[RESOLVED] Rootkits and Virus and Trojans.... Oh My..

Hi Broni,

I wish this was just a "Hello" post, but I have something VERY wrong again. After you helped me fix this computer, I kept the kids away from it, but I fear that I let some creepy crawlies in.

I downloaded a free program called MediaCell Blackberry Converter, it was supposed to let me resize or edit video clips, to a size that can be sent to my wife's blackberry phone. Well it didn't work, and I got all kinds of problems since. I have uninstalled it, and tried to attack it with M-Bam, Webroot Spy Sweeper and McAfee anti virus ware.

All have detected and claimed to have removed virus's and trojans. But the problems keep popping back up. Detected and tried to remove several nasties. Generic Exploits, Aluroot, Privacy Protctor fake alerts, Artemis! (several different ones).

Any search that I do on Google, gets redirected to various sites. If I try to use Firefox, several tabs open to various BS sites. I keep getting fake alerts for a program called Privacy Protector. Computer is so slow, that I could tap out morse code on a hollow log, and communicate faster.

Helpppp........

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8127

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

11/9/2011 4:50:17 PM
mbam-log-2011-11-09 (16-50-17).txt

Scan type: Quick scan
Objects scanned: 215586
Time elapsed: 44 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-11-09 17:08:49
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-6 ST3500410AS rev.CC34
Running: gvgechfu.exe; Driver: C:\DOCUME~1\KENHEN~1\LOCALS~1\Temp\kwlyqpoc.sys


---- System - GMER 1.0.15 ----

SSDT 8A9C5DA0 ZwAllocateVirtualMemory
SSDT 8AB101C0 ZwCreateKey
SSDT 8AA74088 ZwCreateProcess
SSDT 8AA94020 ZwCreateProcessEx
SSDT 8AAD15C0 ZwCreateThread
SSDT 8AACBCD8 ZwDeleteKey
SSDT 8AA81020 ZwDeleteValueKey
SSDT 8A9C5E18 ZwQueueApcThread
SSDT 8A9C5CB0 ZwReadVirtualMemory
SSDT 8AAF8080 ZwRenameKey
SSDT 8AB0DC60 ZwSetContextThread
SSDT 8AAD1020 ZwSetInformationKey
SSDT 8A9E6020 ZwSetInformationProcess
SSDT 8AA92190 ZwSetInformationThread
SSDT 8AB10248 ZwSetValueKey
SSDT 8AACECB0 ZwSuspendProcess
SSDT 8AB0DBE8 ZwSuspendThread
SSDT 8AA818E0 ZwTerminateProcess
SSDT 8AA92208 ZwTerminateThread
SSDT 8A9C5D28 ZwWriteVirtualMemory

Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xB7E6629E]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwOpenKey [0xB7E661FC]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwOpenProcess [0xB7E661D4]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwOpenThread [0xB7E661E8]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwSetSecurityObject [0xB7E66274]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xB7E662B4]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwYieldExecution [0xB7E66288]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtMapViewOfSection
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtOpenProcess
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtOpenThread
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtSetSecurityObject

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwYieldExecution 80504B08 7 Bytes JMP B7E6628C mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB70AE3A0, 0x59FFE5, 0xE8000020]
init C:\WINDOWS\system32\drivers\monfilt.sys entry point in "init" section [0xB49DB280]
PAGE afd.sys B476D000 223 Bytes [58, 08, 8B, D6, FF, 15, 94, ...]
PAGE afd.sys B476D0E0 703 Bytes [64, 76, B4, 5F, 5E, EB, 12, ...]
PAGE afd.sys B476D3A0 446 Bytes [1A, 00, 89, 43, 1A, 33, F6, ...]
PAGE afd.sys B476D55F 107 Bytes [FC, FF, FF, 8B, D8, 85, DB, ...]
PAGE afd.sys B476D5CB 1148 Bytes [75, FC, FF, 15, 00, 64, 76, ...]
PAGE ...

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\Explorer.EXE[624] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00C9000A
.text C:\WINDOWS\Explorer.EXE[624] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00C9002C
.text C:\WINDOWS\Explorer.EXE[624] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00C9001B
.text C:\WINDOWS\Explorer.EXE[624] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C00FEF
.text C:\WINDOWS\Explorer.EXE[624] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C00F61
.text C:\WINDOWS\Explorer.EXE[624] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C00056
.text C:\WINDOWS\Explorer.EXE[624] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C00045
.text C:\WINDOWS\Explorer.EXE[624] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C00F7C
.text C:\WINDOWS\Explorer.EXE[624] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C00F9E
.text C:\WINDOWS\Explorer.EXE[624] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C0008C
.text C:\WINDOWS\Explorer.EXE[624] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C0007B
.text C:\WINDOWS\Explorer.EXE[624] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C000D3
.text C:\WINDOWS\Explorer.EXE[624] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C000C2
.text C:\WINDOWS\Explorer.EXE[624] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00C00F1F
.text C:\WINDOWS\Explorer.EXE[624] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00C00F8D
.text C:\WINDOWS\Explorer.EXE[624] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C00FD4
.text C:\WINDOWS\Explorer.EXE[624] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00C00F50
.text C:\WINDOWS\Explorer.EXE[624] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00C00FB9
.text C:\WINDOWS\Explorer.EXE[624] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00C0000A
.text C:\WINDOWS\Explorer.EXE[624] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00C000A7
.text C:\WINDOWS\Explorer.EXE[624] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00BF0FAF
.text C:\WINDOWS\Explorer.EXE[624] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00BF0062
.text C:\WINDOWS\Explorer.EXE[624] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00BF0FCA
.text C:\WINDOWS\Explorer.EXE[624] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00BF0FE5
.text C:\WINDOWS\Explorer.EXE[624] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00BF0047
.text C:\WINDOWS\Explorer.EXE[624] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00BF000A
.text C:\WINDOWS\Explorer.EXE[624] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00BF002C
.text C:\WINDOWS\Explorer.EXE[624] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00BF001B
.text C:\WINDOWS\Explorer.EXE[624] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00FE0047
.text C:\WINDOWS\Explorer.EXE[624] msvcrt.dll!system 77C293C7 5 Bytes JMP 00FE0036
.text C:\WINDOWS\Explorer.EXE[624] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00FE0FCD
.text C:\WINDOWS\Explorer.EXE[624] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00FE0FEF
.text C:\WINDOWS\Explorer.EXE[624] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00FE0FBC
.text C:\WINDOWS\Explorer.EXE[624] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00FE0FDE
.text C:\WINDOWS\Explorer.EXE[624] WININET.dll!InternetOpenA 3D95D698 5 Bytes JMP 00CE0FE5
.text C:\WINDOWS\Explorer.EXE[624] WININET.dll!InternetOpenW 3D95DB11 5 Bytes JMP 00CE000A
.text C:\WINDOWS\Explorer.EXE[624] WININET.dll!InternetOpenUrlA 3D95F3AC 5 Bytes JMP 00CE001B
.text C:\WINDOWS\Explorer.EXE[624] WININET.dll!InternetOpenUrlW 3D9A6D6F 5 Bytes JMP 00CE002C
.text C:\WINDOWS\Explorer.EXE[624] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00FD0FE5
.text C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe[692] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 62419A20 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe[692] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 62419AE2 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\WINDOWS\system32\svchost.exe[1036] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00C30000
.text C:\WINDOWS\system32\svchost.exe[1036] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00C30040
.text C:\WINDOWS\system32\svchost.exe[1036] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00C30025
.text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C20FE5
.text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C20F9E
.text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C20089
.text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C20FAF
.text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C2006C
.text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C20036
.text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C200AE
.text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C20F66
.text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C20F37
.text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C200D0
.text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00C20F1C
.text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00C20047
.text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C20FCA
.text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00C20F83
.text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00C20025
.text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00C20000
.text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00C200BF
.text C:\WINDOWS\system32\svchost.exe[1036] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00C10FB9
.text C:\WINDOWS\system32\svchost.exe[1036] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00C10040
.text C:\WINDOWS\system32\svchost.exe[1036] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00C10FD4
.text C:\WINDOWS\system32\svchost.exe[1036] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00C10FE5
.text C:\WINDOWS\system32\svchost.exe[1036] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00C10F83
.text C:\WINDOWS\system32\svchost.exe[1036] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00C10000
.text C:\WINDOWS\system32\svchost.exe[1036] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00C10F94
.text C:\WINDOWS\system32\svchost.exe[1036] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [E1, 88] {LOOPZ 0xffffffffffffff8a}
.text C:\WINDOWS\system32\svchost.exe[1036] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00C1001B
.text C:\WINDOWS\system32\svchost.exe[1036] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00C00F8B
.text C:\WINDOWS\system32\svchost.exe[1036] msvcrt.dll!system 77C293C7 5 Bytes JMP 00C00FB0
.text C:\WINDOWS\system32\svchost.exe[1036] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00C00FC1
.text C:\WINDOWS\system32\svchost.exe[1036] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00C00FE3
.text C:\WINDOWS\system32\svchost.exe[1036] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00C00020
.text C:\WINDOWS\system32\svchost.exe[1036] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00C00FD2
.text C:\WINDOWS\system32\svchost.exe[1036] WININET.dll!InternetOpenA 3D95D698 5 Bytes JMP 00BE0FEF
.text C:\WINDOWS\system32\svchost.exe[1036] WININET.dll!InternetOpenW 3D95DB11 5 Bytes JMP 00BE0FDE
.text C:\WINDOWS\system32\svchost.exe[1036] WININET.dll!InternetOpenUrlA 3D95F3AC 5 Bytes JMP 00BE0FCD
.text C:\WINDOWS\system32\svchost.exe[1036] WININET.dll!InternetOpenUrlW 3D9A6D6F 5 Bytes JMP 00BE0FB2
.text C:\WINDOWS\system32\svchost.exe[1036] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BF0FEF
.text C:\WINDOWS\system32\services.exe[1112] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00050FEF
.text C:\WINDOWS\system32\services.exe[1112] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00050FC3
.text C:\WINDOWS\system32\services.exe[1112] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00050FD4
.text C:\WINDOWS\system32\services.exe[1112] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 0004000A
.text C:\WINDOWS\system32\services.exe[1112] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00040F77
.text C:\WINDOWS\system32\services.exe[1112] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 0004006C
.text C:\WINDOWS\system32\services.exe[1112] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00040F92
.text C:\WINDOWS\system32\services.exe[1112] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00040051
.text C:\WINDOWS\system32\services.exe[1112] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00040040
.text C:\WINDOWS\system32\services.exe[1112] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 000400A9
.text C:\WINDOWS\system32\services.exe[1112] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00040098
.text C:\WINDOWS\system32\services.exe[1112] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 000400D5
.text C:\WINDOWS\system32\services.exe[1112] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 000400C4
.text C:\WINDOWS\system32\services.exe[1112] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00040F2B
.text C:\WINDOWS\system32\services.exe[1112] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00040FB9
.text C:\WINDOWS\system32\services.exe[1112] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00040FEF
.text C:\WINDOWS\system32\services.exe[1112] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 0004007D
.text C:\WINDOWS\system32\services.exe[1112] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00040FD4
.text C:\WINDOWS\system32\services.exe[1112] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00040025
.text C:\WINDOWS\system32\services.exe[1112] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00040F46
.text C:\WINDOWS\system32\services.exe[1112] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00DF001B
.text C:\WINDOWS\system32\services.exe[1112] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00DF006C
.text C:\WINDOWS\system32\services.exe[1112] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00DF0FD4
.text C:\WINDOWS\system32\services.exe[1112] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00DF0000
.text C:\WINDOWS\system32\services.exe[1112] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00DF0047
.text C:\WINDOWS\system32\services.exe[1112] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00DF0FE5
.text C:\WINDOWS\system32\services.exe[1112] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00DF0036
.text C:\WINDOWS\system32\services.exe[1112] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00DF0FAF
.text C:\WINDOWS\system32\services.exe[1112] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00070F9A
.text C:\WINDOWS\system32\services.exe[1112] msvcrt.dll!system 77C293C7 5 Bytes JMP 00070025
.text C:\WINDOWS\system32\services.exe[1112] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00070FC6
.text C:\WINDOWS\system32\services.exe[1112] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00070FE3
.text C:\WINDOWS\system32\services.exe[1112] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00070FB5
.text C:\WINDOWS\system32\services.exe[1112] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00070000
.text C:\WINDOWS\system32\services.exe[1112] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00060FEF
.text C:\WINDOWS\system32\lsass.exe[1124] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00F70000
.text C:\WINDOWS\system32\lsass.exe[1124] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00F70011
.text C:\WINDOWS\system32\lsass.exe[1124] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00F70FDB
.text C:\WINDOWS\system32\lsass.exe[1124] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00F60FEF
.text C:\WINDOWS\system32\lsass.exe[1124] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00F60F61
.text C:\WINDOWS\system32\lsass.exe[1124] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00F60056
.text C:\WINDOWS\system32\lsass.exe[1124] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00F60F72
.text C:\WINDOWS\system32\lsass.exe[1124] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00F60F8D
.text C:\WINDOWS\system32\lsass.exe[1124] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00F60014
.text C:\WINDOWS\system32\lsass.exe[1124] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00F60F29
.text C:\WINDOWS\system32\lsass.exe[1124] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00F60071
.text C:\WINDOWS\system32\lsass.exe[1124] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00F6009D
.text C:\WINDOWS\system32\lsass.exe[1124] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00F60082
.text C:\WINDOWS\system32\lsass.exe[1124] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00F60EE9
.text C:\WINDOWS\system32\lsass.exe[1124] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00F60025
.text C:\WINDOWS\system32\lsass.exe[1124] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00F60FCA
.text C:\WINDOWS\system32\lsass.exe[1124] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00F60F50
.text C:\WINDOWS\system32\lsass.exe[1124] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00F60FA8
.text C:\WINDOWS\system32\lsass.exe[1124] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00F60FB9
.text C:\WINDOWS\system32\lsass.exe[1124] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00F60F0E
.text C:\WINDOWS\system32\lsass.exe[1124] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00FF0039
.text C:\WINDOWS\system32\lsass.exe[1124] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00FF005E
.text C:\WINDOWS\system32\lsass.exe[1124] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00FF001E
.text C:\WINDOWS\system32\lsass.exe[1124] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00FF0FDE
.text C:\WINDOWS\system32\lsass.exe[1124] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00FF0FA1
.text C:\WINDOWS\system32\lsass.exe[1124] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00FF0FEF
.text C:\WINDOWS\system32\lsass.exe[1124] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00FF0FB2
.text C:\WINDOWS\system32\lsass.exe[1124] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [1F, 89]
.text C:\WINDOWS\system32\lsass.exe[1124] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00FF0FC3
.text C:\WINDOWS\system32\lsass.exe[1124] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00FE0027
.text C:\WINDOWS\system32\lsass.exe[1124] msvcrt.dll!system 77C293C7 5 Bytes JMP 00FE0F9C
.text C:\WINDOWS\system32\lsass.exe[1124] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00FE0FD2
.text C:\WINDOWS\system32\lsass.exe[1124] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00FE0000
.text C:\WINDOWS\system32\lsass.exe[1124] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00FE0FC1
.text C:\WINDOWS\system32\lsass.exe[1124] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00FE0FE3
.text C:\WINDOWS\system32\lsass.exe[1124] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00F9000A
.text C:\WINDOWS\system32\lsass.exe[1124] WININET.dll!InternetOpenA 3D95D698 5 Bytes JMP 00F80FEF
.text C:\WINDOWS\system32\lsass.exe[1124] WININET.dll!InternetOpenW 3D95DB11 5 Bytes JMP 00F8000A
.text C:\WINDOWS\system32\lsass.exe[1124] WININET.dll!InternetOpenUrlA 3D95F3AC 5 Bytes JMP 00F8001B
.text C:\WINDOWS\system32\lsass.exe[1124] WININET.dll!InternetOpenUrlW 3D9A6D6F 5 Bytes JMP 00F80FD4
.text C:\WINDOWS\system32\svchost.exe[1412] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00F80FEF
.text C:\WINDOWS\system32\svchost.exe[1412] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00F80FC3
.text C:\WINDOWS\system32\svchost.exe[1412] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00F80FDE
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00F70FE5
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00F70076
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00F70F77
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00F70051
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00F70040
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00F70025
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00F700A4
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00F70F5C
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00F70F37
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00F700D0
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00F70F1C
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00F70F9E
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00F70000
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00F70087
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00F70FB9
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00F70FD4
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00F700B5
.text C:\WINDOWS\system32\svchost.exe[1412] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 02490FC0
.text C:\WINDOWS\system32\svchost.exe[1412] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 02490F9B
.text C:\WINDOWS\system32\svchost.exe[1412] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0249001B
.text C:\WINDOWS\system32\svchost.exe[1412] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 0249000A
.text C:\WINDOWS\system32\svchost.exe[1412] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 02490058
.text C:\WINDOWS\system32\svchost.exe[1412] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 02490FEF
.text C:\WINDOWS\system32\svchost.exe[1412] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 02490047
.text C:\WINDOWS\system32\svchost.exe[1412] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 0249002C
.text C:\WINDOWS\system32\svchost.exe[1412] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00FF0FDB
.text C:\WINDOWS\system32\svchost.exe[1412] msvcrt.dll!system 77C293C7 5 Bytes JMP 00FF005C
.text C:\WINDOWS\system32\svchost.exe[1412] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00FF003A
.text C:\WINDOWS\system32\svchost.exe[1412] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00FF000C
.text C:\WINDOWS\system32\svchost.exe[1412] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00FF004B
.text C:\WINDOWS\system32\svchost.exe[1412] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00FF001D
.text C:\WINDOWS\system32\svchost.exe[1412] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00F90FE5
.text C:\WINDOWS\system32\svchost.exe[1464] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 01060000
.text C:\WINDOWS\system32\svchost.exe[1464] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 01060FD4
.text C:\WINDOWS\system32\svchost.exe[1464] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 01060FE5
.text C:\WINDOWS\system32\svchost.exe[1464] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 01050FE5
.text C:\WINDOWS\system32\svchost.exe[1464] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 01050F5E
.text C:\WINDOWS\system32\svchost.exe[1464] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 01050F79
.text C:\WINDOWS\system32\svchost.exe[1464] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 01050F8A
.text C:\WINDOWS\system32\svchost.exe[1464] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 01050047
.text C:\WINDOWS\system32\svchost.exe[1464] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 01050FAF
.text C:\WINDOWS\system32\svchost.exe[1464] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 01050089
.text C:\WINDOWS\system32\svchost.exe[1464] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 01050078
.text C:\WINDOWS\system32\svchost.exe[1464] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 01050F04
.text C:\WINDOWS\system32\svchost.exe[1464] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 01050F15
.text C:\WINDOWS\system32\svchost.exe[1464] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 01050EF3
.text C:\WINDOWS\system32\svchost.exe[1464] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 01050036
.text C:\WINDOWS\system32\svchost.exe[1464] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 0105000A
.text C:\WINDOWS\system32\svchost.exe[1464] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 01050F4D
.text C:\WINDOWS\system32\svchost.exe[1464] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 01050FC0
.text C:\WINDOWS\system32\svchost.exe[1464] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 0105001B
.text C:\WINDOWS\system32\svchost.exe[1464] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 01050F26
.text C:\WINDOWS\system32\svchost.exe[1464] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 010A0036
.text C:\WINDOWS\system32\svchost.exe[1464] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 010A0098
.text C:\WINDOWS\system32\svchost.exe[1464] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 010A0025
.text C:\WINDOWS\system32\svchost.exe[1464] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 010A0FE5
.text C:\WINDOWS\system32\svchost.exe[1464] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 010A0087
.text C:\WINDOWS\system32\svchost.exe[1464] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 010A0000
.text C:\WINDOWS\system32\svchost.exe[1464] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 010A006C
.text C:\WINDOWS\system32\svchost.exe[1464] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 010A005B
.text C:\WINDOWS\system32\svchost.exe[1464] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 0109002C
.text C:\WINDOWS\system32\svchost.exe[1464] msvcrt.dll!system 77C293C7 5 Bytes JMP 01090FA1
.text C:\WINDOWS\system32\svchost.exe[1464] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 01090FD7
.text C:\WINDOWS\system32\svchost.exe[1464] msvcrt.dll!_open 77C2F566 5 Bytes JMP 01090000
.text C:\WINDOWS\system32\svchost.exe[1464] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 01090FB2
.text C:\WINDOWS\system32\svchost.exe[1464] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 01090011
.text C:\WINDOWS\system32\svchost.exe[1464] WS2_32.dll!socket 71AB4211 5 Bytes JMP 01080000
.text C:\WINDOWS\system32\svchost.exe[1464] WININET.dll!InternetOpenA 3D95D698 5 Bytes JMP 0107000A
.text C:\WINDOWS\system32\svchost.exe[1464] WININET.dll!InternetOpenW 3D95DB11 5 Bytes JMP 01070FE5
.text C:\WINDOWS\system32\svchost.exe[1464] WININET.dll!InternetOpenUrlA 3D95F3AC 5 Bytes JMP 01070FD4
.text C:\WINDOWS\system32\svchost.exe[1464] WININET.dll!InternetOpenUrlW 3D9A6D6F 5 Bytes JMP 01070FB9
.text C:\WINDOWS\system32\svchost.exe[1568] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00B70000
.text C:\WINDOWS\system32\svchost.exe[1568] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00B70022
.text C:\WINDOWS\system32\svchost.exe[1568] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00B70011
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00B60000
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00B60F70
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00B60F81
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00B60FA8
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00B60FC3
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00B60FD4
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00B60096
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00B60F4E
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00B600B1
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00B60F18
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00B600C2
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00B6005B
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00B60011
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00B60F5F
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00B60036
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00B60FE5
.text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00B60F29
.text C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00B50011
.text C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00B50036
.text

C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00B50FC0
.text C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00B50000
.text C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00B50F79
.text C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00B50FEF
.text C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00B50F9E
.text C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [D5, 88] {AAD 0x88}
.text C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00B50FAF
.text C:\WINDOWS\system32\svchost.exe[1568] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00B40069
.text C:\WINDOWS\system32\svchost.exe[1568] msvcrt.dll!system 77C293C7 5 Bytes JMP 00B40058
.text C:\WINDOWS\system32\svchost.exe[1568] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00B4002C
.text C:\WINDOWS\system32\svchost.exe[1568] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00B40000
.text C:\WINDOWS\system32\svchost.exe[1568] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00B40047
.text C:\WINDOWS\system32\svchost.exe[1568] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00B40011
.text C:\WINDOWS\System32\svchost.exe[1580] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 0325000A
.text C:\WINDOWS\System32\svchost.exe[1580] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 03250FCA
.text C:\WINDOWS\System32\svchost.exe[1580] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 03250FEF
.text C:\WINDOWS\System32\svchost.exe[1580] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00FE000A
.text C:\WINDOWS\System32\svchost.exe[1580] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00FC000C
.text C:\WINDOWS\System32\svchost.exe[1580] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 03240000
.text C:\WINDOWS\System32\svchost.exe[1580] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 03240078
.text C:\WINDOWS\System32\svchost.exe[1580] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 03240F83
.text C:\WINDOWS\System32\svchost.exe[1580] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 03240F94
.text C:\WINDOWS\System32\svchost.exe[1580] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 03240051
.text C:\WINDOWS\System32\svchost.exe[1580] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 03240036
.text C:\WINDOWS\System32\svchost.exe[1580] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 03240F3C
.text C:\WINDOWS\System32\svchost.exe[1580] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 03240F4D
.text C:\WINDOWS\System32\svchost.exe[1580] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 03240F10
.text C:\WINDOWS\System32\svchost.exe[1580] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 032400A9
.text C:\WINDOWS\System32\svchost.exe[1580] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 03240EF5
.text C:\WINDOWS\System32\svchost.exe[1580] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 03240FAF
.text C:\WINDOWS\System32\svchost.exe[1580] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 03240FEF
.text C:\WINDOWS\System32\svchost.exe[1580] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 03240F5E
.text C:\WINDOWS\System32\svchost.exe[1580] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 03240FCA
.text C:\WINDOWS\System32\svchost.exe[1580] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 03240025
.text C:\WINDOWS\System32\svchost.exe[1580] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 03240F2B
.text C:\WINDOWS\System32\svchost.exe[1580] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 032E0FCA
.text C:\WINDOWS\System32\svchost.exe[1580] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 032E0F83
.text C:\WINDOWS\System32\svchost.exe[1580] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 032E001B
.text C:\WINDOWS\System32\svchost.exe[1580] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 032E0FEF
.text C:\WINDOWS\System32\svchost.exe[1580] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 032E0F94
.text C:\WINDOWS\System32\svchost.exe[1580] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 032E0000
.text C:\WINDOWS\System32\svchost.exe[1580] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 032E0036
.text C:\WINDOWS\System32\svchost.exe[1580] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 032E0FAF
.text C:\WINDOWS\System32\svchost.exe[1580] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 032D0F84
.text C:\WINDOWS\System32\svchost.exe[1580] msvcrt.dll!system 77C293C7 5 Bytes JMP 032D0F95
.text C:\WINDOWS\System32\svchost.exe[1580] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 032D0FC1
.text C:\WINDOWS\System32\svchost.exe[1580] msvcrt.dll!_open 77C2F566 5 Bytes JMP 032D0FEF
.text C:\WINDOWS\System32\svchost.exe[1580] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 032D0FA6
.text C:\WINDOWS\System32\svchost.exe[1580] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 032D0FD2
.text C:\WINDOWS\System32\svchost.exe[1580] WS2_32.dll!socket 71AB4211 5 Bytes JMP 03270FEF
.text C:\WINDOWS\System32\svchost.exe[1580] WININET.dll!InternetOpenA 3D95D698 5 Bytes JMP 03260FEF
.text C:\WINDOWS\System32\svchost.exe[1580] WININET.dll!InternetOpenW 3D95DB11 5 Bytes JMP 0326000A
.text C:\WINDOWS\System32\svchost.exe[1580] WININET.dll!InternetOpenUrlA 3D95F3AC 5 Bytes JMP 0326001B
.text C:\WINDOWS\System32\svchost.exe[1580] WININET.dll!InternetOpenUrlW 3D9A6D6F 3 Bytes JMP 0326002C
.text C:\WINDOWS\System32\svchost.exe[1580] WININET.dll!InternetOpenUrlW + 4 3D9A6D73 1 Byte [C5]
.text C:\WINDOWS\system32\svchost.exe[1628] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00640000
.text C:\WINDOWS\system32\svchost.exe[1628] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00640FDB
.text C:\WINDOWS\system32\svchost.exe[1628] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00640011
.text C:\WINDOWS\system32\svchost.exe[1628] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 0063000A
.text C:\WINDOWS\system32\svchost.exe[1628] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 0063007D
.text C:\WINDOWS\system32\svchost.exe[1628] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00630062
.text C:\WINDOWS\system32\svchost.exe[1628] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00630F94
.text C:\WINDOWS\system32\svchost.exe[1628] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00630051
.text C:\WINDOWS\system32\svchost.exe[1628] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00630036
.text C:\WINDOWS\system32\svchost.exe[1628] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00630F46
.text C:\WINDOWS\system32\svchost.exe[1628] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 0063008E
.text C:\WINDOWS\system32\svchost.exe[1628] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00630EFF
.text C:\WINDOWS\system32\svchost.exe[1628] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00630F10
.text C:\WINDOWS\system32\svchost.exe[1628] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 006300BD
.text C:\WINDOWS\system32\svchost.exe[1628] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00630FB9
.text C:\WINDOWS\system32\svchost.exe[1628] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 0063001B
.text C:\WINDOWS\system32\svchost.exe[1628] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00630F63
.text C:\WINDOWS\system32\svchost.exe[1628] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00630FD4
.text C:\WINDOWS\system32\svchost.exe[1628] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00630FE5
.text C:\WINDOWS\system32\svchost.exe[1628] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00630F35
.text C:\WINDOWS\system32\svchost.exe[1628] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00660FD4
.text C:\WINDOWS\system32\svchost.exe[1628] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00660F83
.text C:\WINDOWS\system32\svchost.exe[1628] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0066001B
.text C:\WINDOWS\system32\svchost.exe[1628] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00660FE5
.text C:\WINDOWS\system32\svchost.exe[1628] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00660040
.text C:\WINDOWS\system32\svchost.exe[1628] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00660000
.text C:\WINDOWS\system32\svchost.exe[1628] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00660F9E
.text C:\WINDOWS\system32\svchost.exe[1628] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [86, 88]
.text C:\WINDOWS\system32\svchost.exe[1628] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00660FAF
.text C:\WINDOWS\system32\svchost.exe[1628] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00650049
.text C:\WINDOWS\system32\svchost.exe[1628] msvcrt.dll!system 77C293C7 5 Bytes JMP 0065002E
.text C:\WINDOWS\system32\svchost.exe[1628] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00650FD2
.text C:\WINDOWS\system32\svchost.exe[1628] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00650FEF
.text C:\WINDOWS\system32\svchost.exe[1628] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 0065001D
.text C:\WINDOWS\system32\svchost.exe[1628] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0065000C
.text C:\WINDOWS\system32\svchost.exe[1716] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 01DB0FE5
.text C:\WINDOWS\system32\svchost.exe[1716] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 01DB0FCA
.text C:\WINDOWS\system32\svchost.exe[1716] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 01DB0000
.text C:\WINDOWS\system32\svchost.exe[1716] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 01DA0FEF
.text C:\WINDOWS\system32\svchost.exe[1716] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 01DA0F74
.text C:\WINDOWS\system32\svchost.exe[1716] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 01DA0069
.text C:\WINDOWS\system32\svchost.exe[1716] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 01DA0058
.text C:\WINDOWS\system32\svchost.exe[1716] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 01DA0F9B
.text C:\WINDOWS\system32\svchost.exe[1716] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 01DA0FC0
.text C:\WINDOWS\system32\svchost.exe[1716] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 01DA0084
.text C:\WINDOWS\system32\svchost.exe[1716] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 01DA0F48
.text C:\WINDOWS\system32\svchost.exe[1716] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 01DA00B0
.text C:\WINDOWS\system32\svchost.exe[1716] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 01DA0F21
.text C:\WINDOWS\system32\svchost.exe[1716] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 01DA00C1
.text C:\WINDOWS\system32\svchost.exe[1716] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 01DA003D
.text C:\WINDOWS\system32\svchost.exe[1716] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 01DA0000
.text C:\WINDOWS\system32\svchost.exe[1716] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 01DA0F63
.text C:\WINDOWS\system32\svchost.exe[1716] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 01DA0022
.text C:\WINDOWS\system32\svchost.exe[1716] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 01DA0011
.text C:\WINDOWS\system32\svchost.exe[1716] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 01DA009F
.text C:\WINDOWS\system32\svchost.exe[1716] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 01C10036
.text C:\WINDOWS\system32\svchost.exe[1716] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 01C10F9E
.text C:\WINDOWS\system32\svchost.exe[1716] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 01C10025
.text C:\WINDOWS\system32\svchost.exe[1716] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 01C1000A
.text C:\WINDOWS\system32\svchost.exe[1716] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 01C10FAF
.text C:\WINDOWS\system32\svchost.exe[1716] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 01C10FEF
.text C:\WINDOWS\system32\svchost.exe[1716] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 01C10051
.text C:\WINDOWS\system32\svchost.exe[1716] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 01C10FCA
.text C:\WINDOWS\system32\svchost.exe[1716] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 01C00031
.text C:\WINDOWS\system32\svchost.exe[1716] msvcrt.dll!system 77C293C7 5 Bytes JMP 01C00FB0
.text C:\WINDOWS\system32\svchost.exe[1716] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 01C00016
.text C:\WINDOWS\system32\svchost.exe[1716] msvcrt.dll!_open 77C2F566 5 Bytes JMP 01C00FEF
.text C:\WINDOWS\system32\svchost.exe[1716] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 01C00FC1
.text C:\WINDOWS\system32\svchost.exe[1716] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 01C00FDE
.text C:\WINDOWS\system32\svchost.exe[1716] WS2_32.dll!socket 71AB4211 5 Bytes JMP 01BF0FEF
.text C:\WINDOWS\system32\svchost.exe[1716] WININET.dll!InternetOpenA 3D95D698 5 Bytes JMP 01BE0FEF
.text C:\WINDOWS\system32\svchost.exe[1716] WININET.dll!InternetOpenW 3D95DB11 5 Bytes JMP 01BE0FD4
.text C:\WINDOWS\system32\svchost.exe[1716] WININET.dll!InternetOpenUrlA 3D95F3AC 5 Bytes JMP 01BE0FC3
.text C:\WINDOWS\system32\svchost.exe[1716] WININET.dll!InternetOpenUrlW 3D9A6D6F 5 Bytes JMP 01BE0FB2
.text C:\WINDOWS\system32\svchost.exe[1760] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00AC0FE5
.text C:\WINDOWS\system32\svchost.exe[1760] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00AC0FC3
.text C:\WINDOWS\system32\svchost.exe[1760] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00AC0FD4
.text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00AB0FEF
.text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00AB0F52
.text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00AB0047
.text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00AB002C
.text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00AB0F6F
.text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00AB0000
.text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00AB0F26
.text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00AB006E
.text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00AB00AB
.text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00AB009A
.text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00AB00BC
.text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00AB001B
.text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00AB0FCA
.text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00AB0F37
.text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00AB0F94
.text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00AB0FAF
.text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00AB0089
.text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00AA0FC3
.text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00AA004A
.text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00AA0FD4
.text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00AA0FEF
.text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00AA0039
.text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00AA0000
.text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00AA0F97
.text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [CA, 88]
.text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00AA0FB2
.text C:\WINDOWS\system32\svchost.exe[1760] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00AF0FB5
.text C:\WINDOWS\system32\svchost.exe[1760] msvcrt.dll!system 77C293C7 5 Bytes JMP 00AF0036
.text C:\WINDOWS\system32\svchost.exe[1760] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00AF0FD7
.text C:\WINDOWS\system32\svchost.exe[1760] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00AF0000
.text C:\WINDOWS\system32\svchost.exe[1760] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00AF0FC6
.text C:\WINDOWS\system32\svchost.exe[1760] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00AF0011
.text C:\WINDOWS\system32\svchost.exe[1760] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00AE0FE5
.text C:\WINDOWS\system32\svchost.exe[1760] WININET.dll!InternetOpenA 3D95D698 5 Bytes JMP 00AD0FEF
.text C:\WINDOWS\system32\svchost.exe[1760] WININET.dll!InternetOpenW 3D95DB11 5 Bytes JMP 00AD0FDE
.text C:\WINDOWS\system32\svchost.exe[1760] WININET.dll!InternetOpenUrlA 3D95F3AC 5 Bytes JMP 00AD0FC3
.text C:\WINDOWS\system32\svchost.exe[1760] WININET.dll!InternetOpenUrlW 3D9A6D6F 5 Bytes JMP 00AD0FB2
.text C:\WINDOWS\system32\svchost.exe[1888] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 01330FEF
.text C:\WINDOWS\system32\svchost.exe[1888] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 01330FD4
.text C:\WINDOWS\system32\svchost.exe[1888] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0133000A
.text C:\WINDOWS\system32\svchost.exe[1888] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 01320000
.text C:\WINDOWS\system32\svchost.exe[1888] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 01320058
.text C:\WINDOWS\system32\svchost.exe[1888] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 01320F59
.text C:\WINDOWS\system32\svchost.exe[1888] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0132003D
.text C:\WINDOWS\system32\svchost.exe[1888] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 0132002C
.text C:\WINDOWS\system32\svchost.exe[1888] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 01320FAF
.text C:\WINDOWS\system32\svchost.exe[1888] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 01320073
.text C:\WINDOWS\system32\svchost.exe[1888] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 01320F2B
.text C:\WINDOWS\system32\svchost.exe[1888] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 01320095
.text C:\WINDOWS\system32\svchost.exe[1888] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 01320F06
.text C:\WINDOWS\system32\svchost.exe[1888] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 013200A6
.text C:\WINDOWS\system32\svchost.exe[1888] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 01320F94
.text C:\WINDOWS\system32\svchost.exe[1888] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 01320FE5
.text C:\WINDOWS\system32\svchost.exe[1888] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 01320F48
.text C:\WINDOWS\system32\svchost.exe[1888] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 01320011
.text C:\WINDOWS\system32\svchost.exe[1888] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 01320FCA
.text C:\WINDOWS\system32\svchost.exe[1888] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 01320084
.text C:\WINDOWS\system32\svchost.exe[1888] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 0131001B
.text C:\WINDOWS\system32\svchost.exe[1888] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 01310047
.text C:\WINDOWS\system32\svchost.exe[1888] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 0131000A
.text C:\WINDOWS\system32\svchost.exe[1888] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 01310FD4
.text C:\WINDOWS\system32\svchost.exe[1888] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 01310F94
.text C:\WINDOWS\system32\svchost.exe[1888] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 01310FEF
.text C:\WINDOWS\system32\svchost.exe[1888] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 01310036
.text C:\WINDOWS\system32\svchost.exe[1888] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 01310FB9
.text C:\WINDOWS\system32\svchost.exe[1888] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 01360FAD
.text C:\WINDOWS\system32\svchost.exe[1888] msvcrt.dll!system 77C293C7 5 Bytes JMP 01360FBE
.text C:\WINDOWS\system32\svchost.exe[1888] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 0136001D
.text C:\WINDOWS\system32\svchost.exe[1888] msvcrt.dll!_open 77C2F566 5 Bytes JMP 01360FE3
.text C:\WINDOWS\system32\svchost.exe[1888] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 0136002E
.text C:\WINDOWS\system32\svchost.exe[1888] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 01360000
.text C:\WINDOWS\system32\svchost.exe[1888] WS2_32.dll!socket 71AB4211 5 Bytes JMP 01350FEF
.text C:\WINDOWS\system32\svchost.exe[1888] WININET.dll!InternetOpenA 3D95D698 5 Bytes JMP 0134000A
.text C:\WINDOWS\system32\svchost.exe[1888] WININET.dll!InternetOpenW 3D95DB11 5 Bytes JMP 0134001B
.text C:\WINDOWS\system32\svchost.exe[1888] WININET.dll!InternetOpenUrlA 3D95F3AC 5 Bytes JMP 01340FEF
.text C:\WINDOWS\system32\svchost.exe[1888] WININET.dll!InternetOpenUrlW 3D9A6D6F 5 Bytes JMP 01340040
.text C:\WINDOWS\System32\svchost.exe[2052] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00710000
.text C:\WINDOWS\System32\svchost.exe[2052] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00710FE5
.text C:\WINDOWS\System32\svchost.exe[2052] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0071001B
.text C:\WINDOWS\System32\svchost.exe[2052] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00700FEF
.text C:\WINDOWS\System32\svchost.exe[2052] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00700078
.text C:\WINDOWS\System32\svchost.exe[2052] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00700067
.text C:\WINDOWS\System32\svchost.exe[2052] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00700F8D
.text C:\WINDOWS\System32\svchost.exe[2052] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 0070004A
.text C:\WINDOWS\System32\svchost.exe[2052] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00700FA8
.text C:\WINDOWS\System32\svchost.exe[2052] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00700F43
.text C:\WINDOWS\System32\svchost.exe[2052] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00700F5E
.text C:\WINDOWS\System32\svchost.exe[2052] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00700F21
.text C:\WINDOWS\System32\svchost.exe[2052] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00700F32
.text C:\WINDOWS\System32\svchost.exe[2052] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 007000DF
.text C:\WINDOWS\System32\svchost.exe[2052] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 0070002F
.text C:\WINDOWS\System32\svchost.exe[2052] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00700FDE
.text C:\WINDOWS\System32\svchost.exe[2052] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00700089
.text C:\WINDOWS\System32\svchost.exe[2052] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00700014
.text C:\WINDOWS\System32\svchost.exe[2052] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00700FC3
.text C:\WINDOWS\System32\svchost.exe[2052] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 007000A6
.text C:\WINDOWS\System32\svchost.exe[2052] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 006F002F
.text C:\WINDOWS\System32\svchost.exe[2052] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 006F007D
.text C:\WINDOWS\System32\svchost.exe[2052] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 006F0FDE
.text C:\WINDOWS\System32\svchost.exe[2052] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 006F0FEF
.text C:\WINDOWS\System32\svchost.exe[2052] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 006F006C
.text C:\WINDOWS\System32\svchost.exe[2052] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 006F000A
.text C:\WINDOWS\System32\svchost.exe[2052] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 006F005B
.text C:\WINDOWS\System32\svchost.exe[2052] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 006F004A
.text C:\WINDOWS\System32\svchost.exe[2052] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 006E0FBC
.text C:\WINDOWS\System32\svchost.exe[2052] msvcrt.dll!system 77C293C7 5 Bytes JMP 006E0047
.text C:\WINDOWS\System32\svchost.exe[2052] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 006E002C
.text C:\WINDOWS\System32\svchost.exe[2052] msvcrt.dll!_open 77C2F566 5 Bytes JMP 006E0000
.text C:\WINDOWS\System32\svchost.exe[2052] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 006E0FD7
.text C:\WINDOWS\System32\svchost.exe[2052] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 006E0011
.text C:\WINDOWS\System32\svchost.exe[2052] WS2_32.dll!socket 71AB4211 5 Bytes JMP 006D000A
.text C:\WINDOWS\System32\svchost.exe[2408] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00F8000A
.text C:\WINDOWS\System32\svchost.exe[2408] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00F80040
.text C:\WINDOWS\System32\svchost.exe[2408] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00F8001B
.text C:\WINDOWS\System32\svchost.exe[2408] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00F70FEF
.text C:\WINDOWS\System32\svchost.exe[2408] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00F70060
.text C:\WINDOWS\System32\svchost.exe[2408] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00F70F6B
.text C:\WINDOWS\System32\svchost.exe[2408] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00F70F7C
.text C:\WINDOWS\System32\svchost.exe[2408] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00F70F8D
.text C:\WINDOWS\System32\svchost.exe[2408] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00F70F9E
.text C:\WINDOWS\System32\svchost.exe[2408] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00F70F18
.text C:\WINDOWS\System32\svchost.exe[2408] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00F70F35
.text C:\WINDOWS\System32\svchost.exe[2408] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00F700BB
.text C:\WINDOWS\System32\svchost.exe[2408] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00F70096
.text

C:\WINDOWS\System32\svchost.exe[2408] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00F70F07
.text C:\WINDOWS\System32\svchost.exe[2408] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00F7002F
.text C:\WINDOWS\System32\svchost.exe[2408] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00F70FD4
.text C:\WINDOWS\System32\svchost.exe[2408] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00F70F46
.text C:\WINDOWS\System32\svchost.exe[2408] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00F7000A
.text C:\WINDOWS\System32\svchost.exe[2408] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00F70FB9
.text C:\WINDOWS\System32\svchost.exe[2408] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00F7007B
.text C:\WINDOWS\System32\svchost.exe[2408] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00F60FC3
.text C:\WINDOWS\System32\svchost.exe[2408] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00F60043
.text C:\WINDOWS\System32\svchost.exe[2408] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00F60FD4
.text C:\WINDOWS\System32\svchost.exe[2408] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00F60FE5
.text C:\WINDOWS\System32\svchost.exe[2408] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00F60F86
.text C:\WINDOWS\System32\svchost.exe[2408] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00F60000
.text C:\WINDOWS\System32\svchost.exe[2408] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00F60F97
.text C:\WINDOWS\System32\svchost.exe[2408] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [16, 89]
.text C:\WINDOWS\System32\svchost.exe[2408] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00F60FA8
.text C:\WINDOWS\System32\svchost.exe[2408] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00F50053
.text C:\WINDOWS\System32\svchost.exe[2408] msvcrt.dll!system 77C293C7 5 Bytes JMP 00F50042
.text C:\WINDOWS\System32\svchost.exe[2408] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00F50FE3
.text C:\WINDOWS\System32\svchost.exe[2408] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00F50000
.text C:\WINDOWS\System32\svchost.exe[2408] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00F50FC8
.text C:\WINDOWS\System32\svchost.exe[2408] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00F50011
.text C:\WINDOWS\System32\svchost.exe[2408] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00F40FEF
.text C:\WINDOWS\System32\svchost.exe[2452] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00710FEF
.text C:\WINDOWS\System32\svchost.exe[2452] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00710FCA
.text C:\WINDOWS\System32\svchost.exe[2452] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00710000
.text C:\WINDOWS\System32\svchost.exe[2452] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00700FEF
.text C:\WINDOWS\System32\svchost.exe[2452] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 0070005B
.text C:\WINDOWS\System32\svchost.exe[2452] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 0070004A
.text C:\WINDOWS\System32\svchost.exe[2452] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00700F7C
.text C:\WINDOWS\System32\svchost.exe[2452] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00700F97
.text C:\WINDOWS\System32\svchost.exe[2452] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00700FA8
.text C:\WINDOWS\System32\svchost.exe[2452] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00700F30
.text C:\WINDOWS\System32\svchost.exe[2452] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00700F41
.text C:\WINDOWS\System32\svchost.exe[2452] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00700EDF
.text C:\WINDOWS\System32\svchost.exe[2452] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00700EFA
.text C:\WINDOWS\System32\svchost.exe[2452] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00700ECE
.text C:\WINDOWS\System32\svchost.exe[2452] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 0070002F
.text C:\WINDOWS\System32\svchost.exe[2452] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00700FDE
.text C:\WINDOWS\System32\svchost.exe[2452] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 0070006C
.text C:\WINDOWS\System32\svchost.exe[2452] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00700014
.text C:\WINDOWS\System32\svchost.exe[2452] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00700FCD
.text C:\WINDOWS\System32\svchost.exe[2452] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00700F15
.text C:\WINDOWS\System32\svchost.exe[2452] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 006F0FB9
.text C:\WINDOWS\System32\svchost.exe[2452] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 006F0039
.text C:\WINDOWS\System32\svchost.exe[2452] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 006F000A
.text C:\WINDOWS\System32\svchost.exe[2452] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 006F0FDE
.text C:\WINDOWS\System32\svchost.exe[2452] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 006F0F86
.text C:\WINDOWS\System32\svchost.exe[2452] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 006F0FEF
.text C:\WINDOWS\System32\svchost.exe[2452] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 006F0F97
.text C:\WINDOWS\System32\svchost.exe[2452] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [8F, 88]
.text C:\WINDOWS\System32\svchost.exe[2452] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 006F0FA8
.text C:\WINDOWS\System32\svchost.exe[2452] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 006E0036
.text C:\WINDOWS\System32\svchost.exe[2452] msvcrt.dll!system 77C293C7 5 Bytes JMP 006E0011
.text C:\WINDOWS\System32\svchost.exe[2452] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 006E0000
.text C:\WINDOWS\System32\svchost.exe[2452] msvcrt.dll!_open 77C2F566 5 Bytes JMP 006E0FE3
.text C:\WINDOWS\System32\svchost.exe[2452] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 006E0FA1
.text C:\WINDOWS\System32\svchost.exe[2452] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 006E0FD2
.text C:\WINDOWS\System32\svchost.exe[2452] WS2_32.dll!socket 71AB4211 5 Bytes JMP 006D0FE5
.text C:\WINDOWS\system32\svchost.exe[2976] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00CF0000
.text C:\WINDOWS\system32\svchost.exe[2976] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00CF0FDB
.text C:\WINDOWS\system32\svchost.exe[2976] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00CF0011
.text C:\WINDOWS\system32\svchost.exe[2976] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00CE0000
.text C:\WINDOWS\system32\svchost.exe[2976] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00CE0F57
.text C:\WINDOWS\system32\svchost.exe[2976] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00CE0042
.text C:\WINDOWS\system32\svchost.exe[2976] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00CE0F68
.text C:\WINDOWS\system32\svchost.exe[2976] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00CE0F83
.text C:\WINDOWS\system32\svchost.exe[2976] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00CE0FA5
.text C:\WINDOWS\system32\svchost.exe[2976] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00CE0F21
.text C:\WINDOWS\system32\svchost.exe[2976] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00CE0F32
.text C:\WINDOWS\system32\svchost.exe[2976] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00CE009F
.text C:\WINDOWS\system32\svchost.exe[2976] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00CE008E
.text C:\WINDOWS\system32\svchost.exe[2976] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00CE00BA
.text C:\WINDOWS\system32\svchost.exe[2976] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00CE0F94
.text C:\WINDOWS\system32\svchost.exe[2976] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00CE0FE5
.text C:\WINDOWS\system32\svchost.exe[2976] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00CE005D
.text C:\WINDOWS\system32\svchost.exe[2976] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00CE0FCA
.text C:\WINDOWS\system32\svchost.exe[2976] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00CE0011
.text C:\WINDOWS\system32\svchost.exe[2976] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00CE0F10
.text C:\WINDOWS\system32\svchost.exe[2976] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00CD002F
.text C:\WINDOWS\system32\svchost.exe[2976] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00CD0054
.text C:\WINDOWS\system32\svchost.exe[2976] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00CD0FD4
.text
C:\WINDOWS\system32\svchost.exe[2976] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00CD0000
.text C:\WINDOWS\system32\svchost.exe[2976] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00CD0F97
.text C:\WINDOWS\system32\svchost.exe[2976] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00CD0FE5
.text C:\WINDOWS\system32\svchost.exe[2976] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00CD0FA8
.text C:\WINDOWS\system32\svchost.exe[2976] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [ED, 88]
.text C:\WINDOWS\system32\svchost.exe[2976] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00CD0FC3
.text C:\WINDOWS\system32\svchost.exe[2976] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00CC0F9F
.text C:\WINDOWS\system32\svchost.exe[2976] msvcrt.dll!system 77C293C7 5 Bytes JMP 00CC0FB0
.text C:\WINDOWS\system32\svchost.exe[2976] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00CC0FC1
.text C:\WINDOWS\system32\svchost.exe[2976] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00CC0FEF
.text C:\WINDOWS\system32\svchost.exe[2976] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00CC0016
.text C:\WINDOWS\system32\svchost.exe[2976] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00CC0FDE
.text C:\WINDOWS\System32\ping.exe[4416] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00A5000A
.text C:\WINDOWS\System32\ping.exe[4416] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00A6000A
.text C:\WINDOWS\System32\ping.exe[4416] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00A4000C
.text C:\WINDOWS\System32\ping.exe[4416] USER32.dll!GetCursorPos 7E42974E 5 Bytes JMP 00BC000A
.text C:\WINDOWS\System32\ping.exe[4416] USER32.dll!WindowFromPoint 7E429766 5 Bytes JMP 00BD000A
.text C:\WINDOWS\System32\ping.exe[4416] USER32.dll!GetForegroundWindow 7E429823 5 Bytes JMP 00BE000A
.text C:\WINDOWS\System32\ping.exe[4416] ole32.dll!CoCreateInstance 774FF1AC 5 Bytes JMP 00BB000A

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisDeregisterProtocol] 8A9C5B40
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] 8A9C5C38
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] 8A9C5C38
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] 8A9C5B40
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] 8A9C5B40
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] 8A9C5C38
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] 8A9C5C38
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] 8A9C5B40
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] 8A9C5C38
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] 8A9C5B40
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] 8A9C5C38
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] 8A9C5C38
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] 8A9C5B40

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\mfevtps.exe[1020] @ C:\WINDOWS\system32\CRYPT32.dll [ADVAPI32.dll!RegQueryValueExW] [00407740] C:\WINDOWS\system32\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.)
IAT C:\WINDOWS\system32\mfevtps.exe[1020] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [004077A0] C:\WINDOWS\system32\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs ssfs0bbc.sys (Spy Sweeper FileSystem Filter Driver/Webroot Software, Inc. (www.webroot.com))
AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
AttachedDevice \FileSystem\Ntfs \Ntfs InCDRec.sys (Nero InCD File System Recognizer/Nero AG)

Device \Driver\Tcpip \Device\Ip 89C9E6E8

AttachedDevice \Driver\Tcpip \Device\Ip mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

Device \Driver\Tcpip \Device\Tcp 89C9E6E8

AttachedDevice \Driver\Tcpip \Device\Tcp mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

Device \Driver\Tcpip \Device\Udp 89C9E6E8

AttachedDevice \Driver\Tcpip \Device\Udp mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

Device \Driver\Tcpip \Device\RawIp 89C9E6E8

AttachedDevice \Driver\Tcpip \Device\RawIp mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

Device \Driver\Tcpip \Device\IPMULTICAST 89C9E6E8

---- Modules - GMER 1.0.15 ----

Module (noname) (*** hidden *** ) B4787000-B47A6000 (126976 bytes)

---- Registry - GMER 1.0.15 ----

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{E3D7829F-E20F-19F4-6BE0-1497091A7076}

---- EOF - GMER 1.0.15 ----

aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-11-09 17:10:52
-----------------------------
17:10:52.906 OS Version: Windows 5.1.2600 Service Pack 3
17:10:52.906 Number of processors: 4 586 0x202
17:10:52.906 ComputerName: ASUS-DESKTOP UserName:
17:10:53.734 Initialize success
17:14:52.062 AVAST engine defs: 11110901
17:15:08.562 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-6
17:15:08.562 Disk 0 Vendor: ST3500410AS CC34 Size: 476940MB BusType: 3
17:15:10.578 Disk 0 MBR read successfully
17:15:10.578 Disk 0 MBR scan
17:15:10.609 Disk 0 Windows XP default MBR code
17:15:10.609 Disk 0 scanning sectors +976752000
17:15:10.671 Disk 0 scanning C:\WINDOWS\system32\drivers
17:15:13.968 File: C:\WINDOWS\system32\drivers\afd.sys **INFECTED** Win32:Aluroot [Rtk]
17:15:30.140 Service scanning
17:15:31.140 Modules scanning
17:15:34.187 Module: C:\WINDOWS\System32\drivers\afd.sys **SUSPICIOUS**
17:15:35.593 Disk 0 trace - called modules:
17:15:35.640 ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x89063f10]<<
17:15:35.640 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8aacfab8]
17:15:35.640 3 CLASSPNP.SYS[b8108fd7] -> nt!IofCallDriver -> [0x8a202030]
17:15:35.640 \Driver\00000515[0x890d1c98] -> IRP_MJ_CREATE -> 0x89063f10
17:15:38.671 AVAST engine scan C:\WINDOWS
17:15:50.203 AVAST engine scan C:\WINDOWS\system32
17:19:41.296 AVAST engine scan C:\WINDOWS\system32\drivers
17:19:45.421 File: C:\WINDOWS\system32\drivers\afd.sys **INFECTED** Win32:Aluroot [Rtk]
17:20:37.453 AVAST engine scan C:\Documents and Settings\Ken Henrikson
17:21:25.843 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Ken Henrikson\Desktop\MBR.dat"
17:21:25.843 The log file has been saved successfully to "C:\Documents and Settings\Ken Henrikson\Desktop\aswMBR.log"


aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-11-09 17:10:52
-----------------------------
17:10:52.906 OS Version: Windows 5.1.2600 Service Pack 3
17:10:52.906 Number of processors: 4 586 0x202
17:10:52.906 ComputerName: ASUS-DESKTOP UserName:
17:10:53.734 Initialize success
17:14:52.062 AVAST engine defs: 11110901
17:15:08.562 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-6
17:15:08.562 Disk 0 Vendor: ST3500410AS CC34 Size: 476940MB BusType: 3
17:15:10.578 Disk 0 MBR read successfully
17:15:10.578 Disk 0 MBR scan
17:15:10.609 Disk 0 Windows XP default MBR code
17:15:10.609 Disk 0 scanning sectors +976752000
17:15:10.671 Disk 0 scanning C:\WINDOWS\system32\drivers
17:15:13.968 File: C:\WINDOWS\system32\drivers\afd.sys **INFECTED** Win32:Aluroot [Rtk]
17:15:30.140 Service scanning
17:15:31.140 Modules scanning
17:15:34.187 Module: C:\WINDOWS\System32\drivers\afd.sys **SUSPICIOUS**
17:15:35.593 Disk 0 trace - called modules:
17:15:35.640 ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x89063f10]<<
17:15:35.640 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8aacfab8]
17:15:35.640 3 CLASSPNP.SYS[b8108fd7] -> nt!IofCallDriver -> [0x8a202030]
17:15:35.640 \Driver\00000515[0x890d1c98] -> IRP_MJ_CREATE -> 0x89063f10
17:15:38.671 AVAST engine scan C:\WINDOWS
17:15:50.203 AVAST engine scan C:\WINDOWS\system32
17:19:41.296 AVAST engine scan C:\WINDOWS\system32\drivers
17:19:45.421 File: C:\WINDOWS\system32\drivers\afd.sys **INFECTED** Win32:Aluroot [Rtk]
17:20:37.453 AVAST engine scan C:\Documents and Settings\Ken Henrikson
17:21:25.843 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Ken Henrikson\Desktop\MBR.dat"
17:21:25.843 The log file has been saved successfully to "C:\Documents and Settings\Ken Henrikson\Desktop\aswMBR.log"
19:15:04.281 AVAST engine scan C:\Documents and Settings\All Users
19:22:59.796 Scan finished successfully
20:12:51.296 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Ken Henrikson\Desktop\MBR.dat"
20:12:51.343 The log file has been saved successfully to "C:\Documents and Settings\Ken Henrikson\Desktop\aswMBR.log"

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_24
Run by Ken Henrikson at 20:14:33 on 2011-11-09
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2815.1556 [GMT -5:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Firewall *Enabled*
.
============== Running Processes ===============
.
C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\WINDOWS\system32\svchost.exe -k HPService
C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
C:\WINDOWS\system32\mfevtps.exe
C:\Program Files\Nero\Nero8\InCD\NBHRegInCDSrv.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\MSN Toolbar\Platform\4.0.0357.1\mswinext.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\ping.exe
C:\WINDOWS\system32\wuauclt.exe
.
============== Pseudo HJT Report ===============
.
uWindow Title = Windows Internet Explorer provided by MSN & Bing
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.forumswatcher.com/search.htm
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20110512003700.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll
BHO: MSN Toolbar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn toolbar\platform\4.0.0357.1\npwinext.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: MSN Toolbar: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files\msn toolbar\platform\4.0.0357.1\npwinext.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [nwiz] "c:\program files\nvidia corporation\nview\nwiz.exe" /installquiet
mRun: [NvMediaCenter] "RUNDLL32.EXE" c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] "RUNDLL32.EXE" c:\windows\system32\NvCpl.dll,NvStartup
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
dRun: [WinCalendarV3] "c:\program files\sapro systems wincalendarv3\WinCalendarV3_SysTray.exe" /q /c
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
LSP: mswsock.dll
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {33704B0F-9EB7-434B-B752-EA6CFFB87423} - hxxp://brityacht.viewnetcam.com:5050/JpegInst.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265501466609
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1265566893765
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxps://www.battlefieldheroes.com/static/updater/BFHUpdater_5.0.110.0.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 167.206.254.2 167.206.254.1 192.168.1.1
TCP: Interfaces\{594F6792-37CA-468D-8E44-EEC2AA4BFBDA} : DhcpNameServer = 167.206.254.2 167.206.254.1 192.168.1.1
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\ken henrikson\application data\mozilla\firefox\profiles\ovu13fza.default\
FF - prefs.js: browser.search.selectedEngine - Bing
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/?pc=Z128&install_date=20110903
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z128&form=ZGAADF&install_date=20110903&q=
FF - plugin: c:\documents and settings\ken henrikson\application data\mozilla\firefox\profiles\ovu13fza.default\extensions\[email protected]\plugins\npBFHUpdater.dll
FF - plugin: c:\documents and settings\ken henrikson\local settings\application data\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mcafee\supportability\mvt\NPMVTPlugin.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\msn toolbar\platform\4.0.0357.1\npwinext.dll
FF - plugin: c:\program files\nos\bin\np_gp.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2011-1-12 387480]
R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2011-3-22 29832]
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [2011-1-12 84200]
R2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2011-1-12 271480]
R2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2011-1-12 271480]
R2 McProxy;McAfee Proxy Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2011-1-12 271480]
R2 McShield;McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2011-1-12 171168]
R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2011-1-12 188136]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2011-1-12 141792]
R2 NeroRegInCDSrv;Nero Registry InCD Service;c:\program files\nero\nero8\incd\NBHRegInCDSrv.exe [2008-2-28 53032]
R2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\webrootsecurity\SpySweeper.exe [2011-3-22 4048256]
R2 WRConsumerService;Webroot Client Service;c:\program files\webroot\webrootsecurity\WRConsumerService.exe [2011-7-30 1201656]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2011-1-12 56064]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2011-1-12 153280]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2011-1-12 52320]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2011-1-12 314088]
R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [2011-1-12 88736]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2010-2-6 993280]
S2 0210931317728736mcinstcleanup;McAfee Application Installer Cleanup (0210931317728736);c:\windows\temp\021093~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service --> c:\windows\temp\021093~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-5-2 136176]
S2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files\roxio\digital home 10\RoxioUpnpService10.exe [2008-6-23 362992]
S2 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxLiveShare10.exe [2008-6-23 309744]
S2 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxWatch10.exe [2008-6-23 166384]
S2 SessionLauncher;SessionLauncher;c:\docume~1\kenhen~1\locals~1\temp\dx9\sessionlauncher.exe --> c:\docume~1\kenhen~1\locals~1\temp\dx9\SessionLauncher.exe [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-5-2 136176]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [2011-1-12 88736]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2011-1-12 84488]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [2011-1-22 39456]
S3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files\roxio\digital home 10\RoxioUPnPRenderer10.exe [2008-6-23 313840]
S3 RoxMediaDB10;RoxMediaDB10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxMediaDB10.exe [2008-6-23 1120752]
S3 samhid;samhid;c:\windows\system32\drivers\samhid.sys --> c:\windows\system32\drivers\samhid.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2011-11-08 17:49:41 -------- d-----w- c:\documents and settings\ken henrikson\application data\XnnFF4amH6
2011-11-08 17:49:41 -------- d-----w- c:\documents and settings\ken henrikson\application data\hIIBBtzP0ycAiv3
2011-11-08 17:49:37 -------- d-----w- c:\documents and settings\ken henrikson\application data\T666dEEK8fR9
2011-11-08 17:49:36 -------- d-----w- c:\documents and settings\ken henrikson\application data\KXXwwjUCelIBz
2011-10-27 02:01:32 -------- d-----w- c:\documents and settings\ken henrikson\application data\Visan
2011-10-27 02:01:32 -------- d-----w- c:\documents and settings\all users\application data\Visan
2011-10-26 00:56:03 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
==================== Find3M ====================
.
2011-09-26 15:41:20 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 15:41:20 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-26 15:41:14 20480 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-09 09:12:13 599040 ----a-w- c:\windows\system32\crypt32.dll
2011-09-06 13:20:51 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-09-06 01:13:14 139080 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-09-06 01:12:55 270240 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-09-06 01:12:55 270240 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-09-06 00:52:55 270240 ----a-w- c:\windows\system32\PnkBstrB.ex0
2011-09-03 19:43:04 13696 ----a-w- c:\windows\system32\drivers\wpsnuio.sys
2011-08-31 22:00:50 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-22 23:48:55 916480 ----a-w- c:\windows\system32\wininet.dll
2011-08-22 23:48:54 43520 ------w- c:\windows\system32\licmgr10.dll
2011-08-22 23:48:54 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-08-22 11:56:39 385024 ------w- c:\windows\system32\html.iec
2011-08-17 13:49:54 138496 ----a-w- c:\windows\system32\drivers\afd.sys
.
============= FINISH: 20:21:55.71 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\Harddisk0\DP(1)0x7e00-0x74701a8200+1
Install Date: 2/6/2010 5:21:08 PM
System Uptime: 11/9/2011 4:00:57 PM (4 hours ago)
.
Motherboard: ASUSTeK Computer INC. | | M4N78 PRO
Processor: AMD Phenom(tm) 9600 Quad-Core Processor | AM2/AM3 | 2300/200mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 466 GiB total, 149.455 GiB free.
D: is CDROM (CDFS)
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Description: NVIDIA High Definition Audio
Device ID: HDAUDIO\FUNC_01&VEN_10DE&DEV_0002&SUBSYS_10DE0101&REV_1000\4&26CEEC39&0&0301
Manufacturer: NVIDIA
Name: NVIDIA High Definition Audio
PNP Device ID: HDAUDIO\FUNC_01&VEN_10DE&DEV_0002&SUBSYS_10DE0101&REV_1000\4&26CEEC39&0&0301
Service: NVHDA
.
Class GUID: {4D36E971-E325-11CE-BFC1-08002BE10318}
Description: Photosmart D110 series
Device ID: ROOT\MULTIFUNCTION\0000
Manufacturer: HP
Name: Photosmart D110 series
PNP Device ID: ROOT\MULTIFUNCTION\0000
Service:
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
.
32 Bit HP CIO Components Installer
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.0.1)
Amazon MP3 Downloader 1.0.12
Battlefield Heroes
BattleForge™
BitTornado 0.3.18
BufferChm
CCleaner
CDisplay 1.8
Cisco Connect
Compatibility Pack for the 2007 Office system
D110
Day of Defeat: Source
Destinations
DeviceDiscovery
DirectXInstallService
DivX Converter
DivX Plus DirectShow Filters
DivX Setup
DivX Version Checker
ESET Online Scanner v3
EVEREST Home Edition v2.20
EVEREST Ultimate Edition v5.30
Fraps (remove only)
Gangsters
Garmin MapSource
Garmin USB Drivers
Google Earth Plug-in
Google Toolbar for Internet Explorer
Google Update Helper
GPBaseService2
Half-Life
Half-Life 2
Half-Life 2: Deathmatch
Half-Life 2: Episode One
Half-Life 2: Episode Two
Half-Life 2: Lost Coast
Half-Life Deathmatch: Source
Half-Life: Blue Shift
Half-Life: Opposing Force
High Definition Audio Driver Package - KB888111
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP Customer Participation Program 14.0
HP Imaging Device Functions 14.0
HP Photo Creations
HP Photosmart D110 All-In-One Driver Software 14.0 Rel. 7
HP Smart Web Printing 4.60
HP Solution Center 14.0
HP Update
HPAppStudio
HPProductAssistant
HPSSupply
Image Plugin
ImageMixer 3 SE Ver.4.5 Transfer Utility
InCD Reader
Java Auto Updater
Java(TM) 6 Update 24
Junk Mail filter update
Left 4 Dead
Left 4 Dead 2
Left 4 Dead 2 Add-on Support
LG Burning Tools
LG CyberLink LabelPrint
LG CyberLink PowerDVD 7.0
LG CyberLink PowerProducer
LG Power Tools
Malwarebytes' Anti-Malware version 1.51.2.1300
MapSource
MapSource - BlueChart Americas v6.5
MapSource - Trip & Waypoint Manager v2
MarketResearch
McAfee Security Scan Plus
McAfee SecurityCenter
McAfee Virtual Technician
Media Player Codec Pack 3.9.6
MediaFACE II
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2572067)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Default Manager
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Office PowerPoint Viewer 2003
Microsoft Office XP Media Content
Microsoft Office XP Small Business
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Molly Hatchet
Mozilla Firefox 6.0.2 (x86 en-US)
Mp3tag v2.48
MSN
MSN Toolbar
MSN Toolbar Platform
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Music Transfer Utility Ver.1.5
neroxml
NetWaiting
Network
NVIDIA Display Control Panel
NVIDIA Drivers
NVIDIA nView Desktop Manager
NVIDIA PhysX v8.10.13
OGA Notifier 2.0.0048.0
PC Probe II
PDFCreator 0.8.0
PhoTags Express
Platform
PS_AIO_07_D110_SW_Min
PunkBuster Services
QuickTransfer
Registry Mechanic 5.0
RingCentral SmartFax 2002
Roblox for Ken Henrikson
Roxio Activation Module
Roxio BackOnTrack
Roxio Central Audio
Roxio Central Copy
Roxio Central Core
Roxio Central Data
Roxio Central Tools
Roxio CinePlayer
Roxio CinePlayer Decoder Pack
Roxio Disc Gallery
Roxio Easy Media Creator
Roxio Easy Media Creator 10 Suite
Roxio File Backup
Roxio MediaShare
Roxio Update Manager
Scan
SecurDisc Viewer
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Segoe UI
Shop for HP Supplies
Sid Meier's Pirates!
SimCity 3000
SmartSound Quicktracks Plugin
SmartWebPrinting
SolutionCenter
Spy Sweeper Core
Spy Sweeper for MSN
Status
Steam
Steel Panthers
Stubbs the Zombie in Rebel Without a Pulse
Toolbox
TrayApp
TurboCAD Symbols
TurboCAD v9
Uninstall Dual Mode Camera
Unity Web Player
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Windows (KB971513)
Update for Windows Internet Explorer 8 (KB2447568)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB978207)
VC80CRTRedist - 8.0.50727.6195
VCRedistSetup
VIA Platform Device Manager
WebFldrs XP
WebReg
WinCalendarV3
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sync
Windows Live Upload Tool
Windows Media Format 11 runtime
Windows Media Player 11
Windows NT Messaging
Windows PowerShell(TM) 1.0
Windows XP Service Pack 3
WinRAR archiver
WinX DVD Ripper Platinum 6.3.5
WinX HD Video Converter Deluxe 3.10.3
WinZip 11.1
WXTide32
Xvid 1.2.2 final uninstall
Zombie Panic! Source
Zoom V.92 PCI Voice Faxmodem
.
==== Event Viewer Messages From Past Week ========
.
11/8/2011 3:48:14 PM, error: Service Control Manager [7023] - The Network Location Awareness (NLA) service terminated with the following error: The specified procedure could not be found.
11/8/2011 1:57:30 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service SeaPort with arguments "-Service" in order to run the server: {D6381B4A-D254-46EB-9018-A62E0F4BA6BA}
11/8/2011 1:44:46 PM, error: Service Control Manager [7000] - The SessionLauncher service failed to start due to the following error: The system cannot find the path specified.
11/8/2011 1:42:17 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
11/8/2011 1:29:48 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service McNaiAnn with arguments "" in order to run the server: {DC7EF8E1-824F-4110-AB43-1604DA9B4F40}
11/8/2011 1:29:10 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AmdPPM AsIO Fips IPSec mfehidk mfetdi2k MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
11/8/2011 1:29:10 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
11/8/2011 1:29:10 PM, error: Service Control Manager [7001] - The McShield service depends on the McAfee Validation Trust Protection Service service which failed to start because of the following error: The dependency service or group failed to start.
11/8/2011 1:29:10 PM, error: Service Control Manager [7001] - The McAfee Validation Trust Protection Service service depends on the McAfee Inc. mfehidk service which failed to start because of the following error: A device attached to the system is not functioning.
11/8/2011 1:29:10 PM, error: Service Control Manager [7001] - The McAfee Proxy Service service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.
11/8/2011 1:29:10 PM, error: Service Control Manager [7001] - The McAfee Personal Firewall Service service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.
11/8/2011 1:29:10 PM, error: Service Control Manager [7001] - The McAfee Network Agent service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.
11/8/2011 1:29:10 PM, error: Service Control Manager [7001] - The McAfee Firewall Core Service service depends on the McAfee Validation Trust Protection Service service which failed to start because of the following error: The dependency service or group failed to start.
11/8/2011 1:29:10 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/8/2011 1:29:10 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
11/8/2011 1:29:10 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
11/8/2011 1:28:32 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
11/8/2011 1:23:38 PM, error: Service Control Manager [7031] - The McAfee VirusScan Announcer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
11/8/2011 1:23:38 PM, error: Service Control Manager [7031] - The McAfee Services service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
11/8/2011 1:23:38 PM, error: Service Control Manager [7031] - The McAfee Proxy Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
11/8/2011 1:23:38 PM, error: Service Control Manager [7031] - The McAfee Personal Firewall Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
11/8/2011 1:23:38 PM, error: Service Control Manager [7031] - The McAfee Network Agent service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
11/8/2011 1:20:09 PM, error: Service Control Manager [7034] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s).
.
==== End Of File ===========================

PS.

The computer makes sounds ( system types) at random times, when I am not doing any thing. It will make the chime sound, like when some programs close, or the exclaimation sound like when an error occurs, etc.

Thank you again for all of your help.
Ken

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running tools or applying updates other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

=============================================================

This is your third visit in this forum this year alone.
You'll definitely have to pay more attention to secure computing.

Download TDSSKiller and save it to your desktop.

• Doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
• If an infected file is detected, the default action will be Cure, click on Continue.
• If a suspicious file is detected, the default action will be Skip, click on Continue.
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.

Yes I know I have to do better. This one is my fault, I can't blame the kids.

Funny thing, after running this and rebooting, I have no sound now, at all.

01:12:37.0203 3824 TDSS rootkit removing tool 2.6.16.0 Nov 7 2011 16:26:51
01:12:39.0468 3824 ============================================================
01:12:39.0468 3824 Current date / time: 2011/11/10 01:12:39.0468
01:12:39.0468 3824 SystemInfo:
01:12:39.0468 3824
01:12:39.0468 3824 OS Version: 5.1.2600 ServicePack: 3.0
01:12:39.0468 3824 Product type: Workstation
01:12:39.0468 3824 ComputerName: ASUS-DESKTOP
01:12:39.0468 3824 UserName: Ken Henrikson
01:12:39.0468 3824 Windows directory: C:\WINDOWS
01:12:39.0468 3824 System windows directory: C:\WINDOWS
01:12:39.0484 3824 Processor architecture: Intel x86
01:12:39.0484 3824 Number of processors: 4
01:12:39.0484 3824 Page size: 0x1000
01:12:39.0484 3824 Boot type: Normal boot
01:12:39.0484 3824 ============================================================
01:12:51.0671 3824 Initialize success
01:12:55.0843 2780 ============================================================
01:12:55.0843 2780 Scan started
01:12:55.0843 2780 Mode: Manual;
01:12:55.0843 2780 ============================================================
01:12:58.0718 2780 Abiosdsk - ok
01:12:58.0718 2780 abp480n5 - ok
01:12:58.0734 2780 ACPI - ok
01:12:58.0750 2780 ACPIEC - ok
01:12:58.0750 2780 adpu160m - ok
01:12:58.0765 2780 aec - ok
01:12:58.0765 2780 AFD - ok
01:12:58.0765 2780 Aha154x - ok
01:12:58.0781 2780 aic78u2 - ok
01:12:58.0781 2780 aic78xx - ok
01:12:58.0796 2780 AliIde - ok
01:12:58.0796 2780 AmdPPM - ok
01:12:58.0812 2780 amsint - ok
01:12:58.0859 2780 asc - ok
01:12:58.0859 2780 asc3350p - ok
01:12:58.0859 2780 asc3550 - ok
01:12:58.0875 2780 AsIO - ok
01:12:58.0890 2780 AsyncMac - ok
01:12:58.0906 2780 atapi - ok
01:12:58.0921 2780 Atdisk - ok
01:12:58.0921 2780 Atmarpc - ok
01:12:58.0937 2780 audstub - ok
01:12:58.0953 2780 Beep - ok
01:12:58.0984 2780 cbidf2k - ok
01:12:58.0984 2780 CCDECODE - ok
01:12:58.0984 2780 cd20xrnt - ok
01:12:59.0000 2780 Cdaudio - ok
01:12:59.0000 2780 Cdfs - ok
01:12:59.0015 2780 Cdr4_xp - ok
01:12:59.0015 2780 Cdralw2k - ok
01:12:59.0031 2780 Cdrom - ok
01:12:59.0031 2780 cfwids - ok
01:12:59.0031 2780 Changer - ok
01:12:59.0109 2780 CmdIde - ok
01:12:59.0125 2780 Cpqarray - ok
01:12:59.0140 2780 dac2w2k - ok
01:12:59.0140 2780 dac960nt - ok
01:12:59.0187 2780 Disk - ok
01:12:59.0187 2780 dmboot - ok
01:12:59.0203 2780 dmio - ok
01:12:59.0203 2780 dmload - ok
01:12:59.0218 2780 DMusic - ok
01:12:59.0250 2780 dpti2o - ok
01:12:59.0265 2780 drmkaud - ok
01:12:59.0281 2780 Fastfat - ok
01:12:59.0281 2780 Fdc - ok
01:12:59.0296 2780 Fips - ok
01:12:59.0296 2780 Flpydisk - ok
01:12:59.0296 2780 FltMgr - ok
01:12:59.0312 2780 Fs_Rec - ok
01:12:59.0312 2780 Ftdisk - ok
01:12:59.0312 2780 Gpc - ok
01:12:59.0359 2780 grmnusb - ok
01:12:59.0375 2780 HDAudBus - ok
01:12:59.0390 2780 HidUsb - ok
01:12:59.0406 2780 hpn - ok
01:12:59.0421 2780 HPZid412 - ok
01:12:59.0421 2780 HPZipr12 - ok
01:12:59.0453 2780 HPZius12 - ok
01:12:59.0453 2780 HTTP - ok
01:12:59.0468 2780 i2omgmt - ok
01:12:59.0468 2780 i2omp - ok
01:12:59.0468 2780 i8042prt - ok
01:12:59.0484 2780 Imapi - ok
01:12:59.0500 2780 InCDfs - ok
01:12:59.0515 2780 InCDPass - ok
01:12:59.0515 2780 InCDRec - ok
01:12:59.0531 2780 incdrm - ok
01:12:59.0562 2780 ini910u - ok
01:12:59.0578 2780 IntelIde - ok
01:12:59.0578 2780 Ip6Fw - ok
01:12:59.0609 2780 IpFilterDriver - ok
01:12:59.0609 2780 IpInIp - ok
01:12:59.0625 2780 IpNat - ok
01:12:59.0625 2780 IPSec - ok
01:12:59.0625 2780 IRENUM - ok
01:12:59.0640 2780 isapnp - ok
01:12:59.0640 2780 JL2005C - ok
01:12:59.0640 2780 Kbdclass - ok
01:12:59.0656 2780 kbdhid - ok
01:12:59.0656 2780 kmixer - ok
01:12:59.0656 2780 KSecDD - ok
01:12:59.0671 2780 lbrtfdc - ok
01:12:59.0703 2780 LwUsbHid - ok
01:12:59.0718 2780 mdmxsdk - ok
01:12:59.0734 2780 mfeapfk - ok
01:12:59.0750 2780 mfeavfk - ok
01:12:59.0750 2780 mfeavfk01 - ok
01:12:59.0750 2780 mfebopk - ok
01:12:59.0765 2780 mfefirek - ok
01:12:59.0765 2780 mfehidk - ok
01:12:59.0765 2780 mfendisk - ok
01:12:59.0765 2780 mfendiskmp - ok
01:12:59.0781 2780 mferkdet - ok
01:12:59.0781 2780 mfetdi2k - ok
01:12:59.0781 2780 mnmdd - ok
01:12:59.0796 2780 Modem - ok
01:12:59.0796 2780 MODEMCSA - ok
01:12:59.0812 2780 monfilt - ok
01:12:59.0812 2780 motmodem - ok
01:12:59.0812 2780 Mouclass - ok
01:12:59.0812 2780 mouhid - ok
01:12:59.0828 2780 MountMgr - ok
01:12:59.0828 2780 mraid35x - ok
01:12:59.0828 2780 MRxDAV - ok
01:12:59.0843 2780 MRxSmb - ok
01:12:59.0859 2780 Msfs - ok
01:12:59.0859 2780 MSKSSRV - ok
01:12:59.0875 2780 MSPCLOCK - ok
01:12:59.0875 2780 MSPQM - ok
01:12:59.0875 2780 mssmbios - ok
01:12:59.0890 2780 MSTEE - ok
01:12:59.0890 2780 MTsensor - ok
01:12:59.0890 2780 Mup - ok
01:12:59.0906 2780 NABTSFEC - ok
01:12:59.0906 2780 NDIS - ok
01:12:59.0921 2780 NdisIP - ok
01:12:59.0921 2780 NdisTapi - ok
01:12:59.0921 2780 Ndisuio - ok
01:12:59.0937 2780 NdisWan - ok
01:12:59.0937 2780 NDProxy - ok
01:12:59.0953 2780 NetBIOS - ok
01:12:59.0953 2780 NetBT - ok
01:12:59.0968 2780 Npfs - ok
01:12:59.0968 2780 Ntfs - ok
01:12:59.0984 2780 Null - ok
01:12:59.0984 2780 nv - ok
01:12:59.0984 2780 NVENETFD - ok
01:13:00.0000 2780 NVHDA - ok
01:13:00.0000 2780 nvnetbus - ok
01:13:00.0000 2780 nvsmu - ok
01:13:00.0015 2780 NwlnkFlt - ok
01:13:00.0015 2780 NwlnkFwd - ok
01:13:00.0015 2780 Parport - ok
01:13:00.0015 2780 PartMgr - ok
01:13:00.0031 2780 ParVdm - ok
01:13:00.0031 2780 PCI - ok
01:13:00.0031 2780 PCIDump - ok
01:13:00.0031 2780 PCIIde - ok
01:13:00.0046 2780 Pcmcia - ok
01:13:00.0046 2780 PDCOMP - ok
01:13:00.0046 2780 PDFRAME - ok
01:13:00.0062 2780 PDRELI - ok
01:13:00.0062 2780 PDRFRAME - ok
01:13:00.0062 2780 perc2 - ok
01:13:00.0062 2780 perc2hib - ok
01:13:00.0078 2780 PptpMiniport - ok
01:13:00.0093 2780 Processor - ok
01:13:00.0093 2780 PSched - ok
01:13:00.0093 2780 Ptilink - ok
01:13:00.0093 2780 PxHelp20 - ok
01:13:00.0109 2780 ql1080 - ok
01:13:00.0109 2780 Ql10wnt - ok
01:13:00.0109 2780 ql12160 - ok
01:13:00.0125 2780 ql1240 - ok
01:13:00.0125 2780 ql1280 - ok
01:13:00.0125 2780 RasAcd - ok
01:13:00.0140 2780 Rasl2tp - ok
01:13:00.0140 2780 RasPppoe - ok
01:13:00.0140 2780 Raspti - ok
01:13:00.0140 2780 Rdbss - ok
01:13:00.0156 2780 RDPCDD - ok
01:13:00.0156 2780 rdpdr - ok
01:13:00.0156 2780 RDPWD - ok
01:13:00.0171 2780 redbook - ok
01:13:00.0296 2780 RxFilter - ok
01:13:00.0296 2780 samhid - ok
01:13:00.0312 2780 Secdrv - ok
01:13:00.0328 2780 serenum - ok
01:13:00.0328 2780 Serial - ok
01:13:00.0359 2780 Sfloppy - ok
01:13:00.0359 2780 Simbad - ok
01:13:00.0359 2780 SLIP - ok
01:13:00.0390 2780 Sparrow - ok
01:13:00.0390 2780 splitter - ok
01:13:00.0390 2780 sr - ok
01:13:00.0406 2780 Srv - ok
01:13:00.0406 2780 ssfs0bbc - ok
01:13:00.0406 2780 sshrmd - ok
01:13:00.0421 2780 ssidrv - ok
01:13:00.0421 2780 StillCam - ok
01:13:00.0421 2780 streamip - ok
01:13:00.0437 2780 swenum - ok
01:13:00.0437 2780 swmidi - ok
01:13:00.0453 2780 symc810 - ok
01:13:00.0453 2780 symc8xx - ok
01:13:00.0453 2780 sym_hi - ok
01:13:00.0453 2780 sym_u3 - ok
01:13:00.0468 2780 sysaudio - ok
01:13:00.0468 2780 Tcpip - ok
01:13:00.0468 2780 TDPIPE - ok
01:13:00.0468 2780 TDTCP - ok
01:13:00.0484 2780 TermDD - ok
01:13:00.0484 2780 TosIde - ok
01:13:00.0500 2780 Udfs - ok
01:13:00.0515 2780 ultra - ok
01:13:00.0515 2780 Update - ok
01:13:00.0531 2780 usbccgp - ok
01:13:00.0531 2780 usbehci - ok
01:13:00.0531 2780 usbhub - ok
01:13:00.0531 2780 usbohci - ok
01:13:00.0546 2780 usbprint - ok
01:13:00.0546 2780 usbscan - ok
01:13:00.0546 2780 USBSTOR - ok
01:13:00.0546 2780 VgaSave - ok
01:13:00.0562 2780 VIAHdAudAddService - ok
01:13:00.0562 2780 ViaIde - ok
01:13:00.0562 2780 VolSnap - ok
01:13:00.0578 2780 Wanarp - ok
01:13:00.0578 2780 Wdf01000 - ok
01:13:00.0578 2780 WDICA - ok
01:13:00.0578 2780 wdmaud - ok
01:13:00.0593 2780 Winachcf - ok
01:13:00.0609 2780 WmBEnum - ok
01:13:00.0609 2780 WmFilter - ok
01:13:00.0625 2780 WmiAcpi - ok
01:13:00.0718 2780 WmVirHid - ok
01:13:00.0718 2780 WmXlCore - ok
01:13:00.0734 2780 WpdUsb - ok
01:13:00.0734 2780 WS2IFSL - ok
01:13:00.0734 2780 WSTCODEC - ok
01:13:00.0750 2780 WudfPf - ok
01:13:00.0750 2780 WudfRd - ok
01:13:00.0796 2780 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
01:13:00.0937 2780 \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - infected
01:13:00.0937 2780 \Device\Harddisk0\DR0 - detected Rootkit.Boot.SST.b (0)
01:13:00.0984 2780 Boot (0x1200) (7591b7fbb6932c71c0f99d46d2235cdd) \Device\Harddisk0\DR0\Partition0
01:13:01.0046 2780 \Device\Harddisk0\DR0\Partition0 - ok
01:13:01.0046 2780 ============================================================
01:13:01.0046 2780 Scan finished
01:13:01.0046 2780 ============================================================
01:13:01.0046 2768 Detected object count: 1
01:13:01.0046 2768 Actual detected object count: 1
01:13:18.0609 2768 \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - will be cured on reboot
01:13:18.0609 2768 \Device\Harddisk0\DR0 - ok
01:13:18.0609 2768 \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - User select action: Cure
01:13:28.0875 3656 Deinitialize success

Please download Rootkit Unhooker from one of the following links and save it to your desktop.

• Link 1 (.exe file)
  Link 2 (zipped file)
  Link 3 (.rar file)

In order to use this tool if you downloaded from either of the second two links, you will need to extract the RKUnhookerLE.exe file using a program capable of extracing ZIP and RAR compressed files. If you don't have an extraction program, you can download, install and use the free 7-zip utility.

• Double-click on RKUnhookerLE.exe to start the program.
  Vista/Windows 7 users right-click and select Run As Administrator.
• Click the Report tab, then click Scan.
• Check Drivers, Stealth, and uncheck the rest.
• Click OK.
• Wait until it's finished and then go to File > Save Report.
• Save the report to your Desktop.
• Copy and paste the contents of the report into your next reply.

-- Note: You may get this warning...just ignore it, click OK and continue: "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?".

==========================================================

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   
   • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
   • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
   
   NOTE1. If Combofix asks you to install Recovery Console, please allow it.
   NOTE 2. If Combofix asks you to update the program, always do so.
   
   • Close any open browsers.
   • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
   • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
   • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode (How to...)

2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

• Double-click on the Rkill desktop icon to run the tool.
• If using Vista or Windows 7 right-click on it and choose Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• If not, delete the file, then download and use the one provided in Link 2.
• If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
• Do not reboot until instructed.
• If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

RkU Version: 3.8.389.593, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #4
==============================================
>Drivers
==============================================
0xB709C000 C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 10604544 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Miniport Driver, Version 258.96 )
0xBD012000 C:\WINDOWS\System32\nv4_disp.dll 6344704 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Display driver, Version 258.96 )
0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2154496 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2154496 bytes
0x804D7000 RAW 2154496 bytes
0x804D7000 WMIxWDM 2154496 bytes
0xBF800000 Win32k 1859584 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1859584 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xB490D000 C:\WINDOWS\system32\drivers\monfilt.sys 1392640 bytes (Creative Technology Ltd., Creative WDM Audio Driver (32-bit))
0xB4A85000 C:\WINDOWS\system32\drivers\viahduaa.sys 995328 bytes (VIA Technologies, Inc., VIA High Definition Audio Function Driver)
0xB7AB9000 C:\WINDOWS\system32\DRIVERS\NVNRM.SYS 958464 bytes (NVIDIA Corporation, NVIDIA Network Resource Manager.)
0xB7BC6000 C:\WINDOWS\system32\DRIVERS\winachcf.sys 843776 bytes (Conexant, Modem)
0xB7D6A000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xB46D7000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xB6E5F000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xB7E21000 mfehidk.sys 380928 bytes (McAfee, Inc., McAfee Link Driver)
0xB481D000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xB393D000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
0xB6F15000 C:\WINDOWS\system32\drivers\mfefirek.sys 307200 bytes (McAfee, Inc., McAfee Core Firewall Engine Driver)
0xBD61F000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xB30B8000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xB6EBD000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector)
0xB7F79000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xB7F3A000 ssidrv.sys 188416 bytes (Webroot Software, Inc. (www.webroot.com), Spy Sweeper Interdiction Driver)
0xB3B9D000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xB7F0D000 C:\WINDOWS\system32\DRIVERS\NDIS.SYS 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xB1DD3000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
0xB4747000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xB7C94000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows (R) Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a)
0xB4794000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xB7EC8000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver)
0xB47E4000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
0xB6F88000 C:\WINDOWS\system32\drivers\mfeavfk.sys 147456 bytes (McAfee, Inc., Anti-Virus File System Filter Driver)
0xB4A61000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xB7CBC000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xB7BA3000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xB4772000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0x806E5000 ACPI_HAL 134400 bytes
0x806E5000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xB7E90000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xB7EEE000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xB4889000 C:\WINDOWS\system32\drivers\InCDFs.sys 126976 bytes (Nero AG, InCD File System Driver)
0xB7D50000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xB7EB0000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xB46BF000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
0xB7E0A000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xB705D000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xB22D0000 C:\WINDOWS\system32\drivers\mfeapfk.sys 90112 bytes (McAfee, Inc., Access Protection Filter Driver)
0xB3F82000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xB7074000 C:\WINDOWS\system32\DRIVERS\mfendisk.sys 81920 bytes (McAfee, Inc., McAfee NDIS Intermediate Driver)
0xB7088000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xB4876000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xB480A000 C:\WINDOWS\system32\drivers\mfetdi2k.sys 77824 bytes (McAfee, Inc., Anti-Virus Mini-Firewall Driver)
0xB7DF7000 WudfPf.sys 77824 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)
0xBD000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xB7E7E000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xB7F68000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xB6FAC000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xB702D000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xB81A8000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xB8188000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)
0xB82A8000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xB81B8000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xB439F000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xB8258000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xB8228000 C:\WINDOWS\system32\drivers\WmXlCore.sys 61440 bytes (Logitech Inc., Logitech WingMan Translation Driver)
0xB8268000 C:\WINDOWS\system32\DRIVERS\NVENETFD.sys 57344 bytes (NVIDIA Corporation, NVIDIA Networking Function Driver.)
0xB8168000 C:\WINDOWS\system32\DRIVERS\AmdPPM.sys 53248 bytes (Advanced Micro Devices, AMD Processor Driver)
0xB8108000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xB8178000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)
0xB81D8000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xB80E8000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xB3251000 C:\WINDOWS\system32\drivers\cfwids.sys 49152 bytes (McAfee, Inc., McAfee Personal Firewall IDS Plugin)
0xB3179000 C:\WINDOWS\system32\drivers\mfebopk.sys 49152 bytes (McAfee, Inc., Buffer Overflow Protection Driver)
0xB81F8000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xB704D000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xB8198000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
0xB80D8000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xB81E8000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xB80C8000 ssfs0bbc.sys 45056 bytes (Webroot Software, Inc. (www.webroot.com), Spy Sweeper FileSystem Filter Driver)
0xB80A8000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xB8248000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xB81C8000 C:\WINDOWS\system32\DRIVERS\nvnetbus.sys 40960 bytes (NVIDIA Corporation, NVIDIA Networking Bus Driver.)
0xB8118000 PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0xB8218000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xB3A65000 C:\WINDOWS\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver)
0xB80F8000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xB82D8000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
0xB8308000 C:\WINDOWS\system32\drivers\InCDPass.sys 36864 bytes (Nero AG, Nero InCD RW Filter Driver)
0xB8208000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xB82E8000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xB80B8000 sshrmd.sys 36864 bytes (Webroot Software, Inc. (www.webroot.com), Spy Sweeper Mini Driver)
0xB82C8000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xB83C0000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver)
0xB84B0000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xB8450000 C:\WINDOWS\system32\drivers\nvhda32.sys 32768 bytes (NVIDIA Corporation, NVIDIA HDMI Audio Driver)
0xB83B0000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xB83A0000 C:\WINDOWS\system32\drivers\WmFilter.sys 32768 bytes (Logitech Inc., Logitech WingMan Hid Filter Driver)
0xB8388000 C:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
0xB8478000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xB8330000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xB8398000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xB8428000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xB8480000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xB8458000 C:\WINDOWS\system32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)
0xB84A0000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xB8338000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xB8408000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xB8418000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)
0xB8328000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xB83A8000 C:\WINDOWS\system32\DRIVERS\usbohci.sys 20480 bytes (Microsoft Corporation, OHCI USB Miniport Driver)
0xB83F8000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xB6F74000 C:\WINDOWS\system32\drivers\MODEMCSA.sys 16384 bytes (Microsoft Corporation, Unimodem CSA Filter)
0xB7CEC000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xB41FF000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xB8564000 C:\WINDOWS\system32\DRIVERS\nvsmu.sys 16384 bytes (NVIDIA Corporation, NVIDIA nForce(TM) SMU Microcontroller Driver)
0xB855C000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)
0xB7CE8000 C:\WINDOWS\system32\drivers\WmBEnum.sys 16384 bytes (Logitech Inc., Logitech WingMan Virtual Bus Enumerator Driver)
0xB84B8000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xB6F68000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xB5D57000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0xB6F05000 C:\WINDOWS\system32\drivers\InCDRec.sys 12288 bytes (Nero AG, Nero InCD File System Recognizer)
0xB39C1000 C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 12288 bytes (Conexant, Diagnostic Interface DRIVER)
0xB4C30000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xB8588000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xB6EFD000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xB857C000 C:\WINDOWS\system32\DRIVERS\wmiacpi.sys 12288 bytes (Microsoft Corporation, Windows Management Interface for ACPI)
0xB85B6000 C:\WINDOWS\system32\DRIVERS\ASACPI.sys 8192 bytes (-, ATK0110 ACPI Utility)
0xB8606000 C:\WINDOWS\system32\drivers\AsIO.sys 8192 bytes
0xB85F6000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xB85AC000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)
0xB8612000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xB85F2000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xB85A8000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xB85FA000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xB85FE000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xB85BC000 C:\WINDOWS\system32\DRIVERS\serscan.sys 8192 bytes (Microsoft Corporation, Serial Imaging Device Driver)
0xB85C4000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xB85C8000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xB85AA000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xB8724000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xB86D8000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xB8781000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xB8670000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
0x89CA46E8 unknown_irp_handler 2328 bytes
0x89CA36E8 unknown_irp_handler 2328 bytes
0x89CA26E8 unknown_irp_handler 2328 bytes
0x89CA16E8 unknown_irp_handler 2328 bytes
0x89CA06E8 unknown_irp_handler 2328 bytes
0x89C9F6E8 unknown_irp_handler 2328 bytes
0x89C9E6E8 unknown_irp_handler 2328 bytes
0x89C9D6E8 unknown_irp_handler 2328 bytes
0x89C9C6E8 unknown_irp_handler 2328 bytes
0x89C9B6E8 unknown_irp_handler 2328 bytes
0x89C9A6E8 unknown_irp_handler 2328 bytes
0x89C996E8 unknown_irp_handler 2328 bytes
0x89C986E8 unknown_irp_handler 2328 bytes
0x89C976E8 unknown_irp_handler 2328 bytes
0x89C966E8 unknown_irp_handler 2328 bytes
0x89C956E8 unknown_irp_handler 2328 bytes
0x89C946E8 unknown_irp_handler 2328 bytes
0x89C936E8 unknown_irp_handler 2328 bytes
0x89C926E8 unknown_irp_handler 2328 bytes
0x89C916E8 unknown_irp_handler 2328 bytes
0x89C906E8 unknown_irp_handler 2328 bytes
0x89C8F6E8 unknown_irp_handler 2328 bytes
0x89C8E6E8 unknown_irp_handler 2328 bytes
0x89C8D6E8 unknown_irp_handler 2328 bytes
0x89C8C6E8 unknown_irp_handler 2328 bytes
0x89C8B6E8 unknown_irp_handler 2328 bytes
0x89C8A6E8 unknown_irp_handler 2328 bytes
0x89C896E8 unknown_irp_handler 2328 bytes
==============================================
>Stealth
==============================================

ComboFix 11-11-10.02 - Ken Henrikson 11/10/2011 11:17:22.3.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2815.2228 [GMT -5:00]
Running from: c:\documents and settings\Ken Henrikson\Desktop\ComboFix.exe
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\Application Data\TEMP\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\PostBuild.exe
c:\documents and settings\All Users\Application Data\TEMP\{5DB1DF0C-AABC-4362-8A6D-CEFDFB036E41}\PostBuild.exe
c:\documents and settings\Ken Henrikson\WINDOWS
c:\windows\$NtUninstallKB14955$
c:\windows\$NtUninstallKB14955$\3103425169\@
c:\windows\$NtUninstallKB14955$\3103425169\bckfg.tmp
c:\windows\$NtUninstallKB14955$\3103425169\cfg.ini
c:\windows\$NtUninstallKB14955$\3103425169\Desktop.ini
c:\windows\$NtUninstallKB14955$\3103425169\keywords
c:\windows\$NtUninstallKB14955$\3103425169\kwrd.dll
c:\windows\$NtUninstallKB14955$\3103425169\L\ygcmsqkh
c:\windows\$NtUninstallKB14955$\3103425169\lsflt7.ver
c:\windows\$NtUninstallKB14955$\3103425169\U\00000001.@
c:\windows\$NtUninstallKB14955$\3103425169\U\00000002.@
c:\windows\$NtUninstallKB14955$\3103425169\U\00000004.@
c:\windows\$NtUninstallKB14955$\3103425169\U\80000000.@
c:\windows\$NtUninstallKB14955$\3103425169\U\80000004.@
c:\windows\$NtUninstallKB14955$\3103425169\U\80000032.@
c:\windows\$NtUninstallKB14955$\4201489263
c:\windows\Downloaded Program Files\Install.inf
c:\windows\system32\msnphoto.scr
c:\windows\system32\skinboxer43.dll
.
.
((((((((((((((((((((((((( Files Created from 2011-10-10 to 2011-11-10 )))))))))))))))))))))))))))))))
.
.
2011-11-10 16:34 . 2011-11-10 16:34 63115 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\USERTILE.JS
2011-11-10 16:34 . 2011-11-10 16:34 4599 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UIRESOURCE.JS
2011-11-10 16:34 . 2011-11-10 16:34 9310 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXTBOX.JS
2011-11-10 16:34 . 2011-11-10 16:34 8646 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TILEBOX.JS
2011-11-10 16:34 . 2011-11-10 16:34 8613 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\SAVEDUSER.JS
2011-11-10 16:34 . 2011-11-10 16:34 6429 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UICORE.JS
2011-11-10 16:34 . 2011-11-10 16:34 5927 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXT.JS
2011-11-10 16:34 . 2011-11-10 16:34 6910 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\NEWUSERCOMM.JS
2011-11-10 16:34 . 2011-11-10 16:34 1651 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\QUERYSTRING.JS
2011-11-10 16:34 . 2011-11-10 16:34 8288 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\IMAGE.JS
2011-11-10 16:34 . 2011-11-10 16:34 6208 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LINK.JS
2011-11-10 16:34 . 2011-11-10 16:34 18541 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LOCALIZATION.JS
2011-11-10 16:33 . 2011-11-10 16:33 51852 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\EXTERNALWRAPPER.JS
2011-11-10 16:33 . 2011-11-10 16:33 20719 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\DIVWRAPPER.JS
2011-11-10 16:33 . 2011-11-10 16:33 8782 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\BUTTON.JS
2011-11-10 16:33 . 2011-11-10 16:33 7271 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\CHECKBOX.JS
2011-11-10 16:33 . 2011-11-10 16:33 23327 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\COMBOBOX.JS
2011-11-10 16:13 . 2011-08-17 13:49 138496 -c--a-w- c:\windows\system32\dllcache\afd.sys
2011-11-10 16:13 . 2011-08-17 13:49 138496 ----a-w- c:\windows\system32\drivers\afd.sys
2011-11-10 15:22 . 2011-11-10 15:22 -------- d-----w- C:\found.000
2011-11-08 21:33 . 2011-11-08 21:38 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\HPAppData
2011-11-08 21:33 . 2011-11-08 21:33 -------- d-----w- c:\documents and settings\NetworkService\Application Data\HPAppData
2011-11-08 20:29 . 2011-11-08 20:29 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2011-11-08 20:29 . 2011-11-08 20:29 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
2011-11-08 17:49 . 2011-11-08 17:49 -------- d-----w- c:\documents and settings\Ken Henrikson\Application Data\XnnFF4amH6
2011-11-08 17:49 . 2011-11-08 17:49 -------- d-----w- c:\documents and settings\Ken Henrikson\Application Data\hIIBBtzP0ycAiv3
2011-11-08 17:49 . 2011-11-08 17:49 -------- d-----w- c:\documents and settings\Ken Henrikson\Application Data\T666dEEK8fR9
2011-11-08 17:49 . 2011-11-08 17:49 -------- d-----w- c:\documents and settings\Ken Henrikson\Application Data\KXXwwjUCelIBz
2011-10-27 02:01 . 2011-10-27 02:01 -------- d-----w- c:\documents and settings\Ken Henrikson\Application Data\Visan
2011-10-27 02:01 . 2011-10-27 02:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Visan
2011-10-26 00:56 . 2011-10-26 00:56 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-10 14:22 . 2010-02-06 22:17 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-09-26 15:41 . 2009-10-08 19:57 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 15:41 . 2001-08-23 12:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-26 15:41 . 2001-08-23 12:00 20480 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-09 09:12 . 2004-08-04 05:56 599040 ----a-w- c:\windows\system32\crypt32.dll
2011-09-06 13:20 . 2004-08-04 04:17 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-09-06 01:13 . 2010-02-08 02:01 139080 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-09-06 01:12 . 2010-02-08 02:05 270240 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-09-06 01:12 . 2010-02-08 02:01 270240 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-09-06 00:52 . 2010-02-08 02:01 270240 ----a-w- c:\windows\system32\PnkBstrB.ex0
2011-09-03 19:43 . 2011-09-03 19:43 13696 ----a-w- c:\windows\system32\drivers\wpsnuio.sys
2011-08-31 22:00 . 2010-02-08 00:56 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-22 23:48 . 2004-08-04 05:56 916480 ----a-w- c:\windows\system32\wininet.dll
2011-08-22 23:48 . 2004-08-04 05:56 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-08-22 23:48 . 2004-08-04 05:56 43520 ------w- c:\windows\system32\licmgr10.dll
2011-08-22 11:56 . 2004-08-04 03:59 385024 ------w- c:\windows\system32\html.iec
2011-09-07 21:01 . 2011-05-28 20:30 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2011-04-14 18:01 . 2011-01-12 12:12 24376 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\NBHShellExt]
@="{8D2223A2-B3C6-4e32-B096-CDD11F628C60}"
[HKEY_CLASSES_ROOT\CLSID\{8D2223A2-B3C6-4e32-B096-CDD11F628C60}]
2008-02-28 22:39 97064 ----a-w- c:\program files\Nero\Nero8\InCD\NBHShx.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-06-28 1195408]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-08 1753192]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-03-27 421888]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"WinCalendarV3"="c:\program files\Sapro Systems WinCalendarV3\WinCalendarV3_SysTray.exe" [2011-01-25 79288]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-11-10 16:49 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-07-28 23:08 1259376 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
2008-06-12 14:00 113136 ----a-w- c:\program files\Roxio\CinePlayer\DMXLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]
2008-12-31 07:38 33546240 -c--a-r- c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2008-12-08 20:50 54576 -c--a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2007-01-09 03:17 52256 -c--a-w- c:\program files\CyberLink\PowerDVD\Language\Language.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Default Manager]
2009-07-17 15:12 288080 ----a-w- c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ------w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSN Toolbar]
2009-11-16 13:27 240992 ----a-w- c:\program files\MSN Toolbar\Platform\4.0.0357.1\mswinext.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2009-03-10 20:54 570664 -c--a-w- c:\program files\Common Files\Nero\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-03-27 20:37 421888 ----a-w- c:\program files\QuickTime\qttask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2007-03-15 02:01 71216 -c----w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2008-06-23 14:05 244208 ----a-w- c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]
2008-02-28 22:39 2049320 -c--a-w- c:\program files\Nero\Nero8\InCD\NBHGui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateLBPShortCut]
2008-12-04 03:15 218408 ------w- c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdatePSTShortCut]
2009-03-16 21:49 210216 ------w- c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinCalendarV3]
2011-01-25 03:35 79288 ----a-w- c:\program files\Sapro Systems WinCalendarV3\WinCalendarV3_SysTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Electronic Arts\\BattleForge\\Bootstrapper.exe"=
"c:\\Program Files\\Electronic Arts\\BattleForge\\BattleForge.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Steam\\steamapps\\krhenrikson\\half-life\\hl.exe"=
"c:\\Program Files\\Common Files\\McAfee\\McSvcHost\\McSvHost.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Roxio\\Sound Editor 10\\SoundEdit10.exe"=
"c:\\Program Files\\Roxio\\Digital Home 10\\RoxioUPnPRenderer10.exe"=
"c:\\Program Files\\Steam\\steamapps\\krhenrikson\\zombie panic! source\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead 2\\left4dead2.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\stubbs the zombie\\Stubbs.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
.
R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [3/22/2011 9:14 AM 29832]
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [1/12/2011 7:12 AM 84200]
R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [1/12/2011 7:12 AM 271480]
R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [1/12/2011 7:12 AM 271480]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\mfefire.exe [1/12/2011 7:12 AM 188136]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [1/12/2011 7:12 AM 141792]
R2 NeroRegInCDSrv;Nero Registry InCD Service;c:\program files\Nero\Nero8\InCD\NBHRegInCDSrv.exe [2/28/2008 5:39 PM 53032]
R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe [7/30/2011 11:58 AM 1201656]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [1/12/2011 7:12 AM 56064]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [1/12/2011 7:12 AM 314088]
R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [1/12/2011 7:12 AM 88736]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [1/22/2011 7:03 PM 39456]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2/6/2010 6:38 PM 993280]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 12:16 PM 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [5/2/2011 8:33 AM 136176]
S2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files\Roxio\Digital Home 10\RoxioUpnpService10.exe [6/23/2008 9:08 AM 362992]
S2 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [6/23/2008 9:06 AM 309744]
S2 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [6/23/2008 9:06 AM 166384]
S2 SessionLauncher;SessionLauncher;c:\docume~1\KENHEN~1\LOCALS~1\Temp\DX9\SessionLauncher.exe --> c:\docume~1\KENHEN~1\LOCALS~1\Temp\DX9\SessionLauncher.exe [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [5/2/2011 8:33 AM 136176]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 7:49 AM 227232]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [1/12/2011 7:12 AM 88736]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [1/12/2011 7:12 AM 84488]
S3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [6/23/2008 9:08 AM 313840]
S3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [6/23/2008 9:05 AM 1120752]
S3 samhid;samhid;c:\windows\system32\drivers\samhid.sys --> c:\windows\system32\drivers\samhid.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 12:16 PM 753504]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mfeavfk01
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-05-02 13:32]
.
2011-11-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-05-02 13:32]
.
2011-11-10 c:\windows\Tasks\HP Photo Creations Communicator.job
- c:\documents and settings\All Users\Application Data\HP Photo Creations\MessageCheck.exe [2011-10-27 01:59]
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.forumswatcher.com/search.htm
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
Trusted Zone: internet
Trusted Zone: mcafee.com
TCP: DhcpNameServer = 167.206.254.2 167.206.254.1 192.168.1.1
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
FF - ProfilePath - c:\documents and settings\Ken Henrikson\Application Data\Mozilla\Firefox\Profiles\ovu13fza.default\
FF - prefs.js: browser.search.selectedEngine - Bing
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/?pc=Z128&install_date=20110903
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z128&form=ZGAADF&install_date=20110903&q=
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
**************************************************************************
.
disk not found C:\
.
please note that you need administrator rights to perform deep scan
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files:
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,61,33,29,68,85,6d,63,4c,a5,34,9c,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,61,33,29,68,85,6d,63,4c,a5,34,9c,\
.
[HKEY_USERS\S-1-5-21-329068152-796845957-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{E3D7829F-E20F-19F4-6BE0-1497091A7076}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2944)
c:\windows\system32\WININET.dll
c:\program files\Nero\Nero8\InCD\NBHShx.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
c:\program files\Nero\Nero8\InCD\NBHStr.dll
c:\program files\Common Files\Nero\Shared\NL3\AdvrCntr3.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Nero\Nero8\InCD\InCDsrv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Webroot\WebrootSecurity\SpySweeper.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\MsPMSPSv.exe
c:\program files\Common Files\McAfee\SystemCore\mcshield.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Completion time: 2011-11-10 11:37:38 - machine was rebooted
ComboFix-quarantined-files.txt 2011-11-10 16:37
.
Pre-Run: 160,905,318,400 bytes free
Post-Run: 161,379,778,560 bytes free
.
- - End Of File - - FCCA57B80686374C4502372EA74AB89F

Since I ran the above steps, several things happened.

I did get my sound back on the computer.
The computer runs ALOT faster, like it should.

But my McAfee real time protection detected and removed 2-3 more Artemis! trojans, while sitting idle, awaiting your next instructions.

Thank you again for your time, efforts and patience.

Good news :)

1. Please open Notepad

• Click Start , then Run
• Type notepad .exe in the Run Box
• Click OK

Windows Vista/7 users: click Start, in "Start search" type notepad and press Enter.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

---

Folder::
c:\documents and settings\Ken Henrikson\Application Data\XnnFF4amH6
c:\documents and settings\Ken Henrikson\Application Data\hIIBBtzP0ycAiv3
c:\documents and settings\Ken Henrikson\Application Data\T666dEEK8fR9
c:\documents and settings\Ken Henrikson\Application Data\KXXwwjUCelIBz

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000000

---

3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

https://discussions.virtualdr.com/im.../2016/03/2.gif


6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt