B8 6 Bytes JMP 5F040F5A
.text C:\Program Files\Spyware Doctor\swdoctor.exe[1596] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F120F5A
.text C:\Program Files\Spyware Doctor\swdoctor.exe[1596] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F0E0F5A
.text C:\Program Files\Spyware Doctor\swdoctor.exe[1596] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Messenger\msmsgs.exe[1624] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Messenger\msmsgs.exe[1624] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 11, 5F ]
.text C:\Program Files\Messenger\msmsgs.exe[1624] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00EF0000
.text C:\Program Files\Messenger\msmsgs.exe[1624] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00EF0F57
.text C:\Program Files\Messenger\msmsgs.exe[1624] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00EF0F68
.text C:\Program Files\Messenger\msmsgs.exe[1624] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00EF0F83
.text C:\Program Files\Messenger\msmsgs.exe[1624] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00EF0F94
.text C:\Program Files\Messenger\msmsgs.exe[1624] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00EF0FB9
.text C:\Program Files\Messenger\msmsgs.exe[1624] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00EF008C
.text C:\Program Files\Messenger\msmsgs.exe[1624] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00EF0071
.text C:\Program Files\Messenger\msmsgs.exe[1624] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00EF00B8
.text C:\Program Files\Messenger\msmsgs.exe[1624] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00EF0F1F
.text C:\Program Files\Messenger\msmsgs.exe[1624] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 00EF00D3
.text C:\Program Files\Messenger\msmsgs.exe[1624] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 00EF0040
.text C:\Program Files\Messenger\msmsgs.exe[1624] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 00EF0FE5
.text C:\Program Files\Messenger\msmsgs.exe[1624] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 00EF0F46
.text C:\Program Files\Messenger\msmsgs.exe[1624] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 00EF001B
.text C:\Program Files\Messenger\msmsgs.exe[1624] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 00EF0FD4
.text C:\Program Files\Messenger\msmsgs.exe[1624] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00EF00A7
.text C:\Program Files\Messenger\msmsgs.exe[1624] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00EE0F9E
.text C:\Program Files\Messenger\msmsgs.exe[1624] ADVAPI32.dll!RegCreateKeyExW 77DD7535 1 Byte [ E9 ]
.text C:\Program Files\Messenger\msmsgs.exe[1624] ADVAPI32.dll!RegCreateKeyExW + 2 77DD7537 3 Bytes [ 8A, 10, 89 ]
.text C:\Program Files\Messenger\msmsgs.exe[1624] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00EE0FB9
.text C:\Program Files\Messenger\msmsgs.exe[1624] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00EE0FCA
.text C:\Program Files\Messenger\msmsgs.exe[1624] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00EE0F7C
.text C:\Program Files\Messenger\msmsgs.exe[1624] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00EE0F8D
.text C:\Program Files\Messenger\msmsgs.exe[1624] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00EE0FEF
.text C:\Program Files\Messenger\msmsgs.exe[1624] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00EE000A
.text C:\Program Files\Messenger\msmsgs.exe[1624] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F130F5A
.text C:\Program Files\Messenger\msmsgs.exe[1624] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F1B0F5A
.text C:\Program Files\Messenger\msmsgs.exe[1624] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F170F5A
.text C:\Program Files\Messenger\msmsgs.exe[1624] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00E6000A
.text C:\Program Files\Messenger\msmsgs.exe[1624] WININET.dll!InternetOpenA 771CC859 5 Bytes JMP 00EC0000
.text C:\Program Files\Messenger\msmsgs.exe[1624] WININET.dll!InternetOpenW 771CCE91 5 Bytes JMP 00EC001B
.text C:\Program Files\Messenger\msmsgs.exe[1624] WININET.dll!InternetOpenUrlA 771D06CD 5 Bytes JMP 00EC0FDB
.text C:\Program Files\Messenger\msmsgs.exe[1624] WININET.dll!InternetOpenUrlW 7721A881 5 Bytes JMP 00EC0FC0
.text C:\WINDOWS\SYSTEM32\BCMWLTRY.EXE[1812] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\SYSTEM32\BCMWLTRY.EXE[1812] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\WINDOWS\SYSTEM32\BCMWLTRY.EXE[1812] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\SYSTEM32\BCMWLTRY.EXE[1812] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\SYSTEM32\BCMWLTRY.EXE[1812] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\SYSTEM32\BCMWLTRY.EXE[1812] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\SYSTEM32\BCMWLTRY.EXE[1812] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\WINDOWS\SYSTEM32\BCMWLTRY.EXE[1812] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\WINDOWS\SYSTEM32\spoolsv.exe[1876] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\WINDOWS\SYSTEM32\spoolsv.exe[1876] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\WINDOWS\SYSTEM32\spoolsv.exe[1876] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\SYSTEM32\spoolsv.exe[1876] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\SYSTEM32\spoolsv.exe[1876] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\SYSTEM32\spoolsv.exe[1876] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\SYSTEM32\spoolsv.exe[1876] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\WINDOWS\SYSTEM32\spoolsv.exe[1876] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe[2016] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe[2016] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe[2016] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe[2016] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe[2016] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe[2016] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe[2016] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe[2016] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 11, 5F ]
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00260FEF
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00260F72
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00260F97
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00260FA8
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00260FC3
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00260FD4
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 0026009D
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00260082
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 002600B8
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00260F1F
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes [ 45, 54, 7F, E2 ]
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 00260F04
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 0026005B
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 0026000A
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 00260F57
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 00260036
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 00260025
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00260F30
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00350FC0
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 00350062
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 0035001B
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 0035000A
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00350FAF
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00350047
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00350FEF
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00350036
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F130F5A
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F1B0F5A
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F170F5A
.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[2076] ws2_32.dll!socket 71AB3B91 5 Bytes JMP 052C0000
.text C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[2276] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[2276] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[2276] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[2276] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[2276] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[2276] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[2276] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[2276] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\Program Files\McAfee\MPF\MpfSrv.exe[2388] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\McAfee\MPF\MpfSrv.exe[2388] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\Program Files\McAfee\MPF\MpfSrv.exe[2388] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\McAfee\MPF\MpfSrv.exe[2388] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\McAfee\MPF\MpfSrv.exe[2388] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\McAfee\MPF\MpfSrv.exe[2388] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\Program Files\McAfee\MPF\MpfSrv.exe[2388] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\Program Files\McAfee\MPF\MpfSrv.exe[2388] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 11, 5F ]
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 005C0000
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 005C0093
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 005C0082
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 005C0067
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 005C0F9E
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 005C0FB9
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 005C00AE
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 005C0F72
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 005C0F4B
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 005C00DA
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 005C00FF
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 005C0040
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 005C0FE5
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 005C0F83
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 005C0025
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 005C0FD4
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 005C00C9
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 005B002C
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 005B0F8A
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 005B0FDB
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 005B001B
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 005B0047
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 005B0FA5
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 005B000A
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 005B0FC0
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F1B0F5A
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F170F5A
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F130F5A
.text C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[2488] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00590FEF
.text C:\Program Files\Spyware Doctor\sdhelp.exe[3060] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Spyware Doctor\sdhelp.exe[3060] user32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F0E0F5A
.text C:\Program Files\Spyware Doctor\sdhelp.exe[3060] user32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Spyware Doctor\sdhelp.exe[3060] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F040F5A
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 11, 5F ]
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00260FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00260089
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00260078
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00260F9E
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 0026005B
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00260025
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 002600CB
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 002600B0
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00260F46
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00260F57
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes [ 45, 54, 7F, E2 ]
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 00260F35
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 00260040
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 00260FD4
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 00260F79
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 0026000A
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 00260FB9
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00260F68
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00340FB2
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 00340047
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00340FC3
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00340FD4
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00340036
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00340025
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00340FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00340014
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F130F5A
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] USER32.dll!DialogBoxParamW 7E42555F 5 Bytes JMP 00CCF205 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F1B0F5A
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F170F5A
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] USER32.dll!DialogBoxIndirectParamW 7E432032 5 Bytes JMP 00E5FEBF C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] USER32.dll!MessageBoxIndirectA 7E43A04A 5 Bytes JMP 00E5FE40 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] USER32.dll!DialogBoxParamA 7E43B10C 5 Bytes JMP 00E5FE84 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] USER32.dll!MessageBoxExW 7E4505D8 5 Bytes JMP 00E5FDCC C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] USER32.dll!MessageBoxExA 7E4505FC 5 Bytes JMP 00E5FE06 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] USER32.dll!DialogBoxIndirectParamA 7E456B50 5 Bytes JMP 00E5FEFA C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] USER32.dll!MessageBoxIndirectW 7E4662AB 5 Bytes JMP 00CF15DA C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] WININET.dll!InternetOpenA 771CC859 5 Bytes JMP 02210FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] WININET.dll!InternetOpenW 771CCE91 5 Bytes JMP 0221000A
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] WININET.dll!InternetOpenUrlA 771D06CD 5 Bytes JMP 02210025
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] WININET.dll!InternetOpenUrlW 7721A881 5 Bytes JMP 02210FD4
.text C:\Program Files\Internet Explorer\iexplore.exe[3588] ws2_32.dll!socket 71AB3B91 5 Bytes JMP 02740FEF
.text C:\Program Files\Common Files\AOL\1121872257\EE\aolsoftware.exe[3676] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Common Files\AOL\1121872257\EE\aolsoftware.exe[3676] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\Program Files\Common Files\AOL\1121872257\EE\aolsoftware.exe[3676] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\AOL\1121872257\EE\aolsoftware.exe[3676] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Common Files\AOL\1121872257\EE\aolsoftware.exe[3676] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Common Files\AOL\1121872257\EE\aolsoftware.exe[3676] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes [ 45, 54, 7F, E2 ]
.text C:\Program Files\Common Files\AOL\1121872257\EE\aolsoftware.exe[3676] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\Program Files\Common Files\AOL\1121872257\EE\aolsoftware.exe[3676] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\Program Files\Common Files\AOL\1121872257\EE\aolsoftware.exe[3676] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 11, 5F ]
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00260FEF
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 0026006F
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00260F7A
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00260F97
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00260054
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00260FC3
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00260F42
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00260F53
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 002600C0
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 0026009B
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes [ 45, 54, 7F, E2 ]
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 002600D1
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 00260FA8
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 00260014
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 00260080
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 00260FDE
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 0026002F
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00260F27
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00370036
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 00370FAC
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00370FE5
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00370011
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00370073
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00370062
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00370000
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00370047
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F130F5A
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F1B0F5A
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F170F5A
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 08B80FE5
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] WININET.dll!InternetOpenA 771CC859 5 Bytes JMP 069B0000
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] WININET.dll!InternetOpenW 771CCE91 5 Bytes JMP 069B0025
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] WININET.dll!InternetOpenUrlA 771D06CD 5 Bytes JMP 069B0FE5
.text C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE[3900] WININET.dll!InternetOpenUrlW 7721A881 5 Bytes JMP 069B0FD4
.text C:\Program Files\America Online 9.0\waol.exe[4124] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\America Online 9.0\waol.exe[4124] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\Program Files\America Online 9.0\waol.exe[4124] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\America Online 9.0\waol.exe[4124] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\America Online 9.0\waol.exe[4124] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\America Online 9.0\waol.exe[4124] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes [ 45, 54, 7F, E2 ]
.text C:\Program Files\America Online 9.0\waol.exe[4124] user32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\Program Files\America Online 9.0\waol.exe[4124] user32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\Program Files\America Online 9.0\waol.exe[4124] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\Program Files\Adobe\Acrobat 6.0\Acrobat\Acrobat.exe[5072] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\Adobe\Acrobat 6.0\Acrobat\Acrobat.exe[5072] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\Program Files\Adobe\Acrobat 6.0\Acrobat\Acrobat.exe[5072] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Adobe\Acrobat 6.0\Acrobat\Acrobat.exe[5072] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Adobe\Acrobat 6.0\Acrobat\Acrobat.exe[5072] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Adobe\Acrobat 6.0\Acrobat\Acrobat.exe[5072] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes [ 45, 54, 7F, E2 ]
.text C:\Program Files\Adobe\Acrobat 6.0\Acrobat\Acrobat.exe[5072] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
.text C:\Program Files\Adobe\Acrobat 6.0\Acrobat\Acrobat.exe[5072] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\Program Files\Adobe\Acrobat 6.0\Acrobat\Acrobat.exe[5072] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\DOCUME~1\Windows\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[5752] ntdll.dll!NtTerminateProcess 7C90E88E 3 Bytes [ FF, 25, 1E ]
.text C:\DOCUME~1\Windows\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[5752] ntdll.dll!NtTerminateProcess + 4 7C90E892 2 Bytes [ 0E, 5F ]
.text C:\DOCUME~1\Windows\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[5752] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\DOCUME~1\Windows\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[5752] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\DOCUME~1\Windows\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[5752] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\DOCUME~1\Windows\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[5752] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes [ 45, 54, 7F, E2 ]
.text C:\DOCUME~1\Windows\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[5752] USER32.dll!SetWindowsHookExW 7E42DDB5 6 Bytes JMP 5F180F5A
.text C:\DOCUME~1\Windows\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[5752] USER32.dll!SetWindowsHookExA 7E4311D1 6 Bytes JMP 5F140F5A
.text C:\DOCUME~1\Windows\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe[5752] GDI32.dll!Escape 77F273B4 6 Bytes JMP 5F100F5A
---- Devices - GMER 1.0.12 ----
Device \FileSystem\Fastfat \Fat IRP_MJ_CREATE A8573C8A
Device \FileSystem\Fastfat \Fat IRP_MJ_CLOSE A85707C8
Device \FileSystem\Fastfat \Fat IRP_MJ_READ A856C60A
Device \FileSystem\Fastfat \Fat IRP_MJ_WRITE A856CAED
Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION A8577958
Device \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION A857A821
Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA A858338A
Device \FileSystem\Fastfat \Fat IRP_MJ_SET_EA A8582D49
Device \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS A857CBBE
Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION A857D331
Device \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION A858B4F4
Device \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL A8573B37
Device \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL A856F948
Device \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL A857946B
Device \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN A858A79D
Device \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL A8589C4A
Device \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP A85702FD
Device \FileSystem\Fastfat \Fat IRP_MJ_PNP A858A1DB
Device \FileSystem\Fastfat \Fat FastIoCheckIfPossible A85851F9
---- Processes - GMER 1.0.12 ----
Process C:\Program Files\America Online 9.0\waol.exe (*** hidden *** ) 4124
---- EOF - GMER 1.0.12 ----
AUTOSTART
GMER 1.0.12.12244 -
http://www.gmer.net
Autostart scan 2007-04-16 15:06:44
Windows 5.1.2600 Service Pack 2
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@Userinit = C:\WINDOWS\system32\userinit.exe,
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ >>>
igfxcui@DLLName = igfxsrvc.dll
WgaLogon@DLLName = WgaLogon.dll
HKLM\SYSTEM\CurrentControlSet\Services\ >>>
AOL ACS /*AOL Connectivity Service*/@ = "C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe"
AOL TopSpeedMonitor /*AOL TopSpeed Monitor*/@ = C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
BAsfIpM /*Broadcom ASF IP monitoring service v6.0.4*/@ = C:\WINDOWS\system32\basfipm.exe
Fax /*Fax*/@ = %systemroot%\system32\fxssvc.exe
McAfee HackerWatch Service /*McAfee HackerWatch Service*/@ = "C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe"
mcmscsvc /*McAfee Services*/@ = C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
McNASvc /*McAfee Network Agent*/@ = "c:\program files\common files\mcafee\mna\mcnasvc.exe"
McODS /*McAfee Scanner*/@ = C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
mcpromgr /*McAfee Protection Manager*/@ = C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
McRedirector /*McAfee Redirector Service*/@ = c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
McShield /*McAfee Real-time Scanner*/@ = C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
McSysmon /*McAfee SystemGuards*/@ = C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
MDM /*Machine Debug Manager*/@ = "C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"
MpfService /*McAfee Personal Firewall Service*/@ = "C:\Program Files\McAfee\MPF\MPFSrv.exe"
MSSQL$MSSMLBIZ /*SQL Server (MSSMLBIZ)*/@ = "c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sMSSMLBIZ
NICCONFIGSVC /*NICCONFIGSVC*/@ = C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
SCardSvr /*Smart Card*/@ = %SystemRoot%\System32\SCardSvr.exe
SDhelper /*PC Tools Spyware Doctor*/@ = C:\Program Files\Spyware Doctor\sdhelp.exe
Spooler /*Print Spooler*/@ = %SystemRoot%\system32\spoolsv.exe
SQLBrowser /*SQL Server Browser*/@ = "c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe"
SQLWriter /*SQL Server VSS Writer*/@ = "c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
wltrysvc /*Dell Wireless WLAN Tray Service*/@ = %SystemRoot%\System32\WLTRYSVC.EXE %SystemRoot%\System32\bcmwltry.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>
@ApointC:\Program Files\Apoint\Apoint.exe = C:\Program Files\Apoint\Apoint.exe
@IgfxTrayC:\WINDOWS\system32\igfxtray.exe = C:\WINDOWS\system32\igfxtray.exe
@HotKeysCmdsC:\WINDOWS\system32\hkcmd.exe = C:\WINDOWS\system32\hkcmd.exe
@Dell QuickSetC:\Program Files\Dell\QuickSet\quickset.exe = C:\Program Files\Dell\QuickSet\quickset.exe
@Dell Wireless Manager UIC:\WINDOWS\system32\WLTRAY = C:\WINDOWS\system32\WLTRAY
@AdaptecDirectCD"C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" = "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
@HostManagerC:\Program Files\Common Files\AOL\1121872257\ee\AOLSoftware.exe = C:\Program Files\Common Files\AOL\1121872257\ee\AOLSoftware.exe
@AOLDialerC:\Program Files\Common Files\AOL\ACS\AOLDial.exe = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
@KernelFaultCheck%systemroot%\system32\dumprep 0 -k = %systemroot%\system32\dumprep 0 -k
@Share-to-Web Namespace Daemonc:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe = c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
@QuickTime Task"C:\Program Files\QuickTime\qttask.exe" -atboottime = "C:\Program Files\QuickTime\qttask.exe" -atboottime
@Logitech Hardware Abstraction LayerKHALMNPR.EXE = KHALMNPR.EXE
@SunJavaUpdateSched"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" = "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run >>>
@ctfmon.exeC:\WINDOWS\system32\ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
@Spyware Doctor"C:\Program Files\Spyware Doctor\swdoctor.exe" /Q = "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
@MSMSGS"C:\Program Files\Messenger\msmsgs.exe" /background = "C:\Program Files\Messenger\msmsgs.exe" /background
@H/PC Connection Agent"C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" = "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
@AOL Fast Start"C:\Program Files\America Online 9.0\AOL.EXE" -b = "C:\Program Files\America Online 9.0\AOL.EXE" -b
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad@WPDShServiceObj = C:\WINDOWS\system32\WPDShServiceObj.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>
@{42071714-76d4-11d1-8b24-00a0c9068ff3} /*Display Panning CPL Extension*/deskpan.dll /*file not found*/ = deskpan.dll /*file not found*/
@{596AB062-B4D2-4215-9F74-E9109B0A8153} /*Previous Versions Property Page*/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll
@{9DB7A13C-F208-4981-8353-73CC61AE2783} /*Previous Versions*/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll
@{30D02401-6A81-11d0-8274-00C04FD5AE38} /*IE Search Band*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} /*Shell DocObject Viewer*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FBF23B40-E3F0-101B-8488-00AA003E56F8} /*InternetShortcut*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{3C374A40-BAE4-11CF-BF7D-00AA006946EE} /*Microsoft Url History Service*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FF393560-C2A7-11CF-BFF4-444553540000} /*History*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{7BD29E00-76C1-11CF-9DD0-00A0C9034933} /*Temporary Internet Files*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{7BD29E01-76C1-11CF-9DD0-00A0C9034933} /*Temporary Internet Files*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{CFBFAE00-17A6-11D0-99CB-00C04FD64497} /*Microsoft Url Search Hook*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{3DC7A020-0ACD-11CF-A9BB-00AA004AE837} /*The Internet*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{871C5380-42A0-1069-A2EA-08002B30309D} /*Internet Name Space*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} /*Autoplay for SlideShow*/(null) =
@{692F0339-CBAA-47e6-B5B5-3B84DB604E87} /*Extensions Manager Folder*/C:\WINDOWS\system32\extmgr.dll = C:\WINDOWS\system32\extmgr.dll
@{5E44E225-A408-11CF-B581-008029601108} /*Adaptec DirectCD Shell Extension*/C:\PROGRA~1\Roxio\EASYCD~1\DirectCD\Shellex.dll = C:\PROGRA~1\Roxio\EASYCD~1\DirectCD\Shellex.dll
@{BDEADF00-C265-11D0-BCED-00A0C90AB50F} /*Web Folders*/C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
@{00020D75-0000-0000-C000-000000000046} /*Microsoft Office Outlook Desktop Icon Handler*/C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL = C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL
@{0006F045-0000-0000-C000-000000000046} /*Microsoft Office Outlook Custom Icon Handler*/C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL = C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL
@{42042206-2D85-11D3-8CFF-005004838597} /*Microsoft Office HTML Icon Handler*/C:\Program Files\Microsoft Office\OFFICE11\msohev.dll = C:\Program Files\Microsoft Office\OFFICE11\msohev.dll
@{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} /*Adobe.Acrobat.ContextMenu*/C:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll = C:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll
@{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} /*Shell Extensions for RealOne Player*/C:\Program Files\Real\RealPlayer\rpshell.dll = C:\Program Files\Real\RealPlayer\rpshell.dll
@{A4DF5659-0801-4A60-9607-1C48695EFDA9} /*Share-to-Web Upload Folder*/c:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL = c:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL
@{e82a2d71-5b2f-43a0-97b8-81be15854de8} /*ShellLink for Application References*/C:\WINDOWS\system32\dfshim.dll = C:\WINDOWS\system32\dfshim.dll
@{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} /*Shell Icon Handler for Application References*/C:\WINDOWS\system32\dfshim.dll = C:\WINDOWS\system32\dfshim.dll
@{07C45BB1-4A8C-4642-A1F5-237E7215FF66} /*IE Microsoft BrowserBand*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{1C1EDB47-CE22-4bbb-B608-77B48F83C823} /*IE Fade Task*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{205D7A97-F16D-4691-86EF-F3075DCCA57D} /*IE Menu Desk Bar*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{3028902F-6374-48b2-8DC6-9725E775B926} /*IE AutoComplete*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{43886CD5-6529-41c4-A707-7B3C92C05E68} /*IE Navigation Bar*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{44C76ECD-F7FA-411c-9929-1B77BA77F524} /*IE Menu Site*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{4B78D326-D922-44f9-AF2A-07805C2A3560} /*IE Menu Band*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{6038EF75-ABFC-4e59-AB6F-12D397F6568D} /*IE Microsoft History AutoComplete List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{6B4ECC4F-16D1-4474-94AB-5A763F2A54AE} /*IE Tracking Shell Menu*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{6CF48EF8-44CD-45d2-8832-A16EA016311B} /*IE IShellFolderBand*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{73CFD649-CD48-4fd8-A272-2070EA56526B} /*IE BandProxy*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{98FF6D4B-6387-4b0a-8FBD-C5C4BB17B4F8} /*IE MRU AutoComplete List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{9A096BB5-9DC3-4D1C-8526-C3CBF991EA4E} /*IE RSS Feeder Folder*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{9D958C62-3954-4b44-8FAB-C4670C1DB4C2} /*IE Microsoft Shell Folder AutoComplete List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{B31C5FAE-961F-415b-BAF0-E697A5178B94} /*IE Microsoft Multiple AutoComplete List Container*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{BC476F4C-D9D7-4100-8D4E-E043F6DEC409} /*Microsoft Browser Architecture*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{BFAD62EE-9D54-4b2a-BF3B-76F90697BD2A} /*IE Shell Rebar BandSite*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{E6EE9AAC-F76B-4947-8260-A9F136138E11} /*IE Shell Band Site Menu*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{F2CF5485-4E02-4f68-819C-B92DE9277049} /*&Links*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{F83DAC1C-9BB9-4f2b-B619-09819DA81B0E} /*IE Registry Tree Options Utility*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} /*IE User Assist*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FDE7673D-2E19-4145-8376-BBD58C4BC7BA} /*IE Custom MRU AutoCompleted List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{35786D3C-B075-49b9-88DD-029876E11C01} /*Portable Devices*/%SystemRoot%\system32\wpdshext.dll = %SystemRoot%\system32\wpdshext.dll
@{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8} /*Portable Devices Menu*/%SystemRoot%\system32\wpdshext.dll = %SystemRoot%\system32\wpdshext.dll
@{49BF5420-FA7F-11cf-8011-00A0C90A8F78} /*Mobile Device*/C:\PROGRA~1\MI3AA1~1\Wcesview.dll = C:\PROGRA~1\MI3AA1~1\Wcesview.dll
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ >>>
Adobe.Acrobat.ContextMenu@{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} = C:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll
MCVSRIGHTCLICKSCANNER@{162EFDC5-2957-465D-887B-590AF4A7E84D} = c:\PROGRA~1\mcafee\VIRUSS~1\mcodsax.dll
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\MCVSRIGHTCLICKSCANNER@{162EFDC5-2957-465D-887B-590AF4A7E84D} = c:\PROGRA~1\mcafee\VIRUSS~1\mcodsax.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects >>>
@{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll = C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
@{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll = C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
@{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll = C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
@{7DB2D5A0-7241-4E79-B68D-6309F01C5231}c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll = c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
@{AE7CD045-E861-484f-8273-0445EE161910}C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll = C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
@{B56A7D7D-6927-48C8-A975-17DF180C71AC}C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll = C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
HKCU\Control Panel\Desktop@SCRNSAVE.EXE = C:\WINDOWS\system32\LOGON.SCR
HKLM\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://go.microsoft.com/fwlink/?LinkId=69157 =
http://go.microsoft....k/?LinkId=69157
@Start Pagehttp://go.microsoft.com/fwlink/?LinkId=69157 =
http://go.microsoft....k/?LinkId=69157
@Local Page%SystemRoot%\system32\blank.htm = %SystemRoot%\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://www.dell.com =
http://www.dell.com
@Start Pagehttp://www.msn.com/ =
http://www.msn.com/
@Local PageC:\WINDOWS\system32\blank.htm = C:\WINDOWS\system32\blank.htm
HKLM\Software\Classes\PROTOCOLS\Filter\text/xml@CLSID = C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
HKLM\Software\Classes\PROTOCOLS\Handler\ >>>
dvd@CLSID = C:\WINDOWS\system32\msvidctl.dll
its@CLSID = C:\WINDOWS\system32\itss.dll
mhtml@CLSID = %SystemRoot%\system32\inetcomm.dll
ms-its@CLSID = C:\WINDOWS\system32\itss.dll
ms-itss@CLSID = C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
mso-offdap@CLSID = C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
mso-offdap11@CLSID = C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
tv@CLSID = C:\WINDOWS\system32\msvidctl.dll
HKLM\Software\Classes\PROTOCOLS\Handler\wia@CLSID = C:\WINDOWS\system32\wiascr.dll
C:\Documents and Settings\Windows\Start Menu\Programs\Startup = DESKTOP.INI
C:\Documents and Settings\All Users\Start Menu\Programs\Startup >>>
Acrobat Assistant.lnk = Acrobat Assistant.lnk
DESKTOP.INI = DESKTOP.INI
Digital Line Detect.lnk = Digital Line Detect.lnk
Logitech SetPoint.lnk = Logitech SetPoint.lnk
---- EOF - GMER 1.0.12 ----