What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed]Avsystemcare Malaware

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
gmerautos.txt

GMER 1.0.13.12551 - http://www.gmer.net
Autostart scan 2007-08-10 21:15:07
Windows 5.1.2600 Service Pack 2


HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon >>>
@UserinitC:\WINDOWS\system32\userinit.exe, = C:\WINDOWS\system32\userinit.exe,
@GinaDLLcswGina.dll = cswGina.dll

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ >>>
!SASWinLogon@DLLName = C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
WgaLogon@DLLName = WgaLogon.dll

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs = secsolni.dll C:\PROGRA~1\Google\GO333C~1\GOEC62~1.DLL

HKLM\SYSTEM\CurrentControlSet\Services\ >>>
Apple Mobile Device /*Apple Mobile Device*/@ = "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
AVG Anti-Spyware Guard /*AVG Anti-Spyware Guard*/@ = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
Avg7Alrt /*AVG7 Alert Manager Server*/@ = C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
Avg7UpdSvc /*AVG7 Update Service*/@ = C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
AVGEMS /*AVG E-mail Scanner*/@ = C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
CBA8 /*LANDesk® Management Agent*/@ = "C:\Program Files\LANDesk\Shared Files\residentagent.exe"
CVPND /*Cisco Systems, Inc. VPN Service*/@ = "C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe"
Diskeeper /*Diskeeper*/@ = C:\Program Files\Executive Software\Diskeeper\DkService.exe
FireSvc /*McAfee Desktop Firewall Service*/@ = C:\PROGRA~1\NETWOR~1\MCAFEE~1\FireSvc.exe
HCLInetd /*Hummingbird InetD*/@ = c:\WINDOWS\System32\Hummingbird\Connectivity\9.00\Inetd\inetd32.exe
HumDisplayServer /*Hummingbird Exceed Display Management*/@ = c:\Program Files\Hummingbird\Connectivity\9.00\Exceed\HumDisplayServer.exe
Intel Local Scheduler Service /*Intel Local Scheduler Service*/@ = C:\LDClient\LOCALSCH.EXE
Intel PDS /*Intel PDS*/@ = C:\WINDOWS\system32\cba\pds.exe
Intel QIP Client Service /*Intel QIP Client Service*/@ = C:\LDClient\QIPCLNT.EXE
Intel Targeted Multicast /*Intel Targeted Multicast*/@ = C:\LDClient\tmcsvc.exe
iPassPeriodicUpdateService /*iPassPeriodicUpdateService*/@ = "C:\Program Files\iPass\iPassConnect Continental RAS\iPassPeriodicUpdateService.exe"
LkCitadelServer /*Lookout Citadel Server*/@ = C:\WINDOWS\system32\lkcitdl.exe
lkClassAds /*National Instruments PSP Server Locator*/@ = C:\WINDOWS\system32\lkads.exe
lkTimeSync /*National Instruments Time Synchronization*/@ = C:\WINDOWS\system32\lktsrv.exe
McAfeeFramework /*McAfee Framework Service*/@ = "C:\Program Files\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart
McShield /*Network Associates McShield*/@ = "C:\Program Files\Network Associates\VirusScan\Mcshield.exe"
McTaskManager /*Network Associates Task Manager*/@ = "C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe"
mxssvr /*NI Configuration Manager*/@ = "C:\Program Files\National Instruments\MAX\nimxs.exe"
NIDomainService /*National Instruments Domain Service*/@ = "C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe"
niSvcLoc /*NI Service Locator*/@ = C:\WINDOWS\system32\nisvcloc.exe -s
NVSvc /*NVIDIA Display Driver Service*/@ = %SystemRoot%\System32\nvsvc32.exe
RichVideo /*Cyberlink RichVideo Service(CRVS)*/@ = "C:\Program Files\CyberLink\Shared files\RichVideo.exe" ?????????????????????????????????????????????????????? /*file not found*/
SCardSvr /*Smart Card*/@ = %SystemRoot%\System32\SCardSvr.exe
ScsiPort@ = %SystemRoot%\system32\drivers\scsiport.sys
Spooler /*Print Spooler*/@ = %SystemRoot%\system32\spoolsv.exe
Wuser32 /*Intel Remote Control Service*/@ = C:\LDClient\wuser32.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>
@McAfeeUpdaterUI"C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey = "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
@LANDeskAPMClientC:\LDClient\amclient.exe /apm /s /ro = C:\LDClient\amclient.exe /apm /s /ro
@LANDeskTaskCompletionC:\LDClient\amclient.exe /tcs /s = C:\LDClient\amclient.exe /tcs /s
@LANDeskInventoryC:\LDClient\LDISCN32.EXE /NTT=frsm103.auto.contiwan.com:5007 /S="frsm103.auto.contiwan.com" /I=ldappl3.ini /NOUI /w=300 = C:\LDClient\LDISCN32.EXE /NTT=frsm103.auto.contiwan.com:5007 /S="frsm103.auto.contiwan.com" /I=ldappl3.ini /NOUI /w=300
@LANDeskVulscanC:\LDClient\ranwait.exe -min=900 -max=7200 C:\LDClient\vulscan.exe = C:\LDClient\ranwait.exe -min=900 -max=7200 C:\LDClient\vulscan.exe
@Network Associates Error Reporting Service"C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" = "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
@McAfeeFireTrayC:\PROGRA~1\NETWOR~1\MCAFEE~1\Firetray.exe = C:\PROGRA~1\NETWOR~1\MCAFEE~1\Firetray.exe
@ShStatEXE"C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE = "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
@StxTrayMenu"C:\Program Files\Seagate\SystemTray\StxMenuMgr.exe" = "C:\Program Files\Seagate\SystemTray\StxMenuMgr.exe"
@BluetoothAuthenticationAgentrundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent = rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
@NvCplDaemonRUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup = RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
@YOPC:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart /*file not found*/ = C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart /*file not found*/
@AVG7_CCC:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP = C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
@!AVG Anti-Spyware"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
@SunJavaUpdateSched"C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" = "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
@QuickTime Task"C:\Program Files\QuickTime\QTTask.exe" -atboottime = "C:\Program Files\QuickTime\QTTask.exe" -atboottime
@iTunesHelper"C:\Program Files\iTunes\iTunesHelper.exe" = "C:\Program Files\iTunes\iTunesHelper.exe"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run >>>
@swgC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe = C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
@ctfmon.exeC:\WINDOWS\system32\ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
@Communicator"C:\Program Files\Microsoft Office Communicator\Communicator.exe" /background = "C:\Program Files\Microsoft Office Communicator\Communicator.exe" /background
@SUPERAntiSpywareC:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe = C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad@WPDShServiceObj = C:\WINDOWS\system32\WPDShServiceObj.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks >>>
@{57B86673-276A-48B2-BAE7-C6DBB3020EB8}C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll
@{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}C:\Program Files\SUPERAntiSpyware\SASSEH.DLL = C:\Program Files\SUPERAntiSpyware\SASSEH.DLL

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>
@{42071714-76d4-11d1-8b24-00a0c9068ff3} /*Display Panning CPL Extension*/deskpan.dll /*file not found*/ = deskpan.dll /*file not found*/
@{30D02401-6A81-11d0-8274-00C04FD5AE38} /*IE Search Band*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{32683183-48a0-441b-a342-7c2a440a9478} /*Media Band*/(null) =
@{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} /*Shell DocObject Viewer*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FBF23B40-E3F0-101B-8488-00AA003E56F8} /*InternetShortcut*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{3C374A40-BAE4-11CF-BF7D-00AA006946EE} /*Microsoft Url History Service*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FF393560-C2A7-11CF-BFF4-444553540000} /*History*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{7BD29E00-76C1-11CF-9DD0-00A0C9034933} /*Temporary Internet Files*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{7BD29E01-76C1-11CF-9DD0-00A0C9034933} /*Temporary Internet Files*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{CFBFAE00-17A6-11D0-99CB-00C04FD64497} /*Microsoft Url Search Hook*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{3DC7A020-0ACD-11CF-A9BB-00AA004AE837} /*The Internet*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{871C5380-42A0-1069-A2EA-08002B30309D} /*Internet Name Space*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{BDEADF00-C265-11D0-BCED-00A0C90AB50F} /*Web Folders*/C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
@{00020D75-0000-0000-C000-000000000046} /*Microsoft Office Outlook Desktop Icon Handler*/C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL = C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL
@{0006F045-0000-0000-C000-000000000046} /*Microsoft Office Outlook Custom Icon Handler*/C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL = C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL
@{42042206-2D85-11D3-8CFF-005004838597} /*Microsoft Office HTML Icon Handler*/C:\Program Files\Microsoft Office 2003\OFFICE11\msohev.dll = C:\Program Files\Microsoft Office 2003\OFFICE11\msohev.dll
@{692E33B0-AF9D-11D0-B976-00A0C9190447} /*Remote Storage Properties*/C:\WINDOWS\System32\rsshell.dll = C:\WINDOWS\System32\rsshell.dll
@{BDA77241-42F6-11d0-85E2-00AA001FE28C} /*LDVP Shell Extensions*/(null) =
@{E0D79304-84BE-11CE-9641-444553540000} /*WinZip*/C:\PROGRA~1\WINZIP\WZSHLSTB.DLL = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
@{E0D79305-84BE-11CE-9641-444553540000} /*WinZip*/C:\PROGRA~1\WINZIP\WZSHLSTB.DLL = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
@{E0D79306-84BE-11CE-9641-444553540000} /*WinZip*/C:\PROGRA~1\WINZIP\WZSHLSTB.DLL = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
@{E0D79307-84BE-11CE-9641-444553540000} /*WinZip*/C:\PROGRA~1\WINZIP\WZSHLSTB.DLL = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
@{A70C977A-BF00-412C-90B7-034C51DA2439} /*NvCpl DesktopContext Class*/C:\WINDOWS\System32\nvcpl.dll = C:\WINDOWS\System32\nvcpl.dll
@{FFB699E0-306A-11d3-8BD1-00104B6F7516} /*Play on my TV helper*/C:\WINDOWS\System32\nvcpl.dll = C:\WINDOWS\System32\nvcpl.dll
@{1CDB2949-8F65-4355-8456-263E7C208A5D} /*Desktop Explorer*/C:\WINDOWS\System32\nvshell.dll = C:\WINDOWS\System32\nvshell.dll
@{1E9B04FB-F9E5-4718-997B-B8DA88302A47} /*Desktop Explorer Menu*/C:\WINDOWS\System32\nvshell.dll = C:\WINDOWS\System32\nvshell.dll
@{1E9B04FB-F9E5-4718-997B-B8DA88302A48} /*nView Desktop Context Menu*/C:\WINDOWS\System32\nvshell.dll = C:\WINDOWS\System32\nvshell.dll
@{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} /*Adobe.Acrobat.ContextMenu*/C:\Program Files\Adobe\Acrobat 7.0\Acrobat Elements\ContextMenu.dll = C:\Program Files\Adobe\Acrobat 7.0\Acrobat Elements\ContextMenu.dll
@{506F4668-F13E-4AA1-BB04-B43203AB3CC0} /*{506F4668-F13E-4AA1-BB04-B43203AB3CC0}*/C:\Program Files\Microsoft Office 2003\Visio11\VISSHE.DLL = C:\Program Files\Microsoft Office 2003\Visio11\VISSHE.DLL
@{D66DC78C-4F61-447F-942B-3FB6980118CF} /*{D66DC78C-4F61-447F-942B-3FB6980118CF}*/C:\Program Files\Microsoft Office 2003\Visio11\VISSHE.DLL = C:\Program Files\Microsoft Office 2003\Visio11\VISSHE.DLL
@{596AB062-B4D2-4215-9F74-E9109B0A8153} /*Previous Versions Property Page*/C:\WINDOWS\System32\twext.dll = C:\WINDOWS\System32\twext.dll
@{9DB7A13C-F208-4981-8353-73CC61AE2783} /*Previous Versions*/C:\WINDOWS\System32\twext.dll = C:\WINDOWS\System32\twext.dll
@{692F0339-CBAA-47e6-B5B5-3B84DB604E87} /*Extensions Manager Folder*/C:\WINDOWS\system32\extmgr.dll = C:\WINDOWS\system32\extmgr.dll
@{07C45BB1-4A8C-4642-A1F5-237E7215FF66} /*IE Microsoft BrowserBand*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{1C1EDB47-CE22-4bbb-B608-77B48F83C823} /*IE Fade Task*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{205D7A97-F16D-4691-86EF-F3075DCCA57D} /*IE Menu Desk Bar*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{3028902F-6374-48b2-8DC6-9725E775B926} /*IE AutoComplete*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{43886CD5-6529-41c4-A707-7B3C92C05E68} /*IE Navigation Bar*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{44C76ECD-F7FA-411c-9929-1B77BA77F524} /*IE Menu Site*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{4B78D326-D922-44f9-AF2A-07805C2A3560} /*IE Menu Band*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{6038EF75-ABFC-4e59-AB6F-12D397F6568D} /*IE Microsoft History AutoComplete List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{6B4ECC4F-16D1-4474-94AB-5A763F2A54AE} /*IE Tracking Shell Menu*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{6CF48EF8-44CD-45d2-8832-A16EA016311B} /*IE IShellFolderBand*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{73CFD649-CD48-4fd8-A272-2070EA56526B} /*IE BandProxy*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{98FF6D4B-6387-4b0a-8FBD-C5C4BB17B4F8} /*IE MRU AutoComplete List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{9A096BB5-9DC3-4D1C-8526-C3CBF991EA4E} /*IE RSS Feeder Folder*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{9D958C62-3954-4b44-8FAB-C4670C1DB4C2} /*IE Microsoft Shell Folder AutoComplete List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{B31C5FAE-961F-415b-BAF0-E697A5178B94} /*IE Microsoft Multiple AutoComplete List Container*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{BC476F4C-D9D7-4100-8D4E-E043F6DEC409} /*Microsoft Browser Architecture*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{BFAD62EE-9D54-4b2a-BF3B-76F90697BD2A} /*IE Shell Rebar BandSite*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{E6EE9AAC-F76B-4947-8260-A9F136138E11} /*IE Shell Band Site Menu*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{F2CF5485-4E02-4f68-819C-B92DE9277049} /*&Links*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{F83DAC1C-9BB9-4f2b-B619-09819DA81B0E} /*IE Registry Tree Options Utility*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} /*IE User Assist*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{FDE7673D-2E19-4145-8376-BBD58C4BC7BA} /*IE Custom MRU AutoCompleted List*/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll
@{e82a2d71-5b2f-43a0-97b8-81be15854de8} /*ShellLink for Application References*/C:\WINDOWS\system32\dfshim.dll = C:\WINDOWS\system32\dfshim.dll
@{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} /*Shell Icon Handler for Application References*/C:\WINDOWS\system32\dfshim.dll = C:\WINDOWS\system32\dfshim.dll
@{35786D3C-B075-49b9-88DD-029876E11C01} /*Portable Devices*/%SystemRoot%\system32\wpdshext.dll = %SystemRoot%\system32\wpdshext.dll
@{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8} /*Portable Devices Menu*/%SystemRoot%\system32\wpdshext.dll = %SystemRoot%\system32\wpdshext.dll
@{B41DB860-8EE4-11D2-9906-E49FADC173CA} /*WinRAR shell extension*/C:\Program Files\WinRAR\rarext.dll = C:\Program Files\WinRAR\rarext.dll
@{20082881-FC36-4E47-9A7A-644C95FF749F} /*IntelliPoint Wireless Control Panel Property Page*/"C:\Program Files\Microsoft IntelliPoint\ipcplwir.dll" = "C:\Program Files\Microsoft IntelliPoint\ipcplwir.dll"
@{AF90F543-6A3A-4C1B-8B16-ECEC073E69BE} /*IntelliPoint Wheel Control Panel Property Page*/"C:\Program Files\Microsoft IntelliPoint\ipcplwhl.dll" = "C:\Program Files\Microsoft IntelliPoint\ipcplwhl.dll"
@{653DCCC2-13DB-45B2-A389-427885776CFE} /*IntelliPoint Activities Control Panel Property Page*/"C:\Program Files\Microsoft IntelliPoint\ipcplact.dll" = "C:\Program Files\Microsoft IntelliPoint\ipcplact.dll"
@{124597D8-850A-41AE-849C-017A4FA99CA2} /*IntelliPoint Buttons Control Panel Property Page*/"C:\Program Files\Microsoft IntelliPoint\ipcplbtn.dll" = "C:\Program Files\Microsoft IntelliPoint\ipcplbtn.dll"
@{5CA3D70E-1895-11CF-8E15-001234567890} /*DriveLetterAccess*/C:\WINDOWS\system32\dla\tfswshx.dll = C:\WINDOWS\system32\dla\tfswshx.dll
@{DEE12703-6333-4D4E-8F34-738C4DCC2E04} /*RecordNow! SendToExt*/C:\Program Files\Sonic\Sonic Solutions Product CD\RecordNow! Plus\shlext.dll = C:\Program Files\Sonic\Sonic Solutions Product CD\RecordNow! Plus\shlext.dll
@{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} /*Autoplay for SlideShow*/(null) =
@{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D} /*Messenger Sharing Folders*/C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll = C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll
@{5464D816-CF16-4784-B9F3-75C0DB52B499} /*Yahoo! Mail*/C:\Program Files\Yahoo!\Common\Ymmapi.dll = C:\Program Files\Yahoo!\Common\Ymmapi.dll
@{45670FA8-ED97-4F44-BC93-305082590BFB} /*Microsoft.XPS.Shell.Metadata.1*/%SystemRoot%\System32\XPSSHHDR.DLL = %SystemRoot%\System32\XPSSHHDR.DLL
@{44121072-A222-48f2-A58A-6D9AD51EBBE9} /*Microsoft.XPS.Shell.Thumbnail.1*/%SystemRoot%\System32\XPSSHHDR.DLL = %SystemRoot%\System32\XPSSHHDR.DLL
@{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} /*AVG7 Shell Extension*/C:\Program Files\Grisoft\AVG7\avgse.dll = C:\Program Files\Grisoft\AVG7\avgse.dll
@{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} /*AVG7 Find Extension*/C:\Program Files\Grisoft\AVG7\avgse.dll = C:\Program Files\Grisoft\AVG7\avgse.dll
@{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} /*iTunes*/C:\Program Files\iTunes\iTunesMiniPlayer.dll = C:\Program Files\iTunes\iTunesMiniPlayer.dll

HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved@{DB8DC413-C0AA-11D0-9545-080009B1C2F3} /*Hummingbird Neighborhood*/ = c:\Program Files\Hummingbird\Connectivity\9.00\Hummingbird Neighborhood\heshell.dll

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ >>>
Adobe.Acrobat.ContextMenu@{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} = C:\Program Files\Adobe\Acrobat 7.0\Acrobat Elements\ContextMenu.dll
AVG Anti-Spyware@{8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll
AVG7 Shell Extension@{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} = C:\Program Files\Grisoft\AVG7\avgse.dll
VirusScan@{cda2863e-2497-4c49-9b89-06840e070a87} = C:\Program Files\Network Associates\VirusScan\shext.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll
WinZip@{E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
Yahoo! Mail@{5464D816-CF16-4784-B9F3-75C0DB52B499} = C:\Program Files\Yahoo!\Common\Ymmapi.dll

HKLM\Software\Classes\*\shellex\ContextMenuHandlers@{CA8ACAFA-5FBB-467B-B348-90DD488DE003} = C:\Program Files\SUPERAntiSpyware\SASCTXMN.DLL

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ >>>
AVG Anti-Spyware@{8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll
VirusScan@{cda2863e-2497-4c49-9b89-06840e070a87} = C:\Program Files\Network Associates\VirusScan\shext.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll
WinZip@{E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers@{CA8ACAFA-5FBB-467B-B348-90DD488DE003} = C:\Program Files\SUPERAntiSpyware\SASCTXMN.DLL

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ >>>
AVG7 Shell Extension@{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} = C:\Program Files\Grisoft\AVG7\avgse.dll
VirusScan@{cda2863e-2497-4c49-9b89-06840e070a87} = C:\Program Files\Network Associates\VirusScan\shext.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll
WinZip@{E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects >>>
@{02478D38-C3F9-4EFB-9B51-7695ECA05670}C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll = C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
@{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll = C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
@{AA58ED58-01DD-4d91-8333-CF10577473F7}c:\program files\google\googletoolbar1.dll = c:\program files\google\googletoolbar1.dll
@{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll = C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

HKLM\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://go.microsoft.com/fwlink/?LinkId=69157 = http://go.microsoft.com/fwlink/?LinkId=69157
@Start Pageabout:blank = about:blank
@Local Page\blank.htm = \blank.htm

HKCU\Software\Microsoft\Internet Explorer\Main >>>
@Start Pagehttp://c-inside.conti.de/generator/c-inside/Surf_Regions/en_US/Divisions/cas/homepage_cas_en.html = http://c-inside.conti.de/generator/c-insid…age_cas_en.html
@Local Page\blank.htm = \blank.htm

HKLM\Software\Classes\PROTOCOLS\Filter\text/xml@CLSID = C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

HKLM\Software\Classes\PROTOCOLS\Handler\ >>>
dvd@CLSID = C:\WINDOWS\system32\msvidctl.dll
its@CLSID = C:\Cadence\PSD_14.2\tools\capture\itss.dll
livecall@CLSID = C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
mhtml@CLSID = %SystemRoot%\System32\inetcomm.dll
ms-its@CLSID = C:\Cadence\PSD_14.2\tools\capture\itss.dll
msnim@CLSID = C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
mso-offdap@CLSID = C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
mso-offdap11@CLSID = C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
saphtmlp@CLSID = C:\Program Files\SAPPC\SapGui\SAPHTMLP.DLL
sapr3@CLSID = C:\Program Files\SAPPC\SapGui\SAPHTMLP.DLL
tv@CLSID = C:\WINDOWS\system32\msvidctl.dll
wia@CLSID = C:\WINDOWS\System32\wiascr.dll

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters@Domain = auto.contiwan.com

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BAC127EE-348D-4E98-A052-A5E1CEB94FDA} /*Local Area Connection 4*/ >>>
@IPAddress10.21.54.38 = 10.21.54.38
@NameServer10.21.43.131,10.21.43.132 = 10.21.43.131,10.21.43.132
@DefaultGateway10.21.54.38 = 10.21.54.38
@Domain =

HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\0000000004@LibraryPath = %SystemRoot%\system32\wshbth.dll

D:\Profiles\All Users\Start Menu\Programs\Startup >>>
Engineering Systems Tools.lnk = Engineering Systems Tools.lnk
VPN Client.lnk = VPN Client.lnk

—- EOF - GMER 1.0.13 —-
Post #17
gmerrk.txt

GMER 1.0.13.12551 - http://www.gmer.net
Rootkit scan 2007-08-10 21:09:53
Windows 5.1.2600 Service Pack 2


—- System - GMER 1.0.13 —-

SSDT \??\C:\WINDOWS\system32\Drivers\FireTDI.sys ZwClose
SSDT \??\C:\WINDOWS\system32\Drivers\FireTDI.sys ZwCreateProcess
SSDT \??\C:\WINDOWS\system32\Drivers\FireTDI.sys ZwCreateProcessEx
SSDT \??\C:\WINDOWS\system32\Drivers\FireTDI.sys ZwCreateSection
SSDT 89698109 ZwCreateThread
SSDT \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys ZwOpenProcess
SSDT \??\C:\WINDOWS\system32\Drivers\FireTDI.sys ZwResumeThread
SSDT \??\C:\WINDOWS\system32\Drivers\FireTDI.sys ZwSuspendThread
SSDT \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys ZwTerminateProcess

—- Kernel code sections - GMER 1.0.13 —-

? System32\Drivers\hiber_WMILIB.SYS The system cannot find the file specified.

—- User code sections - GMER 1.0.13 —-

.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 3700737C C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 3700733E C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 370074F0 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 37007436 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 370074B2 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 370073F8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes JMP 370073BA C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 37007474 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[316] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 3700752E C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[316] WS2_32.dll!select 71AB2DC0 5 Bytes JMP 37007626 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[316] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 3700756C C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[316] WS2_32.dll!bind 71AB3E00 5 Bytes JMP 370075E8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[316] WS2_32.dll!send 71AB428A 5 Bytes JMP 370075AA C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[316] WS2_32.dll!recv 71AB615A 5 Bytes JMP 37007664 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[316] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes JMP 3700779A C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[316] WININET.dll!InternetOpenA 42C2C869 5 Bytes JMP 37007816 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[316] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes JMP 370077D8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 3700737C C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 3700733E C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 370074F0 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 37007436 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 370074B2 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 370073F8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes JMP 370073BA C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[948] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 37007474 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[948] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 3700752E C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[948] WS2_32.dll!select 71AB2DC0 5 Bytes JMP 37007626 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[948] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 3700756C C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[948] WS2_32.dll!bind 71AB3E00 5 Bytes JMP 370075E8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[948] WS2_32.dll!send 71AB428A 5 Bytes JMP 370075AA C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[948] WS2_32.dll!recv 71AB615A 5 Bytes JMP 37007664 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[948] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes JMP 3700779A C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[948] WININET.dll!InternetOpenA 42C2C869 5 Bytes JMP 37007816 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\services.exe[948] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes JMP 370077D8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 3700737C C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 3700733E C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 370074F0 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 37007436 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 370074B2 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 370073F8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes JMP 370073BA C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[960] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 37007474 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[960] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 3700752E C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[960] WS2_32.dll!select 71AB2DC0 5 Bytes JMP 37007626 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[960] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 3700756C C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[960] WS2_32.dll!bind 71AB3E00 5 Bytes JMP 370075E8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[960] WS2_32.dll!send 71AB428A 5 Bytes JMP 370075AA C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[960] WS2_32.dll!recv 71AB615A 5 Bytes JMP 37007664 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[960] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes JMP 3700779A C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[960] WININET.dll!InternetOpenA 42C2C869 5 Bytes JMP 37007816 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\lsass.exe[960] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes JMP 370077D8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 3700737C C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 3700733E C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 370074F0 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 37007436 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 370074B2 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 370073F8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes JMP 370073BA C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 37007474 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 3700752E C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!select 71AB2DC0 5 Bytes JMP 37007626 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 3700756C C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!bind 71AB3E00 5 Bytes JMP 370075E8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!send 71AB428A 5 Bytes JMP 370075AA C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1176] WS2_32.dll!recv 71AB615A 5 Bytes JMP 37007664 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1176] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes JMP 3700779A C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1176] WININET.dll!InternetOpenA 42C2C869 5 Bytes JMP 37007816 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1176] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes JMP 370077D8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1232] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 3700737C C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1232] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 3700733E C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1232] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 370074F0 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1232] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 37007436 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1232] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 370074B2 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1232] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 370073F8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1232] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes JMP 370073BA C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1232] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 37007474 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1232] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 3700752E C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1232] WS2_32.dll!select 71AB2DC0 5 Bytes JMP 37007626 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1232] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 3700756C C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1232] WS2_32.dll!bind 71AB3E00 5 Bytes JMP 370075E8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1232] WS2_32.dll!send 71AB428A 5 Bytes JMP 370075AA C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1232] WS2_32.dll!recv 71AB615A 5 Bytes JMP 37007664 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1232] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes JMP 3700779A C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1232] WININET.dll!InternetOpenA 42C2C869 5 Bytes JMP 37007816 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\system32\svchost.exe[1232] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes JMP 370077D8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1376] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 3700737C C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1376] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 3700733E C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1376] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 370074F0 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1376] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 37007436 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1376] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 370074B2 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1376] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 370073F8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1376] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes JMP 370073BA C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1376] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 37007474 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1376] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 3700752E C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1376] WS2_32.dll!select 71AB2DC0 5 Bytes JMP 37007626 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1376] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 3700756C C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1376] WS2_32.dll!bind 71AB3E00 5 Bytes JMP 370075E8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1376] WS2_32.dll!send 71AB428A 5 Bytes JMP 370075AA C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1376] WS2_32.dll!recv 71AB615A 5 Bytes JMP 37007664 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1376] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes JMP 3700779A C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1376] WININET.dll!InternetOpenA 42C2C869 5 Bytes JMP 37007816 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1376] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes JMP 370077D8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1620] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 3700737C C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1620] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 3700733E C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1620] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 370074F0 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1620] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 37007436 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1620] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 370074B2 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1620] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 370073F8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1620] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes JMP 370073BA C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1620] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 37007474 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1620] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 3700752E C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1620] WS2_32.dll!select 71AB2DC0 5 Bytes JMP 37007626 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1620] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 3700756C C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1620] WS2_32.dll!bind 71AB3E00 5 Bytes JMP 370075E8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1620] WS2_32.dll!send 71AB428A 5 Bytes JMP 370075AA C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1620] WS2_32.dll!recv 71AB615A 5 Bytes JMP 37007664 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1620] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes JMP 3700779A C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1620] WININET.dll!InternetOpenA 42C2C869 5 Bytes JMP 37007816 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\System32\svchost.exe[1620] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes JMP 370077D8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[1632] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 3700737C C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[1632] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 3700733E C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[1632] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 370074F0 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[1632] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 37007436 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[1632] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 370074B2 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[1632] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 370073F8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[1632] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes JMP 370073BA C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[1632] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 37007474 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[1632] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 3700752E C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[1632] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes JMP 3700779A C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[1632] WININET.dll!InternetOpenA 42C2C869 5 Bytes JMP 37007816 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[1632] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes JMP 370077D8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[1632] WS2_32.dll!select 71AB2DC0 5 Bytes JMP 37007626 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[1632] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 3700756C C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[1632] WS2_32.dll!bind 71AB3E00 5 Bytes JMP 370075E8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[1632] WS2_32.dll!send 71AB428A 5 Bytes JMP 370075AA C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[1632] WS2_32.dll!recv 71AB615A 5 Bytes JMP 37007664 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 3700737C C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 3700733E C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 370074F0 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 37007436 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 370074B2 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 370073F8 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes JMP 370073BA C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 37007474 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 3700752E C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] USER32.dll!DialogBoxParamW 7E42555F 5 Bytes JMP 42F0F2A1 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] USER32.dll!DialogBoxIndirectParamW 7E432032 5 Bytes JMP 430A0277 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] USER32.dll!MessageBoxIndirectA 7E43A04A 5 Bytes JMP 430A01F8 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] USER32.dll!DialogBoxParamA 7E43B10C 5 Bytes JMP 430A023C C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] USER32.dll!MessageBoxExW 7E4505D8 5 Bytes JMP 430A0184 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] USER32.dll!MessageBoxExA 7E4505FC 5 Bytes JMP 430A01BE C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] USER32.dll!DialogBoxIndirectParamA 7E456B50 5 Bytes JMP 430A02B2 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] USER32.dll!MessageBoxIndirectW 7E4662AB 5 Bytes JMP 42F3164E C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] WS2_32.dll!select 71AB2DC0 5 Bytes JMP 37007626 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 3700756C C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] WS2_32.dll!bind 71AB3E00 5 Bytes JMP 370075E8 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] WS2_32.dll!send 71AB428A 5 Bytes JMP 370075AA C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] WS2_32.dll!recv 71AB615A 5 Bytes JMP 37007664 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes JMP 3700779A C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] WININET.dll!InternetOpenA 42C2C869 5 Bytes JMP 37007816 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1796] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes JMP 370077D8 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1804] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 3700737C C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1804] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 3700733E C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1804] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 370074F0 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1804] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 37007436 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1804] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 370074B2 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1804] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 370073F8 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1804] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes JMP 370073BA C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1804] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 37007474 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1804] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 3700752E C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1804] WS2_32.dll!select 71AB2DC0 5 Bytes JMP 37007626 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1804] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 3700756C C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1804] WS2_32.dll!bind 71AB3E00 5 Bytes JMP 370075E8 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1804] WS2_32.dll!send 71AB428A 5 Bytes JMP 370075AA C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1804] WS2_32.dll!recv 71AB615A 5 Bytes JMP 37007664 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1804] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes JMP 3700779A C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1804] WININET.dll!InternetOpenA 42C2C869 5 Bytes JMP 37007816 C:\WINDOWS\system32\EntApi.dll
.text C:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1804] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes JMP 370077D8 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2768] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 3700737C C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2768] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 3700733E C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2768] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 370074F0 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2768] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 37007436 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2768] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 370074B2 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2768] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 370073F8 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2768] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes JMP 370073BA C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2768] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 37007474 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2768] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 3700752E C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2768] WS2_32.dll!select 71AB2DC0 5 Bytes JMP 37007626 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2768] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 3700756C C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2768] WS2_32.dll!bind 71AB3E00 5 Bytes JMP 370075E8 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2768] WS2_32.dll!send 71AB428A 5 Bytes JMP 370075AA C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2768] WS2_32.dll!recv 71AB615A 5 Bytes JMP 37007664 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2768] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes JMP 3700779A C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2768] WININET.dll!InternetOpenA 42C2C869 5 Bytes JMP 37007816 C:\WINDOWS\system32\EntApi.dll
.text C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe[2768] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes JMP 370077D8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[6104] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 3700737C C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[6104] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 3700733E C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[6104] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 370074F0 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[6104] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 37007436 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[6104] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 370074B2 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[6104] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 370073F8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[6104] kernel32.dll!PeekNamedPipe 7C85F90F 5 Bytes JMP 370073BA C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[6104] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 37007474 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[6104] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 3700752E C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[6104] WININET.dll!InternetReadFile 42C2ABBC 5 Bytes JMP 3700779A C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[6104] WININET.dll!InternetOpenA 42C2C869 5 Bytes JMP 37007816 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[6104] WININET.dll!InternetOpenUrlA 42C306DD 5 Bytes JMP 370077D8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[6104] WS2_32.dll!select 71AB2DC0 5 Bytes JMP 37007626 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[6104] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 3700756C C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[6104] WS2_32.dll!bind 71AB3E00 5 Bytes JMP 370075E8 C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[6104] WS2_32.dll!send 71AB428A 5 Bytes JMP 370075AA C:\WINDOWS\system32\EntApi.dll
.text C:\WINDOWS\Explorer.EXE[6104] WS2_32.dll!recv 71AB615A 5 Bytes JMP 37007664 C:\WINDOWS\system32\EntApi.dll

—- Devices - GMER 1.0.13 —-

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_NAMED_PIPE [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_READ [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_MAILSLOT [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_POWER [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SYSTEM_CONTROL [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CHANGE [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA [BADDC404] avg7rsw.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_NAMED_PIPE [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_READ [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_MAILSLOT [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_POWER [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SYSTEM_CONTROL [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CHANGE [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA [B4AB5910] naiavf5x.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA [B4AB5910] naiavf5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE [B7405A70] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_NAMED_PIPE [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE [B7406290] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_READ [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_WRITE [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_INFORMATION [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_INFORMATION [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_EA [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_EA [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_FLUSH_BUFFERS [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_VOLUME_INFORMATION [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_VOLUME_INFORMATION [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DIRECTORY_CONTROL [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_FILE_SYSTEM_CONTROL [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL [B740A970] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [BAE4485A] avgtdi.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SHUTDOWN [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_LOCK_CONTROL [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP [B74063A0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_MAILSLOT [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_SECURITY [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_SECURITY [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_POWER [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SYSTEM_CONTROL [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CHANGE [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_QUOTA [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_QUOTA [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE [B9E94AA0] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_NAMED_PIPE [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE [B9E94AC0] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_READ [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_WRITE [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_INFORMATION [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_INFORMATION [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_EA [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_EA [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_FLUSH_BUFFERS [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_VOLUME_INFORMATION [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_VOLUME_INFORMATION [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DIRECTORY_CONTROL [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_FILE_SYSTEM_CONTROL [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL [B9E94B20] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [B9E94B00] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SHUTDOWN [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_LOCK_CONTROL [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP [B9E94AE0] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_MAILSLOT [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_SECURITY [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_SECURITY [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_POWER [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SYSTEM_CONTROL [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CHANGE [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_QUOTA [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_QUOTA [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [B7405A70] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_NAMED_PIPE [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE [B7406290] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_READ [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_WRITE [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_INFORMATION [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_INFORMATION [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_EA [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_EA [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_FLUSH_BUFFERS [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_VOLUME_INFORMATION [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_VOLUME_INFORMATION [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DIRECTORY_CONTROL [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_FILE_SYSTEM_CONTROL [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL [B740A970] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [BAE4485A] avgtdi.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SHUTDOWN [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_LOCK_CONTROL [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP [B74063A0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_MAILSLOT [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_SECURITY [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_SECURITY [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_POWER [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SYSTEM_CONTROL [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CHANGE [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_QUOTA [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_QUOTA [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [B9E94AA0] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_NAMED_PIPE [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE [B9E94AC0] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_READ [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_WRITE [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_INFORMATION [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_INFORMATION [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_EA [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_EA [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_FLUSH_BUFFERS [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_VOLUME_INFORMATION [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_VOLUME_INFORMATION [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DIRECTORY_CONTROL [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_FILE_SYSTEM_CONTROL [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL [B9E94B20] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [B9E94B00] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SHUTDOWN [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_LOCK_CONTROL [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP [B9E94AE0] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_MAILSLOT [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_SECURITY [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_SECURITY [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_POWER [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SYSTEM_CONTROL [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CHANGE [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_QUOTA [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_QUOTA [B9E94520] mvstdi5x.sys

Device \Driver\FireTDI \Device\FireTdiFilter IRP_MJ_INTERNAL_DEVICE_CONTROL [BAE4485A] avgtdi.sys
Device \Driver\BTHUSB \Device\0000b4 IRP_MJ_CREATE [B708ABB0] bthport.sys
Device \Driver\BTHUSB \Device\0000b4 IRP_MJ_CLOSE [B70B6990] bthport.sys
Device \Driver\BTHUSB \Device\0000b4 IRP_MJ_DEVICE_CONTROL [B7088F00] bthport.sys
Device \Driver\BTHUSB \Device\0000b4 IRP_MJ_INTERNAL_DEVICE_CONTROL [B7089A70] bthport.sys
Device \Driver\BTHUSB \Device\0000b4 IRP_MJ_CLEANUP [B708A920] bthport.sys
Device \Driver\BTHUSB \Device\0000b4 IRP_MJ_POWER [B70B7EE0] bthport.sys
Device \Driver\BTHUSB \Device\0000b4 IRP_MJ_SYSTEM_CONTROL [B70B87B0] bthport.sys
Device \Driver\BTHUSB \Device\0000b4 IRP_MJ_PNP [B70B73B0] bthport.sys
Device \Driver\BTHUSB \Device\0000b6 IRP_MJ_CREATE [B708ABB0] bthport.sys
Device \Driver\BTHUSB \Device\0000b6 IRP_MJ_CLOSE [B70B6990] bthport.sys
Device \Driver\BTHUSB \Device\0000b6 IRP_MJ_DEVICE_CONTROL [B7088F00] bthport.sys
Device \Driver\BTHUSB \Device\0000b6 IRP_MJ_INTERNAL_DEVICE_CONTROL [B7089A70] bthport.sys
Device \Driver\BTHUSB \Device\0000b6 IRP_MJ_CLEANUP [B708A920] bthport.sys
Device \Driver\BTHUSB \Device\0000b6 IRP_MJ_POWER [B70B7EE0] bthport.sys
Device \Driver\BTHUSB \Device\0000b6 IRP_MJ_SYSTEM_CONTROL [B70B87B0] bthport.sys
Device \Driver\BTHUSB \Device\0000b6 IRP_MJ_PNP [B70B73B0] bthport.sys

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CREATE [B7405A70] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_NAMED_PIPE [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CLOSE [B7406290] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_READ [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_WRITE [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_INFORMATION [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_INFORMATION [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_EA [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_EA [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_FLUSH_BUFFERS [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_VOLUME_INFORMATION [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_VOLUME_INFORMATION [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_DIRECTORY_CONTROL [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_FILE_SYSTEM_CONTROL [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CONTROL [B740A970] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [BAE4485A] avgtdi.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SHUTDOWN [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_LOCK_CONTROL [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CLEANUP [B74063A0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_MAILSLOT [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_SECURITY [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_SECURITY [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_POWER [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SYSTEM_CONTROL [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CHANGE [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_QUOTA [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_QUOTA [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CREATE [B9E94AA0] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_NAMED_PIPE [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CLOSE [B9E94AC0] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_READ [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_WRITE [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_INFORMATION [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_INFORMATION [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_EA [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_EA [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_FLUSH_BUFFERS [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_VOLUME_INFORMATION [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_VOLUME_INFORMATION [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_DIRECTORY_CONTROL [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_FILE_SYSTEM_CONTROL [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CONTROL [B9E94B20] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [B9E94B00] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SHUTDOWN [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_LOCK_CONTROL [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CLEANUP [B9E94AE0] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_MAILSLOT [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_SECURITY [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_SECURITY [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_POWER [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SYSTEM_CONTROL [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CHANGE [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_QUOTA [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_QUOTA [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE [B7405A70] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_NAMED_PIPE [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSE [B7406290] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_READ [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_WRITE [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_INFORMATION [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_INFORMATION [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_EA [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_EA [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_FLUSH_BUFFERS [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_VOLUME_INFORMATION [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_VOLUME_INFORMATION [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_DIRECTORY_CONTROL [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_FILE_SYSTEM_CONTROL [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CONTROL [B740A970] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [BAE4485A] avgtdi.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SHUTDOWN [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_LOCK_CONTROL [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CLEANUP [B74063A0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_MAILSLOT [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_SECURITY [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_SECURITY [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_POWER [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SYSTEM_CONTROL [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CHANGE [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_QUOTA [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_QUOTA [B740ADB0] FireTDI.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE [B9E94AA0] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_NAMED_PIPE [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSE [B9E94AC0] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_READ [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_WRITE [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_INFORMATION [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_INFORMATION [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_EA [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_EA [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_FLUSH_BUFFERS [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_VOLUME_INFORMATION [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_VOLUME_INFORMATION [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_DIRECTORY_CONTROL [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_FILE_SYSTEM_CONTROL [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CONTROL [B9E94B20] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [B9E94B00] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SHUTDOWN [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_LOCK_CONTROL [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CLEANUP [B9E94AE0] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_MAILSLOT [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_SECURITY [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_SECURITY [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_POWER [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SYSTEM_CONTROL [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CHANGE [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_QUOTA [B9E94520] mvstdi5x.sys
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_QUOTA [B9E94520] mvstdi5x.sys

Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer IRP_MJ_FILE_SYSTEM_CONTROL [B59546B0] tfsnifs.sys
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer IRP_MJ_FILE_SYSTEM_CONTROL [B59546B0] tfsnifs.sys
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer IRP_MJ_FILE_SYSTEM_CONTROL [B59546B0] tfsnifs.sys
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer IRP_MJ_FILE_SYSTEM_CONTROL [B59546B0] tfsnifs.sys
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer IRP_MJ_FILE_SYSTEM_CONTROL [B59546B0] tfsnifs.sys
Device \FileSystem\Cdfs \Cdfs IRP_MJ_FILE_SYSTEM_CONTROL [B595484C] tfsnifs.sys

—- EOF - GMER 1.0.13 —-
Post #18
Hi strus68

I had the GMER log checked over, and you were lucky enough not to pick up the rootkit normally installed with MessengerSkinner, apparently.

Could you post a new HijackThis log and let me know exactly the problems you are having, such as popups etc.

Also
You are operating your computer with multiple Anti Virus programs running in memory at once:
AVG McAfee

Anti-virus programs take up an enormous amount of your computer's resources when they are actively scanning your computer. Having two anti-virus programs running at the same time can cause your computer to run very slow, become unstable and even, in rare cases, crash.

If you choose to install more than one antivirus program on your computer, then only one of them should be active in memory at a time.

There are basically two types of these programs:
On-Access and On-Demand

On-Access Scanners
As the name implies, it runs in the background all the time the PC is turned on and running. The main function of an on-access scanner is to monitor activity on your machine.

On-Demand Scanners
As the name implies, are scanners that only run when you ask them to.
Such as:
Online Scans and scanners that run on your machine but are not actively scanning your machine.

Please disable one or the other so they do not conflict.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI