here is the autoscan
GMER 1.0.13.12551 -
http://www.gmer.net
Rootkit scan 2007-07-16 18:35:02
Windows 5.1.2600 Service Pack 2
—- Kernel code sections - GMER 1.0.13 —-
? C:\DOCUME~1\downtown\LOCALS~1\Temp\mc29.tmp The system cannot find the file specified.
—- User code sections - GMER 1.0.13 —-
.text C:\WINDOWS\ehome\mcrdsvc.exe[112] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00A15007
.text C:\WINDOWS\ehome\mcrdsvc.exe[112] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00A1521F
.text C:\WINDOWS\ehome\mcrdsvc.exe[112] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00A1533C
.text C:\WINDOWS\ehome\mcrdsvc.exe[112] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00A15121
.text C:\WINDOWS\ehome\mcrdsvc.exe[112] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\ehome\mcrdsvc.exe[112] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\ehome\mcrdsvc.exe[112] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\ehome\mcrdsvc.exe[112] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[168] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00995007
.text C:\WINDOWS\eHome\ehRecvr.exe[168] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 0099521F
.text C:\WINDOWS\eHome\ehRecvr.exe[168] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 0099533C
.text C:\WINDOWS\eHome\ehRecvr.exe[168] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00995121
.text C:\WINDOWS\eHome\ehRecvr.exe[168] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[168] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[168] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[168] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\eHome\ehSched.exe[192] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00CB5007
.text C:\WINDOWS\eHome\ehSched.exe[192] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00CB521F
.text C:\WINDOWS\eHome\ehSched.exe[192] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00CB533C
.text C:\WINDOWS\eHome\ehSched.exe[192] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00CB5121
.text C:\WINDOWS\eHome\ehSched.exe[192] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\eHome\ehSched.exe[192] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\eHome\ehSched.exe[192] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\eHome\ehSched.exe[192] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe[256] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 009F5007
.text C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe[256] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 009F521F
.text C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe[256] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 009F533C
.text C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe[256] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 009F5121
.text C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe[256] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe[256] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe[256] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe[256] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\Documents and Settings\downtown\Local Settings\Temporary Internet Files\Content.IE5\NL9711WK\gmer[1]\gmer.exe[496] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 003D5007
.text C:\Documents and Settings\downtown\Local Settings\Temporary Internet Files\Content.IE5\NL9711WK\gmer[1]\gmer.exe[496] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 003D521F
.text C:\Documents and Settings\downtown\Local Settings\Temporary Internet Files\Content.IE5\NL9711WK\gmer[1]\gmer.exe[496] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 003D533C
.text C:\Documents and Settings\downtown\Local Settings\Temporary Internet Files\Content.IE5\NL9711WK\gmer[1]\gmer.exe[496] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 003D5121
.text C:\Documents and Settings\downtown\Local Settings\Temporary Internet Files\Content.IE5\NL9711WK\gmer[1]\gmer.exe[496] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Documents and Settings\downtown\Local Settings\Temporary Internet Files\Content.IE5\NL9711WK\gmer[1]\gmer.exe[496] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Documents and Settings\downtown\Local Settings\Temporary Internet Files\Content.IE5\NL9711WK\gmer[1]\gmer.exe[496] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Documents and Settings\downtown\Local Settings\Temporary Internet Files\Content.IE5\NL9711WK\gmer[1]\gmer.exe[496] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes [ 45, 54, 7F, E2 ]
.text C:\Documents and Settings\downtown\Local Settings\Temporary Internet Files\Content.IE5\NL9711WK\gmer[1]\gmer.exe[496] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[544] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00BB5007
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[544] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00BB521F
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[544] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00BB533C
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[544] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00BB5121
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[544] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[544] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[544] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe[544] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\svchost.exe[676] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00A95007
.text C:\WINDOWS\system32\svchost.exe[676] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00A9521F
.text C:\WINDOWS\system32\svchost.exe[676] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00A9533C
.text C:\WINDOWS\system32\svchost.exe[676] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00A95121
.text C:\WINDOWS\system32\svchost.exe[676] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\svchost.exe[676] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\svchost.exe[676] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\svchost.exe[676] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\svchost.exe[724] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00A15007
.text C:\WINDOWS\system32\svchost.exe[724] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00A1521F
.text C:\WINDOWS\system32\svchost.exe[724] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00A1533C
.text C:\WINDOWS\system32\svchost.exe[724] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00A15121
.text C:\WINDOWS\system32\svchost.exe[724] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\svchost.exe[724] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\svchost.exe[724] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\svchost.exe[724] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\Explorer.EXE[780] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00B75007
.text C:\WINDOWS\Explorer.EXE[780] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00B7521F
.text C:\WINDOWS\Explorer.EXE[780] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00B7533C
.text C:\WINDOWS\Explorer.EXE[780] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00B75121
.text C:\WINDOWS\Explorer.EXE[780] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\Explorer.EXE[780] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\Explorer.EXE[780] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\Explorer.EXE[780] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\csrss.exe[872] KERNEL32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\csrss.exe[872] KERNEL32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\csrss.exe[872] KERNEL32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\csrss.exe[872] KERNEL32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\winlogon.exe[896] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00CC5007
.text C:\WINDOWS\system32\winlogon.exe[896] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00CC521F
.text C:\WINDOWS\system32\winlogon.exe[896] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00CC533C
.text C:\WINDOWS\system32\winlogon.exe[896] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00CC5121
.text C:\WINDOWS\system32\winlogon.exe[896] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\winlogon.exe[896] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\winlogon.exe[896] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\winlogon.exe[896] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\services.exe[940] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00FB5007
.text C:\WINDOWS\system32\services.exe[940] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00FB521F
.text C:\WINDOWS\system32\services.exe[940] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00FB533C
.text C:\WINDOWS\system32\services.exe[940] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00FB5121
.text C:\WINDOWS\system32\services.exe[940] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\services.exe[940] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\services.exe[940] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\services.exe[940] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\lsass.exe[952] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00D85007
.text C:\WINDOWS\system32\lsass.exe[952] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00D8521F
.text C:\WINDOWS\system32\lsass.exe[952] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00D8533C
.text C:\WINDOWS\system32\lsass.exe[952] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00D85121
.text C:\WINDOWS\system32\lsass.exe[952] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\lsass.exe[952] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\lsass.exe[952] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\lsass.exe[952] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00E15007
.text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00E1521F
.text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00E1533C
.text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00E15121
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00CB5007
.text C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00CB521F
.text C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00CB533C
.text C:\WINDOWS\system32\svchost.exe[1244] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00CB5121
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\svchost.exe[1244] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\System32\svchost.exe[1284] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 02725007
.text C:\WINDOWS\System32\svchost.exe[1284] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 0272521F
.text C:\WINDOWS\System32\svchost.exe[1284] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 0272533C
.text C:\WINDOWS\System32\svchost.exe[1284] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 02725121
.text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1340] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 098B5007
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1340] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 098B521F
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1340] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 098B533C
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1340] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 098B5121
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1340] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1340] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1340] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Intel\Wireless\Bin\EvtEng.exe[1340] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1376] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 01635007
.text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1376] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 0163521F
.text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1376] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 0163533C
.text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1376] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 01635121
.text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1376] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1376] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1376] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe[1376] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1400] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 010D5007
.text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1400] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 010D521F
.text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1400] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 010D533C
.text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1400] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 010D5121
.text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1400] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1400] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1400] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe[1400] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\svchost.exe[1456] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00895007
.text C:\WINDOWS\system32\svchost.exe[1456] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 0089521F
.text C:\WINDOWS\system32\svchost.exe[1456] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 0089533C
.text C:\WINDOWS\system32\svchost.exe[1456] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00895121
.text C:\WINDOWS\system32\svchost.exe[1456] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\svchost.exe[1456] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\svchost.exe[1456] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\svchost.exe[1456] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\svchost.exe[1560] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00AA5007
.text C:\WINDOWS\system32\svchost.exe[1560] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00AA521F
.text C:\WINDOWS\system32\svchost.exe[1560] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00AA533C
.text C:\WINDOWS\system32\svchost.exe[1560] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00AA5121
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\dllhost.exe[1600] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00C85007
.text C:\WINDOWS\system32\dllhost.exe[1600] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00C8521F
.text C:\WINDOWS\system32\dllhost.exe[1600] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00C8533C
.text C:\WINDOWS\system32\dllhost.exe[1600] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00C85121
.text C:\WINDOWS\system32\dllhost.exe[1600] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\dllhost.exe[1600] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\dllhost.exe[1600] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\dllhost.exe[1600] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\spoolsv.exe[1852] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00B35007
.text C:\WINDOWS\system32\spoolsv.exe[1852] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00B3521F
.text C:\WINDOWS\system32\spoolsv.exe[1852] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00B3533C
.text C:\WINDOWS\system32\spoolsv.exe[1852] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00B35121
.text C:\WINDOWS\system32\spoolsv.exe[1852] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\spoolsv.exe[1852] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\spoolsv.exe[1852] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\spoolsv.exe[1852] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\iPod\bin\iPodService.exe[2080] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 01525007
.text C:\Program Files\iPod\bin\iPodService.exe[2080] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 0152521F
.text C:\Program Files\iPod\bin\iPodService.exe[2080] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 0152533C
.text C:\Program Files\iPod\bin\iPodService.exe[2080] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 01525121
.text C:\Program Files\iPod\bin\iPodService.exe[2080] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\iPod\bin\iPodService.exe[2080] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\iPod\bin\iPodService.exe[2080] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\iPod\bin\iPodService.exe[2080] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\ehome\ehtray.exe[2472] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00A15007
.text C:\WINDOWS\ehome\ehtray.exe[2472] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00A1521F
.text C:\WINDOWS\ehome\ehtray.exe[2472] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00A1533C
.text C:\WINDOWS\ehome\ehtray.exe[2472] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00A15121
.text C:\WINDOWS\ehome\ehtray.exe[2472] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\ehome\ehtray.exe[2472] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\ehome\ehtray.exe[2472] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\ehome\ehtray.exe[2472] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2480] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00AA5007
.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2480] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00AA521F
.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2480] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00AA533C
.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2480] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00AA5121
.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2480] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2480] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2480] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe[2480] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2496] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00A65007
.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2496] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00A6521F
.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2496] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00A6533C
.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2496] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00A65121
.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2496] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2496] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2496] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe[2496] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\igfxpers.exe[2532] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 003B5007
.text C:\WINDOWS\system32\igfxpers.exe[2532] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 003B521F
.text C:\WINDOWS\system32\igfxpers.exe[2532] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 003B533C
.text C:\WINDOWS\system32\igfxpers.exe[2532] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 003B5121
.text C:\WINDOWS\system32\igfxpers.exe[2532] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\igfxpers.exe[2532] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\igfxpers.exe[2532] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\igfxpers.exe[2532] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\stsystra.exe[2548] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 009B5007
.text C:\WINDOWS\stsystra.exe[2548] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 009B521F
.text C:\WINDOWS\stsystra.exe[2548] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 009B533C
.text C:\WINDOWS\stsystra.exe[2548] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 009B5121
.text C:\WINDOWS\stsystra.exe[2548] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\stsystra.exe[2548] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\stsystra.exe[2548] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\stsystra.exe[2548] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2604] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00A25007
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2604] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00A2521F
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2604] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00A2533C
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2604] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00A25121
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2604] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2604] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2604] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2604] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2632] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00905007
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2632] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 0090521F
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2632] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 0090533C
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2632] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00905121
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2632] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2632] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2632] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2632] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2640] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00975007
.text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2640] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 0097521F
.text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2640] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 0097533C
.text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2640] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00975121
.text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2640] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2640] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2640] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe[2640] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[2664] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00945007
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[2664] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 0094521F
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[2664] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 0094533C
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[2664] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00945121
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[2664] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[2664] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[2664] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[2664] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2692] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00395007
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2692] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 0039521F
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2692] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 0039533C
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2692] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00395121
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2692] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2692] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2692] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2692] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\igfxsrvc.exe[2736] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 01005007
.text C:\WINDOWS\system32\igfxsrvc.exe[2736] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 0100521F
.text C:\WINDOWS\system32\igfxsrvc.exe[2736] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 0100533C
.text C:\WINDOWS\system32\igfxsrvc.exe[2736] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 01005121
.text C:\WINDOWS\system32\igfxsrvc.exe[2736] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\igfxsrvc.exe[2736] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\igfxsrvc.exe[2736] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\igfxsrvc.exe[2736] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\QuickTime\qttask.exe[2752] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00935007
.text C:\Program Files\QuickTime\qttask.exe[2752] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 0093521F
.text C:\Program Files\QuickTime\qttask.exe[2752] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 0093533C
.text C:\Program Files\QuickTime\qttask.exe[2752] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00935121
.text C:\Program Files\QuickTime\qttask.exe[2752] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\QuickTime\qttask.exe[2752] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\QuickTime\qttask.exe[2752] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\QuickTime\qttask.exe[2752] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\eHome\ehmsas.exe[2856] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00A65007
.text C:\WINDOWS\eHome\ehmsas.exe[2856] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00A6521F
.text C:\WINDOWS\eHome\ehmsas.exe[2856] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00A6533C
.text C:\WINDOWS\eHome\ehmsas.exe[2856] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00A65121
.text C:\WINDOWS\eHome\ehmsas.exe[2856] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\eHome\ehmsas.exe[2856] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\eHome\ehmsas.exe[2856] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\eHome\ehmsas.exe[2856] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\iTunes\iTunesHelper.exe[2916] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00B25007
.text C:\Program Files\iTunes\iTunesHelper.exe[2916] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00B2521F
.text C:\Program Files\iTunes\iTunesHelper.exe[2916] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00B2533C
.text C:\Program Files\iTunes\iTunesHelper.exe[2916] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00B25121
.text C:\Program Files\iTunes\iTunesHelper.exe[2916] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\iTunes\iTunesHelper.exe[2916] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\iTunes\iTunesHelper.exe[2916] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\iTunes\iTunesHelper.exe[2916] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\ctfmon.exe[3200] ntdll.dll!NtCreateThread 7C90D7D2 3 Bytes JMP 00915007
.text C:\WINDOWS\system32\ctfmon.exe[3200] ntdll.dll!NtCreateThread + 4 7C90D7D6 1 Byte [ 84 ]
.text C:\WINDOWS\system32\ctfmon.exe[3200] ntdll.dll!NtDeleteValueKey 7C90D8CE 3 Bytes JMP 0091521F
.text C:\WINDOWS\system32\ctfmon.exe[3200] ntdll.dll!NtDeleteValueKey + 4 7C90D8D2 1 Byte [ 84 ]
.text C:\WINDOWS\system32\ctfmon.exe[3200] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 3 Bytes JMP 0091533C
.text C:\WINDOWS\system32\ctfmon.exe[3200] ntdll.dll!NtQueryDirectoryFile + 4 7C90DF62 1 Byte [ 84 ]
.text C:\WINDOWS\system32\ctfmon.exe[3200] ntdll.dll!NtSetValueKey 7C90E7BC 3 Bytes JMP 00915121
.text C:\WINDOWS\system32\ctfmon.exe[3200] ntdll.dll!NtSetValueKey + 4 7C90E7C0 1 Byte [ 84 ]
.text C:\WINDOWS\system32\ctfmon.exe[3200] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\ctfmon.exe[3200] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\ctfmon.exe[3200] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\ctfmon.exe[3200] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe[3232] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00B65007
.text C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe[3232] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00B6521F
.text C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe[3232] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00B6533C
.text C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe[3232] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00B65121
.text C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe[3232] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe[3232] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe[3232] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe[3232] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes [ 45, 54, 7F, E2 ]
.text C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe[3232] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\NoAdware4\NoAdware4.exe[3300] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00D25007
.text C:\Program Files\NoAdware4\NoAdware4.exe[3300] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00D2521F
.text C:\Program Files\NoAdware4\NoAdware4.exe[3300] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00D2533C
.text C:\Program Files\NoAdware4\NoAdware4.exe[3300] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00D25121
.text C:\Program Files\NoAdware4\NoAdware4.exe[3300] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\NoAdware4\NoAdware4.exe[3300] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\NoAdware4\NoAdware4.exe[3300] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\NoAdware4\NoAdware4.exe[3300] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 00A95007
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 00A9521F
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 00A9533C
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 00A95121
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes [ 45, 54, 7F, E2 ]
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!DialogBoxParamW 7E42555F 5 Bytes JMP 42F0F2A1 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!DialogBoxIndirectParamW 7E432032 5 Bytes JMP 430A0277 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!MessageBoxIndirectA 7E43A04A 5 Bytes JMP 430A01F8 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!DialogBoxParamA 7E43B10C 5 Bytes JMP 430A023C C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!MessageBoxExW 7E4505D8 5 Bytes JMP 430A0184 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!MessageBoxExA 7E4505FC 5 Bytes JMP 430A01BE C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!DialogBoxIndirectParamA 7E456B50 5 Bytes JMP 430A02B2 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] USER32.dll!MessageBoxIndirectW 7E4662AB 5 Bytes JMP 42F3164E C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] WININET.dll!HttpSendRequestA 42C2CD48 5 Bytes JMP 00A94D75
.text C:\Program Files\Internet Explorer\iexplore.exe[3804] WININET.dll!HttpSendRequestW 42C41035 5 Bytes JMP 00A94DBE
.text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3828] ntdll.dll!NtCreateThread 7C90D7D2 5 Bytes JMP 01FC5007
.text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3828] ntdll.dll!NtDeleteValueKey 7C90D8CE 5 Bytes JMP 01FC521F
.text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3828] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 01FC533C
.text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3828] ntdll.dll!NtSetValueKey 7C90E7BC 5 Bytes JMP 01FC5121
.text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3828] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3828] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3828] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe[3828] kernel32.dll!WinExec 7C86136D 6 Bytes JMP 5F0D0F5A
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_NAMED_PIPE [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_READ [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_MAILSLOT [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_POWER [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SYSTEM_CONTROL [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CHANGE [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA [F7AF7404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA [F7AF7404] avg7rsw.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_NAMED_PIPE [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CLOSE [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_READ [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_WRITE [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_INFORMATION [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_INFORMATION [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_EA [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_EA [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_FLUSH_BUFFERS [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_VOLUME_INFORMATION [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_VOLUME_INFORMATION [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DIRECTORY_CONTROL [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_FILE_SYSTEM_CONTROL [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CONTROL [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_INTERNAL_DEVICE_CONTROL [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SHUTDOWN [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_LOCK_CONTROL [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CLEANUP [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_MAILSLOT [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_SECURITY [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_SECURITY [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_POWER [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SYSTEM_CONTROL [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CHANGE [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_QUOTA [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 IRP_MJ_SET_QUOTA [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CREATE [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CREATE_NAMED_PIPE [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CLOSE [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_READ [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_WRITE [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_INFORMATION [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_INFORMATION [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_EA [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_EA [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_FLUSH_BUFFERS [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_VOLUME_INFORMATION [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_VOLUME_INFORMATION [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_DIRECTORY_CONTROL [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_FILE_SYSTEM_CONTROL [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_DEVICE_CONTROL [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_INTERNAL_DEVICE_CONTROL [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SHUTDOWN [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_LOCK_CONTROL [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CLEANUP [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_CREATE_MAILSLOT [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_SECURITY [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_SECURITY [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_POWER [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SYSTEM_CONTROL [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_DEVICE_CHANGE [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_QUERY_QUOTA [F6D0B9D0] SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 IRP_MJ_SET_QUOTA [F6D0B9D0] SynTP.sys
Device \FileSystem\Cdfs \Cdfs IRP_MJ_FILE_SYSTEM_CONTROL [AA7A9912] DLAIFS_M.SYS
—- Files - GMER 1.0.13 —-
File C:\WINDOWS\system32\kdmqf.exe
—- EOF - GMER 1.0.13 —-
here is the uninstall list
Ad-Aware SE Personal
Adobe Flash Player ActiveX
Adobe Reader 7.0.8
Adobe Shockwave Player
Apple Software Update
AVG 7.5
Broadcom 440x 10/100 Integrated Controller
Conexant HDA D110 MDC V.92 Modem
Dell Media Experience
Dell ResourceCD
EPSON Printer Software
Google Earth
Google Toolbar for Internet Explorer
High Definition Audio Driver Package - KB835221
Hijackthis 1.99.1
HijackThis 1.99.1
Hotfix for Windows Media Player 10 (KB903157)
Hotfix for Windows XP (KB888795)
Hotfix for Windows XP (KB891593)
Hotfix for Windows XP (KB895961)
Hotfix for Windows XP (KB899337)
Hotfix for Windows XP (KB899510)
Hotfix for Windows XP (KB902841)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Intel® Graphics Media Accelerator Driver
Intel® PROSet/Wireless Software
Internal Network Card Power Management
iTunes
Java™ 6 Update 2
mCore
mDriver
mDrWiFi
mHlpDell
Microsoft .NET Framework 1.0 Hotfix (KB887998)
Microsoft .NET Framework 1.0 Hotfix (KB930494)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
mIWA
mLogView
mMHouse
mPfMgr
mPfWiz
mProSafe
mSSO
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB927978)
mWlsSafe
mWMI
mXML
mZConfig
NoAdware v4.0
Picasa 2
PokerStars.net
PowerDVD 5.7
QuickSet
QuickTime
Remote Desktop Connection
Roxio DLA
Roxio MyDVD LE
Roxio RecordNow Audio
Roxio RecordNow Copy
Roxio RecordNow Data
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
SigmaTel Audio
Sonic Encoders
Sonic Update Manager
Spybot - Search & Destroy 1.4
Synaptics Pointing Device Driver
Update for Windows Media Player 10 (KB913800)
Update for Windows Media Player 10 (KB926251)
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB936357)
Update Rollup 2 for Windows XP Media Center Edition 2005
Windows Driver Package - Ricoh Company Memorystick Host Controller (07/09/2005 1.00.01.12)
Windows Driver Package - Ricoh Company MMC Host Controller (07/14/2005 1.00.00.06)
Windows Driver Package - Ricoh Company xD-Picture Card/SmartMedia Host Controller (07/14/2005 1.00.02.04)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live Safety Scanner
Windows Media Format Runtime
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Media Center Edition 2005 KB908250
Yahoo! Mail Quick Select Tool (PhotoMail)
