[RESOLVED] Trying to remove "Antimalware", can't enter Safe Mode

My mother recently picked up a nasty piece of foistware ironically named "Antimalware". It's a lot like WinAntivirus in that it:

- bombards the user with false virus warnings
- constantly tries to install/reinstall itself
- insists on being given a "reason" before it can be uninstalled
- redirects any internet searches aimed at removing it or stopping its processes

To make matters worse, whenever I try to restart in Safe Mode, I always get the Blue Screen of Death immediately after choosing which OS to use (there's only one in this case: XP Media Center Edition). Anyone seen this before?


On a side note, I wish there were more tech-savvy people in congress so we could see about banning foistware like this altogether. Such a hassle.

Try doing the following scans... (do the superantispyware in regular mode for now)

Print these instructions out.

NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner4.exe

1. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

PHYSICALLY DISCONNECT FROM THE INTERNET

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Under Configuration and Preferences, click the Preferences button.
* Under [b]General and Startup" tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Scan for tracking cookies.
- Terminate memory threats before quarantining.
* Click the Close button to leave the control center screen.
* Back on the main screen, under Scan for Harmful Software click Scan your computer.
* On the left, make sure you check C:\Fixed Drive.
* On the right, under Complete Scan, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.
NOTE: Tracking cookies can be omitted from the log.

RECONNECT TO THE INTERNET

RESTART COMPUTER!

2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

3. Download gmer.zip: http://www.gmer.net/files.php
Unzip the file, and double click on gmer.exe, select Rootkit tab and click the Scan button.
When scan is completed, click Save button, and save the results as gmer.log
Warning ! Please, do not select the "Show all" checkbox during the scan.
Post the log to your next reply.

RESTART COMPUTER

4. Download, install, and run HijackThis:
http://www.snapfiles.com/get/hijackthis.html
Post HijackThis log.
Do NOT attempt to "fix" anything yet with Hijackthis!


DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Above layout courtesy of Broni

Here's the logs. I managed to get SUPER Antispyware updated, but I keep getting an error message when I try to update with Malwarebytes. Also, shortly after trying to update it, I went back to try updating SUPER Antispyware and got a similar error message. I've added them both to Panda's (the firewall on this PC) list of excluded files, but that's not doing it. Nevertheless, I did a scan with it anyway using definitions from September of this year, with log to follow:


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/18/2009 at 12:19 PM

Application Version : 4.30.1004

Core Rules Database Version : 4288
Trace Rules Database Version: 2161

Scan type : Complete Scan
Total Scan Time : 00:27:15

Memory items scanned : 519
Memory threats detected : 2
Registry items scanned : 5553
Registry threats detected : 2
File items scanned : 34554
File threats detected : 519

Trojan.Agent/Gen
C:\WINDOWS\SYSTEM32\CSRSS2.DLL
C:\WINDOWS\SYSTEM32\CSRSS2.DLL
Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\Csrss
C:\DOCUMENTS AND SETTINGS\JANE BOWER\LOCAL SETTINGS\TEMP\A995.EXE
C:\DOCUMENTS AND SETTINGS\JANE BOWER\LOCAL SETTINGS\TEMP\CSRSS2.DLL
C:\DOCUMENTS AND SETTINGS\JANE BOWER\LOCAL SETTINGS\TEMP\INSTALLER.EXE

Trojan.Agent/Gen-FakeAlert[CS]
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\CSRSS.EXE
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\CSRSS.EXE
C:\DOCUMENTS AND SETTINGS\JANE BOWER\LOCAL SETTINGS\TEMP\0.5767820608113787.EXE
C:\WINDOWS\Prefetch\CSRSS.EXE-345D9C3F.pf

Adware.Tracking Cookie
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane_bower@atdmt[1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\[email protected][1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane bower@roiservice[1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane [email protected][2].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane [email protected][2].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane bower@advertising[2].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane bower@metareward[2].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane bower@hitbox[1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane_bower@pointroll[2].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane bower@1070527205[2].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane bower@tribalfusion[1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane bower@realmedia[1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane [email protected][2].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane bower@specificclick[2].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane bower@insightexpressai[2].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane [email protected][2].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane [email protected][1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane bower@adrevolver[1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane bower@1072704758[1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane [email protected][2].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane bower@trafficmp[3].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane [email protected][1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane [email protected][1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane bower@mediaplex[1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane [email protected][1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane bower@partner2profit[1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane [email protected][2].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane bower@atwola[1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane_bower@doubleclick[1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane_bower@casalemedia[2].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane [email protected][1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane bower@tacoda[1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane bower@zedo[1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane [email protected][1].txt
C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\Cookies\jane bower@insightbb[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@qnsr[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane_bower@elitefitness[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@mass2onemedia[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@************[3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightbb[9].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightbb[8].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane_bower@specificmedia[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightfirst[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@tripod[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@************[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@collective-media[10].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][13].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][17].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][7].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][6].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][10].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][14].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][18].txt
C:\Documents and Settings\Jane Bower\Cookies\jane_bower@media6degrees[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][11].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][15].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][12].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][16].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@collective-media[11].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@collective-media[12].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@indextools[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane_bower@adbrite[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane_bower@interclick[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@pro-market[1].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@indextools[3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@pro-market[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][6].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@adbrite[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][9].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][6].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@chitika[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][7].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][8].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightexpressai[3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightexpressai[7].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][9].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][8].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][7].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[16].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@wordtracker[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[26].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[12].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[22].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@yieldmanager[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@buildtraffic[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[17].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][12].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][11].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][10].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightexpressai[4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightexpressai[8].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[27].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[13].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[23].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightexpressai[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightexpressai[5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightexpressai[9].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[18].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[28].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[30].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[10].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[20].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[14].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[24].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightexpressai[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightexpressai[6].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[19].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[29].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[11].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[21].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[15].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[25].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@yieldmanager[1].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane_bower@insightexpressai[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane_bower@eyewonder[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@m2omedia[14].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][13].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@m2omedia[4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@m2omedia[8].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@m2omedia[15].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@m2omedia[16].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@m2omedia[13].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@m2omedia[11].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@m2omedia[12].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][10].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@m2omedia[10].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][14].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@m2omedia[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@m2omedia[5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@m2omedia[9].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][11].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][15].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@m2omedia[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@m2omedia[6].txt
C:\Documents and Settings\Jane Bower\Cookies\jane_bower@m2omedia[2].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][12].txt


(continued in next post)

C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@m2omedia[3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@m2omedia[7].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@tacoda[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@tacoda[6].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@revsci[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@revsci[5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@bizrate[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@bizrate[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@tacoda[3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@tacoda[7].txt
C:\Documents and Settings\Jane Bower\Cookies\jane_bower@revsci[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[8].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[7].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[6].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificclick[9].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@m2omedia[17].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@m2omedia[18].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@revsci[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@revsci[6].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][10].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@tacoda[4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@tacoda[8].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@spafinder[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@revsci[3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@revsci[7].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@tacoda[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@tacoda[5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@tacoda[9].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@adwarealert[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@revsci[4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@revsci[8].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@nextag[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@burstbeacon[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@interclick[11].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane_bower@specificclick[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][13].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][12].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][11].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][14].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane_bower@yieldmanager[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][9].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][8].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][7].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][6].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane_bower@traveladvertising[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][6].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][10].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][20].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][14].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][18].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@pitchforkmedia[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@interclick[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@interclick[6].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][8].txt
C:\Documents and Settings\Jane Bower\Cookies\jane_bower@traffic[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][11].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][21].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][15].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][25].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][19].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@interclick[3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@interclick[7].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][9].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@reztrack[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane_bower@pro-market[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][12].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][22].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][16].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@interclick[4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@interclick[8].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][6].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@reztrack[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][13].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][23].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][17].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@interclick[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@interclick[5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@interclick[9].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][7].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@accounts[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@accounts[5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@accounts[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@accounts[6].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@findtoto[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@accounts[3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@accounts[7].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@findtoto[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@accounts[4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@indexstats[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@roiservice[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@collective-media[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@collective-media[5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@collective-media[9].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightbb[13].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightbb[17].txt
C:\Documents and Settings\Jane Bower\Cookies\jane_bower@invitemedia[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@collective-media[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@collective-media[6].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightbb[10].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightbb[14].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@collective-media[3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@collective-media[7].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightbb[11].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightbb[15].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@roiservice[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@collective-media[4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@collective-media[8].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightbb[12].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightbb[16].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@partner2profit[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane_bower@mediawebconnect[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane_bower@pointroll[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@partner2profit[3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@partner2profit[7].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@partner2profit[4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][8].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][7].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][6].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][9].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@partner2profit[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@partner2profit[5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightexpressai[10].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@eyewonder[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@eyewonder[3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt

(continued in next post)

C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][6].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@a.************[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@adserver[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@revsci[10].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][7].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificmedia[3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificmedia[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@specificmedia[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@adserver[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@tacoda[13].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@tacoda[14].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@tacoda[11].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@tacoda[12].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@tacoda[10].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@adlegend[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@adserver[3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@a.************[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane_bower@precisionclick[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@valueclick[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][6].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@kontera[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightbb[6].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightbb[5].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightbb[4].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightbb[3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightbb[2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightbb[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@insightbb[7].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@crossmediaservices[1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@tacoda[18].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@tacoda[15].txt
C:\Documents and Settings\Jane Bower\Cookies\jane bower@tacoda[16].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][3].txt
C:\Documents and Settings\Jane Bower\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Cookies\[email protected][1].txt
C:\Documents and Settings\Jane Bower\Local Settings\Temp\Cookies\jane bower@insightexpressai[2].txt
C:\Documents and Settings\Jane Bower\Local Settings\Temp\Cookies\jane bower@metareward[2].txt
C:\Documents and Settings\Jane Bower\Local Settings\Temp\Cookies\jane bower@specificclick[2].txt
C:\Documents and Settings\Jane Bower\Local Settings\Temp\Cookies\jane bower@tacoda[1].txt
C:\Documents and Settings\Jane Bower\Local Settings\Temp\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Local Settings\Temp\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Local Settings\Temp\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Local Settings\Temp\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Local Settings\Temp\Cookies\jane bower@roiservice[1].txt
C:\Documents and Settings\Jane Bower\Local Settings\Temp\Cookies\jane_bower@pointroll[2].txt
C:\Documents and Settings\Jane Bower\Local Settings\Temp\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Local Settings\Temp\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Local Settings\Temp\Cookies\jane bower@partner2profit[1].txt
C:\Documents and Settings\Jane Bower\Local Settings\Temp\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Local Settings\Temp\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Local Settings\Temp\Cookies\jane [email protected][2].txt
C:\Documents and Settings\Jane Bower\Local Settings\Temp\Cookies\jane [email protected][1].txt
C:\Documents and Settings\Jane Bower\Local Settings\Temp\Cookies\jane bower@insightbb[1].txt

Rogue.CoreGuardAntiVirus2009
HKU\S-1-5-21-43960125-1719418442-3974907192-1006\Software\CoreGuard

Trojan.Agent/Gen-RogueComponent
C:\DOCUMENTS AND SETTINGS\JANE BOWER\LOCAL SETTINGS\TEMP\UACD26C.TMP
C:\SYSTEM VOLUME INFORMATION\_RESTORE{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP484\A0184858.DLL

Malware.Installer-Pkg/Gen
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{6B6A7665-DB48-4762-AB5D-BEEB9E1CD7FA}.EXE
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{26D2C2C3-CF14-4ED7-B1FC-0BE64AFBA3B3}.EXE
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{3C48F877-A164-45E9-B9DA-26A049FFC207}.EXE
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{6293BC00-4EB8-4C65-8548-53E2FC3BF937}.EXE
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{651956B7-1969-42AA-9453-E0B813019D54}.EXE
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{989E4C3B-B2C9-4486-9A09-D5A8F953837C}.EXE
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{C0A0AA4D-C79B-48CA-8843-2B02B626C9E6}.EXE
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{C2D8F0E2-6978-4409-8351-BA8785DA11EE}.EXE
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{D1A6F3FD-7B40-443F-8767-BADB25A0D222}.EXE
C:\PROGRAM FILES\WILDTANGENT\APPS\DELL GAME CONSOLE\DOWNLOADS\INSTALLERS\{E0814F95-5380-4892-B8C8-7FA4B349EF46}.EXE

Malwarebytes' Anti-Malware 1.41
Database version: 2775
Windows 5.1.2600 Service Pack 3

11/18/2009 3:10:16 PM
mbam-log-2009-11-18 (15-10-16).txt

Scan type: Full Scan (C:\|)
Objects scanned: 184383
Time elapsed: 25 minute(s), 55 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Csrss (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

This next one, the GMER log, is the longest I've ever seen, and it may require around 15 separate posts to get it all on the board. In case you're wondering, I can't remember the last time this PC was subjected to any kind of scanning, for viruses or anything else:


GMER 1.0.15.15227 - http://www.gmer.net
Rootkit scan 2009-11-18 16:38:24
Windows 5.1.2600 Service Pack 3
Running: 4mg2kcxk.exe; Driver: C:\DOCUME~1\JANEBO~1\LOCALS~1\Temp\pxtdypow.sys


---- System - GMER 1.0.15 ----

SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xED1F30B0]
SSDT \??\C:\WINDOWS\system32\DRIVERS\PavProc.sys (Panda Process Protection driver/Panda Software International) ZwTerminateThread [0xBA216E40]
SSDT \??\C:\WINDOWS\system32\PavSRK.sys ZwWriteVirtualMemory [0xEBCDC4E8]

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 3018 805048B4 4 Bytes CALL 693C167D
? C:\WINDOWS\system32\PavTPK.sys The system cannot find the file specified. !
? C:\WINDOWS\system32\PavSRK.sys The system cannot find the file specified. !
? system32\drivers\av5flt.sys The system cannot find the path specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtClose 7C90CFEE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtClose + 4 7C90CFF2 2 Bytes [4D, 5F] {DEC EBP; POP EDI}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtCreateFile 7C90D0AE 1 Byte [FF]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtCreateFile 7C90D0AE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtCreateFile + 4 7C90D0B2 2 Bytes [6E, 5F] {OUTSB ; POP EDI}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [50, 5F] {PUSH EAX; POP EDI}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtDeleteFile 7C90D23E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtDeleteFile + 4 7C90D242 2 Bytes [71, 5F] {JNO 0x61}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtDeleteKey 7C90D24E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtDeleteKey + 4 7C90D252 2 Bytes [53, 5F] {PUSH EBX; POP EDI}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtDeleteValueKey 7C90D26E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtDeleteValueKey + 4 7C90D272 2 Bytes [56, 5F] {PUSH ESI; POP EDI}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtDuplicateObject 7C90D29E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtDuplicateObject + 4 7C90D2A2 2 Bytes [59, 5F] {POP ECX; POP EDI}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtEnumerateKey 7C90D2CE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtEnumerateKey + 4 7C90D2D2 2 Bytes [5C, 5F] {POP ESP; POP EDI}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtEnumerateValueKey 7C90D2EE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtEnumerateValueKey + 4 7C90D2F2 2 Bytes [5F, 5F] {POP EDI; POP EDI}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtOpenFile 7C90D59E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtOpenFile + 4 7C90D5A2 2 Bytes [74, 5F] {JZ 0x61}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtQueryMultipleValueKey 7C90D86E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtQueryMultipleValueKey + 4 7C90D872 2 Bytes [62, 5F]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtQueryValueKey 7C90D96E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtQueryValueKey + 4 7C90D972 2 Bytes [65, 5F]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtReadFile 7C90D9CE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtReadFile + 4 7C90D9D2 2 Bytes [77, 5F] {JA 0x61}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtSetInformationFile 7C90DC5E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtSetInformationFile + 4 7C90DC62 2 Bytes [7A, 5F] {JP 0x61}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [68, 5F]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtUnloadKey 7C90DECE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtUnloadKey + 4 7C90DED2 2 Bytes [6B, 5F]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtWriteFile 7C90DF7E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!NtWriteFile + 4 7C90DF82 2 Bytes [7D, 5F] {JGE 0x61}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!LdrLoadDll 7C9163C3 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ntdll.dll!LdrLoadDll + 4 7C9163C7 2 Bytes [4A, 5F] {DEC EDX; POP EDI}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 5F310F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 5F370F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] kernel32.dll!CreateFileMappingW 7C80943C 6 Bytes JMP 5F3D0F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] kernel32.dll!MapViewOfFileEx 7C80B936 6 Bytes JMP 5F340F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [41, 5F] {INC ECX; POP EDI}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] kernel32.dll!CreateProcessInternalW 7C8197B0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] kernel32.dll!CreateProcessInternalW + 4 7C8197B4 2 Bytes [47, 5F] {INC EDI; POP EDI}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] kernel32.dll!MoveFileWithProgressW 7C81F72E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] kernel32.dll!MoveFileWithProgressW + 4 7C81F732 2 Bytes [44, 5F] {INC ESP; POP EDI}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 5F3A0F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] USER32.dll!DispatchMessageW 7E418A01 6 Bytes JMP 5FA90F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] USER32.dll!TranslateMessage 7E418BF6 6 Bytes JMP 5F940F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] USER32.dll!DispatchMessageA 7E4196B8 6 Bytes JMP 5F910F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] USER32.dll!CreateAcceleratorTableW 7E41D9BB 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] USER32.dll!CreateAcceleratorTableW + 4 7E41D9BF 2 Bytes [A4, 5F] {MOVSB ; POP EDI}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 5FA60F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 5FA00F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 5F970F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] USER32.dll!BeginDeferWindowPos 7E42AFB9 6 Bytes JMP 5F8E0F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [9E, 5F] {SAHF ; POP EDI}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 5F8B0F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] USER32.dll!AttachThreadInput 7E431E52 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] USER32.dll!AttachThreadInput + 4 7E431E56 2 Bytes [9B, 5F] {WAIT ; POP EDI}
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ADVAPI32.dll!OpenServiceW 77DE6FFD 6 Bytes JMP 5F220F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ADVAPI32.dll!StartServiceA 77DEFB58 6 Bytes JMP 5F250F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ADVAPI32.dll!StartServiceW 77DF3E94 6 Bytes JMP 5F280F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ADVAPI32.dll!ControlService 77DF4A09 6 Bytes JMP 5F130F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ADVAPI32.dll!OpenServiceA 77DF4C66 6 Bytes JMP 5F1F0F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ADVAPI32.dll!LsaAddAccountRights 77E1ABF1 6 Bytes JMP 5F2B0F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 5F2E0F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ADVAPI32.dll!ChangeServiceConfigA 77E36E69 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ADVAPI32.dll!ChangeServiceConfigW 77E37001 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ADVAPI32.dll!ChangeServiceConfig2A 77E37101 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ADVAPI32.dll!ChangeServiceConfig2W 77E37189 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ADVAPI32.dll!ChangeServiceConfig2W + 4 77E3718D 2 Bytes [0E, 5F] {PUSH CS; POP EDI}

.text C:\WINDOWS\eHome\ehRecvr.exe[188] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F160F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F190F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ADVAPI32.dll!DeleteService 77E374B1 6 Bytes JMP 5F1C0F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ole32.dll!CoCreateInstanceEx 77500526 6 Bytes JMP 5F880F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ole32.dll!CoGetClassObject 775156C5 6 Bytes JMP 5F850F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ole32.dll!CLSIDFromProgID 775187F2 6 Bytes JMP 5F820F5A
.text C:\WINDOWS\eHome\ehRecvr.exe[188] ole32.dll!CLSIDFromProgIDEx 7755620D 6 Bytes JMP 5F7F0F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtClose 7C90CFEE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtClose + 4 7C90CFF2 2 Bytes [4D, 5F] {DEC EBP; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtCreateFile 7C90D0AE 1 Byte [FF]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtCreateFile 7C90D0AE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtCreateFile + 4 7C90D0B2 2 Bytes [6E, 5F] {OUTSB ; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [50, 5F] {PUSH EAX; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtDeleteFile 7C90D23E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtDeleteFile + 4 7C90D242 2 Bytes [71, 5F] {JNO 0x61}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtDeleteKey 7C90D24E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtDeleteKey + 4 7C90D252 2 Bytes [53, 5F] {PUSH EBX; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtDeleteValueKey 7C90D26E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtDeleteValueKey + 4 7C90D272 2 Bytes [56, 5F] {PUSH ESI; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtDuplicateObject 7C90D29E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtDuplicateObject + 4 7C90D2A2 2 Bytes [59, 5F] {POP ECX; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtEnumerateKey 7C90D2CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtEnumerateKey + 4 7C90D2D2 2 Bytes [5C, 5F] {POP ESP; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtEnumerateValueKey 7C90D2EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtEnumerateValueKey + 4 7C90D2F2 2 Bytes [5F, 5F] {POP EDI; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtOpenFile 7C90D59E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtOpenFile + 4 7C90D5A2 2 Bytes [74, 5F] {JZ 0x61}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtQueryMultipleValueKey 7C90D86E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtQueryMultipleValueKey + 4 7C90D872 2 Bytes [62, 5F]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtQueryValueKey 7C90D96E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtQueryValueKey + 4 7C90D972 2 Bytes [65, 5F]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtReadFile 7C90D9CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtReadFile + 4 7C90D9D2 2 Bytes [77, 5F] {JA 0x61}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtSetInformationFile 7C90DC5E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtSetInformationFile + 4 7C90DC62 2 Bytes [7A, 5F] {JP 0x61}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [68, 5F]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtUnloadKey 7C90DECE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtUnloadKey + 4 7C90DED2 2 Bytes [6B, 5F]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtWriteFile 7C90DF7E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!NtWriteFile + 4 7C90DF82 2 Bytes [7D, 5F] {JGE 0x61}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!LdrLoadDll 7C9163C3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ntdll.dll!LdrLoadDll + 4 7C9163C7 2 Bytes [4A, 5F] {DEC EDX; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 5F310F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 5F370F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] kernel32.dll!CreateFileMappingW 7C80943C 6 Bytes JMP 5F3D0F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] kernel32.dll!MapViewOfFileEx 7C80B936 6 Bytes JMP 5F340F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [41, 5F] {INC ECX; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] kernel32.dll!CreateProcessInternalW 7C8197B0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] kernel32.dll!CreateProcessInternalW + 4 7C8197B4 2 Bytes [47, 5F] {INC EDI; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] kernel32.dll!MoveFileWithProgressW 7C81F72E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] kernel32.dll!MoveFileWithProgressW + 4 7C81F732 2 Bytes [44, 5F] {INC ESP; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 5F3A0F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] USER32.dll!DispatchMessageW 7E418A01 6 Bytes JMP 5FA90F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] USER32.dll!TranslateMessage 7E418BF6 6 Bytes JMP 5F940F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] USER32.dll!DispatchMessageA 7E4196B8 6 Bytes JMP 5F910F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] USER32.dll!CreateAcceleratorTableW 7E41D9BB 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] USER32.dll!CreateAcceleratorTableW + 4 7E41D9BF 2 Bytes [A4, 5F] {MOVSB ; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 5FA60F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 5FA00F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 5F970F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] USER32.dll!BeginDeferWindowPos 7E42AFB9 6 Bytes JMP 5F8E0F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [9E, 5F] {SAHF ; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 5F8B0F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] USER32.dll!AttachThreadInput 7E431E52 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] USER32.dll!AttachThreadInput + 4 7E431E56 2 Bytes [9B, 5F] {WAIT ; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 6 Bytes JMP 5F100F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ADVAPI32.dll!OpenServiceW 77DE6FFD 6 Bytes JMP 5F220F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ADVAPI32.dll!StartServiceA 77DEFB58 6 Bytes JMP 5F250F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ADVAPI32.dll!StartServiceW 77DF3E94 6 Bytes JMP 5F280F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ADVAPI32.dll!ControlService 77DF4A09 6 Bytes JMP 5F130F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ADVAPI32.dll!OpenServiceA 77DF4C66 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ADVAPI32.dll!LsaAddAccountRights 77E1ABF1 6 Bytes JMP 5F2B0F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 5F2E0F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ADVAPI32.dll!ChangeServiceConfigA 77E36E69 6 Bytes JMP 5F040F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ADVAPI32.dll!ChangeServiceConfigW 77E37001 6 Bytes JMP 5F070F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ADVAPI32.dll!ChangeServiceConfig2A 77E37101 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ADVAPI32.dll!ChangeServiceConfig2W 77E37189 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ADVAPI32.dll!ChangeServiceConfig2W + 4 77E3718D 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F160F5A

.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F190F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ADVAPI32.dll!DeleteService 77E374B1 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ole32.dll!CoCreateInstanceEx 77500526 6 Bytes JMP 5F880F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ole32.dll!CoGetClassObject 775156C5 6 Bytes JMP 5F850F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ole32.dll!CLSIDFromProgID 775187F2 6 Bytes JMP 5F820F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe[244] ole32.dll!CLSIDFromProgIDEx 7755620D 6 Bytes JMP 5F7F0F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtClose 7C90CFEE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtClose + 4 7C90CFF2 2 Bytes [4D, 5F] {DEC EBP; POP EDI}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtCreateFile 7C90D0AE 1 Byte [FF]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtCreateFile 7C90D0AE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtCreateFile + 4 7C90D0B2 2 Bytes [6E, 5F] {OUTSB ; POP EDI}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [50, 5F] {PUSH EAX; POP EDI}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtDeleteFile 7C90D23E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtDeleteFile + 4 7C90D242 2 Bytes [71, 5F] {JNO 0x61}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtDeleteKey 7C90D24E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtDeleteKey + 4 7C90D252 2 Bytes [53, 5F] {PUSH EBX; POP EDI}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtDeleteValueKey 7C90D26E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtDeleteValueKey + 4 7C90D272 2 Bytes [56, 5F] {PUSH ESI; POP EDI}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtDuplicateObject 7C90D29E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtDuplicateObject + 4 7C90D2A2 2 Bytes [59, 5F] {POP ECX; POP EDI}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtEnumerateKey 7C90D2CE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtEnumerateKey + 4 7C90D2D2 2 Bytes [5C, 5F] {POP ESP; POP EDI}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtEnumerateValueKey 7C90D2EE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtEnumerateValueKey + 4 7C90D2F2 2 Bytes [5F, 5F] {POP EDI; POP EDI}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtOpenFile 7C90D59E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtOpenFile + 4 7C90D5A2 2 Bytes [74, 5F] {JZ 0x61}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtQueryMultipleValueKey 7C90D86E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtQueryMultipleValueKey + 4 7C90D872 2 Bytes [62, 5F]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtQueryValueKey 7C90D96E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtQueryValueKey + 4 7C90D972 2 Bytes [65, 5F]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtReadFile 7C90D9CE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtReadFile + 4 7C90D9D2 2 Bytes [77, 5F] {JA 0x61}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtSetInformationFile 7C90DC5E 3 Bytes [FF, 25, 1E]

.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtSetInformationFile + 4 7C90DC62 2 Bytes [7A, 5F] {JP 0x61}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [68, 5F]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtUnloadKey 7C90DECE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtUnloadKey + 4 7C90DED2 2 Bytes [6B, 5F]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtWriteFile 7C90DF7E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!NtWriteFile + 4 7C90DF82 2 Bytes [7D, 5F] {JGE 0x61}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!LdrLoadDll 7C9163C3 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ntdll.dll!LdrLoadDll + 4 7C9163C7 2 Bytes [4A, 5F] {DEC EDX; POP EDI}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 5F310F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 5F370F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] kernel32.dll!CreateFileMappingW 7C80943C 6 Bytes JMP 5F3D0F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] kernel32.dll!MapViewOfFileEx 7C80B936 6 Bytes JMP 5F340F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [41, 5F] {INC ECX; POP EDI}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] kernel32.dll!CreateProcessInternalW 7C8197B0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] kernel32.dll!CreateProcessInternalW + 4 7C8197B4 2 Bytes [47, 5F] {INC EDI; POP EDI}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] kernel32.dll!MoveFileWithProgressW 7C81F72E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] kernel32.dll!MoveFileWithProgressW + 4 7C81F732 2 Bytes [44, 5F] {INC ESP; POP EDI}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 5F3A0F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ADVAPI32.dll!OpenServiceW 77DE6FFD 6 Bytes JMP 5F220F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ADVAPI32.dll!StartServiceA 77DEFB58 6 Bytes JMP 5F250F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ADVAPI32.dll!StartServiceW 77DF3E94 6 Bytes JMP 5F280F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ADVAPI32.dll!ControlService 77DF4A09 6 Bytes JMP 5F130F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ADVAPI32.dll!OpenServiceA 77DF4C66 6 Bytes JMP 5F1F0F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ADVAPI32.dll!LsaAddAccountRights 77E1ABF1 6 Bytes JMP 5F2B0F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 5F2E0F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ADVAPI32.dll!ChangeServiceConfigA 77E36E69 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ADVAPI32.dll!ChangeServiceConfigW 77E37001 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ADVAPI32.dll!ChangeServiceConfig2A 77E37101 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ADVAPI32.dll!ChangeServiceConfig2W 77E37189 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ADVAPI32.dll!ChangeServiceConfig2W + 4 77E3718D 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F160F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F190F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ADVAPI32.dll!DeleteService 77E374B1 6 Bytes JMP 5F1C0F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] USER32.dll!DispatchMessageW 7E418A01 6 Bytes JMP 5FA90F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] USER32.dll!TranslateMessage 7E418BF6 6 Bytes JMP 5F940F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] USER32.dll!DispatchMessageA 7E4196B8 6 Bytes JMP 5F910F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] USER32.dll!CreateAcceleratorTableW 7E41D9BB 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] USER32.dll!CreateAcceleratorTableW + 4 7E41D9BF 2 Bytes [A4, 5F] {MOVSB ; POP EDI}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 5FA60F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 5FA00F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 5F970F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] USER32.dll!BeginDeferWindowPos 7E42AFB9 6 Bytes JMP 5F8E0F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [9E, 5F] {SAHF ; POP EDI}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 5F8B0F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] USER32.dll!AttachThreadInput 7E431E52 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] USER32.dll!AttachThreadInput + 4 7E431E56 2 Bytes [9B, 5F] {WAIT ; POP EDI}
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ole32.dll!CoCreateInstanceEx 77500526 6 Bytes JMP 5F880F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ole32.dll!CoGetClassObject 775156C5 6 Bytes JMP 5F850F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ole32.dll!CLSIDFromProgID 775187F2 6 Bytes JMP 5F820F5A
.text C:\WINDOWS\System32\DLA\DLACTRLW.EXE[1072] ole32.dll!CLSIDFromProgIDEx 7755620D 6 Bytes JMP 5F7F0F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtClose 7C90CFEE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtClose + 4 7C90CFF2 2 Bytes [4D, 5F] {DEC EBP; POP EDI}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtCreateFile 7C90D0AE 1 Byte [FF]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtCreateFile 7C90D0AE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtCreateFile + 4 7C90D0B2 2 Bytes [6E, 5F] {OUTSB ; POP EDI}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [50, 5F] {PUSH EAX; POP EDI}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtDeleteFile 7C90D23E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtDeleteFile + 4 7C90D242 2 Bytes [71, 5F] {JNO 0x61}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtDeleteKey 7C90D24E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtDeleteKey + 4 7C90D252 2 Bytes [53, 5F] {PUSH EBX; POP EDI}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtDeleteValueKey 7C90D26E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtDeleteValueKey + 4 7C90D272 2 Bytes [56, 5F] {PUSH ESI; POP EDI}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtDuplicateObject 7C90D29E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtDuplicateObject + 4 7C90D2A2 2 Bytes [59, 5F] {POP ECX; POP EDI}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtEnumerateKey 7C90D2CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtEnumerateKey + 4 7C90D2D2 2 Bytes [5C, 5F] {POP ESP; POP EDI}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtEnumerateValueKey 7C90D2EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtEnumerateValueKey + 4 7C90D2F2 2 Bytes [5F, 5F] {POP EDI; POP EDI}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtOpenFile 7C90D59E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtOpenFile + 4 7C90D5A2 2 Bytes [74, 5F] {JZ 0x61}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtQueryMultipleValueKey 7C90D86E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtQueryMultipleValueKey + 4 7C90D872 2 Bytes [62, 5F]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtQueryValueKey 7C90D96E 3 Bytes [FF, 25, 1E]

.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtQueryValueKey + 4 7C90D972 2 Bytes [65, 5F]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtReadFile 7C90D9CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtReadFile + 4 7C90D9D2 2 Bytes [77, 5F] {JA 0x61}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtSetInformationFile 7C90DC5E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtSetInformationFile + 4 7C90DC62 2 Bytes [7A, 5F] {JP 0x61}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [68, 5F]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtUnloadKey 7C90DECE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtUnloadKey + 4 7C90DED2 2 Bytes [6B, 5F]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtWriteFile 7C90DF7E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!NtWriteFile + 4 7C90DF82 2 Bytes [7D, 5F] {JGE 0x61}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!LdrLoadDll 7C9163C3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ntdll.dll!LdrLoadDll + 4 7C9163C7 2 Bytes [4A, 5F] {DEC EDX; POP EDI}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 5F310F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 5F370F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] kernel32.dll!CreateFileMappingW 7C80943C 6 Bytes JMP 5F3D0F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] kernel32.dll!MapViewOfFileEx 7C80B936 6 Bytes JMP 5F340F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [41, 5F] {INC ECX; POP EDI}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] kernel32.dll!CreateProcessInternalW 7C8197B0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] kernel32.dll!CreateProcessInternalW + 4 7C8197B4 2 Bytes [47, 5F] {INC EDI; POP EDI}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] kernel32.dll!MoveFileWithProgressW 7C81F72E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] kernel32.dll!MoveFileWithProgressW + 4 7C81F732 2 Bytes [44, 5F] {INC ESP; POP EDI}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 5F3A0F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ole32.dll!CoCreateInstanceEx 77500526 6 Bytes JMP 5F880F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ole32.dll!CoGetClassObject 775156C5 6 Bytes JMP 5F850F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ole32.dll!CLSIDFromProgID 775187F2 6 Bytes JMP 5F820F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ole32.dll!CLSIDFromProgIDEx 7755620D 6 Bytes JMP 5F7F0F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 6 Bytes JMP 5F100F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ADVAPI32.dll!OpenServiceW 77DE6FFD 6 Bytes JMP 5F220F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ADVAPI32.dll!StartServiceA 77DEFB58 6 Bytes JMP 5F250F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ADVAPI32.dll!StartServiceW 77DF3E94 6 Bytes JMP 5F280F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ADVAPI32.dll!ControlService 77DF4A09 6 Bytes JMP 5F130F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ADVAPI32.dll!OpenServiceA 77DF4C66 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ADVAPI32.dll!LsaAddAccountRights 77E1ABF1 6 Bytes JMP 5F2B0F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 5F2E0F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ADVAPI32.dll!ChangeServiceConfigA 77E36E69 6 Bytes JMP 5F040F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ADVAPI32.dll!ChangeServiceConfigW 77E37001 6 Bytes JMP 5F070F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ADVAPI32.dll!ChangeServiceConfig2A 77E37101 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ADVAPI32.dll!ChangeServiceConfig2W 77E37189 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ADVAPI32.dll!ChangeServiceConfig2W + 4 77E3718D 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F160F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F190F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] ADVAPI32.dll!DeleteService 77E374B1 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] USER32.dll!DispatchMessageW 7E418A01 6 Bytes JMP 5FA90F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] USER32.dll!TranslateMessage 7E418BF6 6 Bytes JMP 5F940F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] USER32.dll!DispatchMessageA 7E4196B8 6 Bytes JMP 5F910F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] USER32.dll!CreateAcceleratorTableW 7E41D9BB 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] USER32.dll!CreateAcceleratorTableW + 4 7E41D9BF 2 Bytes [A4, 5F] {MOVSB ; POP EDI}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 5FA60F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 5FA00F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 5F970F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] USER32.dll!BeginDeferWindowPos 7E42AFB9 6 Bytes JMP 5F8E0F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [9E, 5F] {SAHF ; POP EDI}
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 5F8B0F5A
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] USER32.dll!AttachThreadInput 7E431E52 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Real\RealPlayer\RealPlay.exe[1084] USER32.dll!AttachThreadInput + 4 7E431E56 2 Bytes [9B, 5F] {WAIT ; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtClose 7C90CFEE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtClose + 4 7C90CFF2 2 Bytes [4D, 5F] {DEC EBP; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtCreateFile 7C90D0AE 1 Byte [FF]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtCreateFile 7C90D0AE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtCreateFile + 4 7C90D0B2 2 Bytes [6E, 5F] {OUTSB ; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [50, 5F] {PUSH EAX; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtDeleteFile 7C90D23E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtDeleteFile + 4 7C90D242 2 Bytes [71, 5F] {JNO 0x61}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtDeleteKey 7C90D24E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtDeleteKey + 4 7C90D252 2 Bytes [53, 5F] {PUSH EBX; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtDeleteValueKey 7C90D26E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtDeleteValueKey + 4 7C90D272 2 Bytes [56, 5F] {PUSH ESI; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtDuplicateObject 7C90D29E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtDuplicateObject + 4 7C90D2A2 2 Bytes [59, 5F] {POP ECX; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtEnumerateKey 7C90D2CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtEnumerateKey + 4 7C90D2D2 2 Bytes [5C, 5F] {POP ESP; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtEnumerateValueKey 7C90D2EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtEnumerateValueKey + 4 7C90D2F2 2 Bytes [5F, 5F] {POP EDI; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtOpenFile 7C90D59E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtOpenFile + 4 7C90D5A2 2 Bytes [74, 5F] {JZ 0x61}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtQueryMultipleValueKey 7C90D86E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtQueryMultipleValueKey + 4 7C90D872 2 Bytes [62, 5F]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtQueryValueKey 7C90D96E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtQueryValueKey + 4 7C90D972 2 Bytes [65, 5F]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtReadFile 7C90D9CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtReadFile + 4 7C90D9D2 2 Bytes [77, 5F] {JA 0x61}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtSetInformationFile 7C90DC5E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtSetInformationFile + 4 7C90DC62 2 Bytes [7A, 5F] {JP 0x61}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [68, 5F]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtUnloadKey 7C90DECE 3 Bytes [FF, 25, 1E]

.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtUnloadKey + 4 7C90DED2 2 Bytes [6B, 5F]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtWriteFile 7C90DF7E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!NtWriteFile + 4 7C90DF82 2 Bytes [7D, 5F] {JGE 0x61}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!LdrLoadDll 7C9163C3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ntdll.dll!LdrLoadDll + 4 7C9163C7 2 Bytes [4A, 5F] {DEC EDX; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 5F310F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 5F370F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] kernel32.dll!CreateFileMappingW 7C80943C 6 Bytes JMP 5F3D0F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] kernel32.dll!MapViewOfFileEx 7C80B936 6 Bytes JMP 5F340F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [41, 5F] {INC ECX; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] kernel32.dll!CreateProcessInternalW 7C8197B0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] kernel32.dll!CreateProcessInternalW + 4 7C8197B4 2 Bytes [47, 5F] {INC EDI; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] kernel32.dll!MoveFileWithProgressW 7C81F72E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] kernel32.dll!MoveFileWithProgressW + 4 7C81F732 2 Bytes [44, 5F] {INC ESP; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 5F3A0F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] USER32.dll!DispatchMessageW 7E418A01 6 Bytes JMP 5FA90F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] USER32.dll!TranslateMessage 7E418BF6 6 Bytes JMP 5F940F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] USER32.dll!DispatchMessageA 7E4196B8 6 Bytes JMP 5F910F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] USER32.dll!CreateAcceleratorTableW 7E41D9BB 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] USER32.dll!CreateAcceleratorTableW + 4 7E41D9BF 2 Bytes [A4, 5F] {MOVSB ; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 5FA60F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 5FA00F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 5F970F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] USER32.dll!BeginDeferWindowPos 7E42AFB9 6 Bytes JMP 5F8E0F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [9E, 5F] {SAHF ; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 5F8B0F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] USER32.dll!AttachThreadInput 7E431E52 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] USER32.dll!AttachThreadInput + 4 7E431E56 2 Bytes [9B, 5F] {WAIT ; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 6 Bytes JMP 5F100F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ADVAPI32.dll!OpenServiceW 77DE6FFD 6 Bytes JMP 5F220F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ADVAPI32.dll!StartServiceA 77DEFB58 6 Bytes JMP 5F250F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ADVAPI32.dll!StartServiceW 77DF3E94 6 Bytes JMP 5F280F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ADVAPI32.dll!ControlService 77DF4A09 6 Bytes JMP 5F130F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ADVAPI32.dll!OpenServiceA 77DF4C66 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ADVAPI32.dll!LsaAddAccountRights 77E1ABF1 6 Bytes JMP 5F2B0F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 5F2E0F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ADVAPI32.dll!ChangeServiceConfigA 77E36E69 6 Bytes JMP 5F040F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ADVAPI32.dll!ChangeServiceConfigW 77E37001 6 Bytes JMP 5F070F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ADVAPI32.dll!ChangeServiceConfig2A 77E37101 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ADVAPI32.dll!ChangeServiceConfig2W 77E37189 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ADVAPI32.dll!ChangeServiceConfig2W + 4 77E3718D 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F160F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F190F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ADVAPI32.dll!DeleteService 77E374B1 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ole32.dll!CoCreateInstanceEx 77500526 6 Bytes JMP 5F880F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ole32.dll!CoGetClassObject 775156C5 6 Bytes JMP 5F850F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ole32.dll!CLSIDFromProgID 775187F2 6 Bytes JMP 5F820F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1088] ole32.dll!CLSIDFromProgIDEx 7755620D 6 Bytes JMP 5F7F0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtClose 7C90CFEE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtClose + 4 7C90CFF2 2 Bytes [4D, 5F] {DEC EBP; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtCreateFile 7C90D0AE 1 Byte [FF]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtCreateFile 7C90D0AE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtCreateFile + 4 7C90D0B2 2 Bytes [6E, 5F] {OUTSB ; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [50, 5F] {PUSH EAX; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtDeleteFile 7C90D23E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtDeleteFile + 4 7C90D242 2 Bytes [71, 5F] {JNO 0x61}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtDeleteKey 7C90D24E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtDeleteKey + 4 7C90D252 2 Bytes [53, 5F] {PUSH EBX; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtDeleteValueKey 7C90D26E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtDeleteValueKey + 4 7C90D272 2 Bytes [56, 5F] {PUSH ESI; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtDuplicateObject 7C90D29E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtDuplicateObject + 4 7C90D2A2 2 Bytes [59, 5F] {POP ECX; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtEnumerateKey 7C90D2CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtEnumerateKey + 4 7C90D2D2 2 Bytes [5C, 5F] {POP ESP; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtEnumerateValueKey 7C90D2EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtEnumerateValueKey + 4 7C90D2F2 2 Bytes [5F, 5F] {POP EDI; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtOpenFile 7C90D59E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtOpenFile + 4 7C90D5A2 2 Bytes [74, 5F] {JZ 0x61}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtQueryMultipleValueKey 7C90D86E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtQueryMultipleValueKey + 4 7C90D872 2 Bytes [62, 5F]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtQueryValueKey 7C90D96E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtQueryValueKey + 4 7C90D972 2 Bytes [65, 5F]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtReadFile 7C90D9CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtReadFile + 4 7C90D9D2 2 Bytes [77, 5F] {JA 0x61}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtSetInformationFile 7C90DC5E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtSetInformationFile + 4 7C90DC62 2 Bytes [7A, 5F] {JP 0x61}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [68, 5F]

.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtUnloadKey 7C90DECE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtUnloadKey + 4 7C90DED2 2 Bytes [6B, 5F]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtWriteFile 7C90DF7E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!NtWriteFile + 4 7C90DF82 2 Bytes [7D, 5F] {JGE 0x61}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!LdrLoadDll 7C9163C3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ntdll.dll!LdrLoadDll + 4 7C9163C7 2 Bytes [4A, 5F] {DEC EDX; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 5F310F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 5F370F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] kernel32.dll!CreateFileMappingW 7C80943C 6 Bytes JMP 5F3D0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] kernel32.dll!MapViewOfFileEx 7C80B936 6 Bytes JMP 5F340F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [41, 5F] {INC ECX; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] kernel32.dll!CreateProcessInternalW 7C8197B0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] kernel32.dll!CreateProcessInternalW + 4 7C8197B4 2 Bytes [47, 5F] {INC EDI; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] kernel32.dll!MoveFileWithProgressW 7C81F72E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] kernel32.dll!MoveFileWithProgressW + 4 7C81F732 2 Bytes [44, 5F] {INC ESP; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 5F3A0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 6 Bytes JMP 5F100F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ADVAPI32.dll!OpenServiceW 77DE6FFD 6 Bytes JMP 5F220F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ADVAPI32.dll!StartServiceA 77DEFB58 6 Bytes JMP 5F250F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ADVAPI32.dll!StartServiceW 77DF3E94 6 Bytes JMP 5F280F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ADVAPI32.dll!ControlService 77DF4A09 6 Bytes JMP 5F130F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ADVAPI32.dll!OpenServiceA 77DF4C66 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ADVAPI32.dll!LsaAddAccountRights 77E1ABF1 6 Bytes JMP 5F2B0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 5F2E0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ADVAPI32.dll!ChangeServiceConfigA 77E36E69 6 Bytes JMP 5F040F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ADVAPI32.dll!ChangeServiceConfigW 77E37001 6 Bytes JMP 5F070F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ADVAPI32.dll!ChangeServiceConfig2A 77E37101 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ADVAPI32.dll!ChangeServiceConfig2W 77E37189 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ADVAPI32.dll!ChangeServiceConfig2W + 4 77E3718D 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F160F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F190F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ADVAPI32.dll!DeleteService 77E374B1 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] USER32.dll!DispatchMessageW 7E418A01 6 Bytes JMP 5FA90F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] USER32.dll!TranslateMessage 7E418BF6 6 Bytes JMP 5F940F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] USER32.dll!DispatchMessageA 7E4196B8 6 Bytes JMP 5F910F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] USER32.dll!CreateAcceleratorTableW 7E41D9BB 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] USER32.dll!CreateAcceleratorTableW + 4 7E41D9BF 2 Bytes [A4, 5F] {MOVSB ; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 5FA60F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 5FA00F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 5F970F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] USER32.dll!BeginDeferWindowPos 7E42AFB9 6 Bytes JMP 5F8E0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [9E, 5F] {SAHF ; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 5F8B0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] USER32.dll!AttachThreadInput 7E431E52 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] USER32.dll!AttachThreadInput + 4 7E431E56 2 Bytes [9B, 5F] {WAIT ; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ole32.dll!CoCreateInstanceEx 77500526 6 Bytes JMP 5F880F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ole32.dll!CoGetClassObject 775156C5 6 Bytes JMP 5F850F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ole32.dll!CLSIDFromProgID 775187F2 6 Bytes JMP 5F820F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[1300] ole32.dll!CLSIDFromProgIDEx 7755620D 6 Bytes JMP 5F7F0F5A
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1636] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 05052422 C:\Program Files\Google\Google Desktop Search\GoogleServices.DLL (Google Desktop/Google)
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1636] USER32.dll!MessageBoxA 7E4507EA 5 Bytes JMP 050523CC C:\Program Files\Google\Google Desktop Search\GoogleServices.DLL (Google Desktop/Google)
.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[1636] USER32.dll!MessageBoxW 7E466534 5 Bytes JMP 050523F7 C:\Program Files\Google\Google Desktop Search\GoogleServices.DLL (Google Desktop/Google)
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtClose 7C90CFEE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtClose + 4 7C90CFF2 2 Bytes [4D, 5F] {DEC EBP; POP EDI}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtCreateFile 7C90D0AE 1 Byte [FF]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtCreateFile 7C90D0AE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtCreateFile + 4 7C90D0B2 2 Bytes [6E, 5F] {OUTSB ; POP EDI}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [50, 5F] {PUSH EAX; POP EDI}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtDeleteFile 7C90D23E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtDeleteFile + 4 7C90D242 2 Bytes [71, 5F] {JNO 0x61}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtDeleteKey 7C90D24E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtDeleteKey + 4 7C90D252 2 Bytes [53, 5F] {PUSH EBX; POP EDI}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtDeleteValueKey 7C90D26E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtDeleteValueKey + 4 7C90D272 2 Bytes [56, 5F] {PUSH ESI; POP EDI}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtDuplicateObject 7C90D29E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtDuplicateObject + 4 7C90D2A2 2 Bytes [59, 5F] {POP ECX; POP EDI}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtEnumerateKey 7C90D2CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtEnumerateKey + 4 7C90D2D2 2 Bytes [5C, 5F] {POP ESP; POP EDI}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtEnumerateValueKey 7C90D2EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtEnumerateValueKey + 4 7C90D2F2 2 Bytes [5F, 5F] {POP EDI; POP EDI}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtOpenFile 7C90D59E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtOpenFile + 4 7C90D5A2 2 Bytes [74, 5F] {JZ 0x61}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtQueryMultipleValueKey 7C90D86E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtQueryMultipleValueKey + 4 7C90D872 2 Bytes [62, 5F]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtQueryValueKey 7C90D96E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtQueryValueKey + 4 7C90D972 2 Bytes [65, 5F]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtReadFile 7C90D9CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtReadFile + 4 7C90D9D2 2 Bytes [77, 5F] {JA 0x61}

.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtSetInformationFile 7C90DC5E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtSetInformationFile + 4 7C90DC62 2 Bytes [7A, 5F] {JP 0x61}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [68, 5F]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtUnloadKey 7C90DECE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtUnloadKey + 4 7C90DED2 2 Bytes [6B, 5F]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtWriteFile 7C90DF7E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!NtWriteFile + 4 7C90DF82 2 Bytes [7D, 5F] {JGE 0x61}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!LdrLoadDll 7C9163C3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ntdll.dll!LdrLoadDll + 4 7C9163C7 2 Bytes [4A, 5F] {DEC EDX; POP EDI}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 5F310F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 5F370F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] kernel32.dll!CreateFileMappingW 7C80943C 6 Bytes JMP 5F3D0F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] kernel32.dll!MapViewOfFileEx 7C80B936 6 Bytes JMP 5F340F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [41, 5F] {INC ECX; POP EDI}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] kernel32.dll!CreateProcessInternalW 7C8197B0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] kernel32.dll!CreateProcessInternalW + 4 7C8197B4 2 Bytes [47, 5F] {INC EDI; POP EDI}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] kernel32.dll!MoveFileWithProgressW 7C81F72E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] kernel32.dll!MoveFileWithProgressW + 4 7C81F732 2 Bytes [44, 5F] {INC ESP; POP EDI}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 5F3A0F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ole32.dll!CoCreateInstanceEx 77500526 6 Bytes JMP 5F880F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ole32.dll!CoGetClassObject 775156C5 6 Bytes JMP 5F850F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ole32.dll!CLSIDFromProgID 775187F2 6 Bytes JMP 5F820F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ole32.dll!CLSIDFromProgIDEx 7755620D 6 Bytes JMP 5F7F0F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 6 Bytes JMP 5F100F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ADVAPI32.dll!OpenServiceW 77DE6FFD 6 Bytes JMP 5F220F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ADVAPI32.dll!StartServiceA 77DEFB58 6 Bytes JMP 5F250F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ADVAPI32.dll!StartServiceW 77DF3E94 6 Bytes JMP 5F280F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ADVAPI32.dll!ControlService 77DF4A09 6 Bytes JMP 5F130F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ADVAPI32.dll!OpenServiceA 77DF4C66 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ADVAPI32.dll!LsaAddAccountRights 77E1ABF1 6 Bytes JMP 5F2B0F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 5F2E0F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ADVAPI32.dll!ChangeServiceConfigA 77E36E69 6 Bytes JMP 5F040F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ADVAPI32.dll!ChangeServiceConfigW 77E37001 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ADVAPI32.dll!ChangeServiceConfig2A 77E37101 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ADVAPI32.dll!ChangeServiceConfig2W 77E37189 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ADVAPI32.dll!ChangeServiceConfig2W + 4 77E3718D 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F160F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F190F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] ADVAPI32.dll!DeleteService 77E374B1 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] USER32.dll!DispatchMessageW 7E418A01 6 Bytes JMP 5FA90F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] USER32.dll!TranslateMessage 7E418BF6 6 Bytes JMP 5F940F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] USER32.dll!DispatchMessageA 7E4196B8 6 Bytes JMP 5F910F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] USER32.dll!CreateAcceleratorTableW 7E41D9BB 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] USER32.dll!CreateAcceleratorTableW + 4 7E41D9BF 2 Bytes [A4, 5F] {MOVSB ; POP EDI}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 5FA60F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 5FA00F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 5F970F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] USER32.dll!BeginDeferWindowPos 7E42AFB9 6 Bytes JMP 5F8E0F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [9E, 5F] {SAHF ; POP EDI}
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 5F8B0F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] USER32.dll!AttachThreadInput 7E431E52 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2148] USER32.dll!AttachThreadInput + 4 7E431E56 2 Bytes [9B, 5F] {WAIT ; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtClose 7C90CFEE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtClose + 4 7C90CFF2 2 Bytes [4D, 5F] {DEC EBP; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtCreateFile 7C90D0AE 1 Byte [FF]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtCreateFile 7C90D0AE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtCreateFile + 4 7C90D0B2 2 Bytes [6E, 5F] {OUTSB ; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [50, 5F] {PUSH EAX; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtDeleteFile 7C90D23E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtDeleteFile + 4 7C90D242 2 Bytes [71, 5F] {JNO 0x61}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtDeleteKey 7C90D24E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtDeleteKey + 4 7C90D252 2 Bytes [53, 5F] {PUSH EBX; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtDeleteValueKey 7C90D26E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtDeleteValueKey + 4 7C90D272 2 Bytes [56, 5F] {PUSH ESI; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtDuplicateObject 7C90D29E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtDuplicateObject + 4 7C90D2A2 2 Bytes [59, 5F] {POP ECX; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtEnumerateKey 7C90D2CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtEnumerateKey + 4 7C90D2D2 2 Bytes [5C, 5F] {POP ESP; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtEnumerateValueKey 7C90D2EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtEnumerateValueKey + 4 7C90D2F2 2 Bytes [5F, 5F] {POP EDI; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtOpenFile 7C90D59E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtOpenFile + 4 7C90D5A2 2 Bytes [74, 5F] {JZ 0x61}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtQueryMultipleValueKey 7C90D86E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtQueryMultipleValueKey + 4 7C90D872 2 Bytes [62, 5F]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtQueryValueKey 7C90D96E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtQueryValueKey + 4 7C90D972 2 Bytes [65, 5F]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtReadFile 7C90D9CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtReadFile + 4 7C90D9D2 2 Bytes [77, 5F] {JA 0x61}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtSetInformationFile 7C90DC5E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtSetInformationFile + 4 7C90DC62 2 Bytes [7A, 5F] {JP 0x61}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [68, 5F]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtUnloadKey 7C90DECE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtUnloadKey + 4 7C90DED2 2 Bytes [6B, 5F]

.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtWriteFile 7C90DF7E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!NtWriteFile + 4 7C90DF82 2 Bytes [7D, 5F] {JGE 0x61}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!LdrLoadDll 7C9163C3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ntdll.dll!LdrLoadDll + 4 7C9163C7 2 Bytes [4A, 5F] {DEC EDX; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 5F310F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 5F370F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] kernel32.dll!CreateFileMappingW 7C80943C 6 Bytes JMP 5F3D0F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] kernel32.dll!MapViewOfFileEx 7C80B936 6 Bytes JMP 5F340F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [41, 5F] {INC ECX; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] kernel32.dll!CreateProcessInternalW 7C8197B0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] kernel32.dll!CreateProcessInternalW + 4 7C8197B4 2 Bytes [47, 5F] {INC EDI; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] kernel32.dll!MoveFileWithProgressW 7C81F72E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] kernel32.dll!MoveFileWithProgressW + 4 7C81F732 2 Bytes [44, 5F] {INC ESP; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 5F3A0F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] USER32.dll!DispatchMessageW 7E418A01 6 Bytes JMP 5FA90F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] USER32.dll!TranslateMessage 7E418BF6 6 Bytes JMP 5F940F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] USER32.dll!DispatchMessageA 7E4196B8 6 Bytes JMP 5F910F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] USER32.dll!CreateAcceleratorTableW 7E41D9BB 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] USER32.dll!CreateAcceleratorTableW + 4 7E41D9BF 2 Bytes [A4, 5F] {MOVSB ; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 5FA60F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 5FA00F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 5F970F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] USER32.dll!BeginDeferWindowPos 7E42AFB9 6 Bytes JMP 5F8E0F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [9E, 5F] {SAHF ; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 5F8B0F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] USER32.dll!AttachThreadInput 7E431E52 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] USER32.dll!AttachThreadInput + 4 7E431E56 2 Bytes [9B, 5F] {WAIT ; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 6 Bytes JMP 5F100F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ADVAPI32.dll!OpenServiceW 77DE6FFD 6 Bytes JMP 5F220F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ADVAPI32.dll!StartServiceA 77DEFB58 6 Bytes JMP 5F250F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ADVAPI32.dll!StartServiceW 77DF3E94 6 Bytes JMP 5F280F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ADVAPI32.dll!ControlService 77DF4A09 6 Bytes JMP 5F130F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ADVAPI32.dll!OpenServiceA 77DF4C66 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ADVAPI32.dll!LsaAddAccountRights 77E1ABF1 6 Bytes JMP 5F2B0F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 5F2E0F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ADVAPI32.dll!ChangeServiceConfigA 77E36E69 6 Bytes JMP 5F040F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ADVAPI32.dll!ChangeServiceConfigW 77E37001 6 Bytes JMP 5F070F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ADVAPI32.dll!ChangeServiceConfig2A 77E37101 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ADVAPI32.dll!ChangeServiceConfig2W 77E37189 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ADVAPI32.dll!ChangeServiceConfig2W + 4 77E3718D 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F160F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F190F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ADVAPI32.dll!DeleteService 77E374B1 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ole32.dll!CoCreateInstanceEx 77500526 6 Bytes JMP 5F880F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ole32.dll!CoGetClassObject 775156C5 6 Bytes JMP 5F850F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ole32.dll!CLSIDFromProgID 775187F2 6 Bytes JMP 5F820F5A
.text C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe[2216] ole32.dll!CLSIDFromProgIDEx 7755620D 6 Bytes JMP 5F7F0F5A
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtClose 7C90CFEE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtClose + 4 7C90CFF2 2 Bytes [4D, 5F] {DEC EBP; POP EDI}
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtCreateFile 7C90D0AE 1 Byte [FF]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtCreateFile 7C90D0AE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtCreateFile + 4 7C90D0B2 2 Bytes [6E, 5F] {OUTSB ; POP EDI}
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [50, 5F] {PUSH EAX; POP EDI}
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtDeleteFile 7C90D23E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtDeleteFile + 4 7C90D242 2 Bytes [71, 5F] {JNO 0x61}
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtDeleteKey 7C90D24E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtDeleteKey + 4 7C90D252 2 Bytes [53, 5F] {PUSH EBX; POP EDI}
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtDeleteValueKey 7C90D26E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtDeleteValueKey + 4 7C90D272 2 Bytes [56, 5F] {PUSH ESI; POP EDI}
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtDuplicateObject 7C90D29E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtDuplicateObject + 4 7C90D2A2 2 Bytes [59, 5F] {POP ECX; POP EDI}
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtEnumerateKey 7C90D2CE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtEnumerateKey + 4 7C90D2D2 2 Bytes [5C, 5F] {POP ESP; POP EDI}
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtEnumerateValueKey 7C90D2EE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtEnumerateValueKey + 4 7C90D2F2 2 Bytes [5F, 5F] {POP EDI; POP EDI}
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtOpenFile 7C90D59E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtOpenFile + 4 7C90D5A2 2 Bytes [74, 5F] {JZ 0x61}
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtQueryMultipleValueKey 7C90D86E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtQueryMultipleValueKey + 4 7C90D872 2 Bytes [62, 5F]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtQueryValueKey 7C90D96E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtQueryValueKey + 4 7C90D972 2 Bytes [65, 5F]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtReadFile 7C90D9CE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtReadFile + 4 7C90D9D2 2 Bytes [77, 5F] {JA 0x61}
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtSetInformationFile 7C90DC5E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtSetInformationFile + 4 7C90DC62 2 Bytes [7A, 5F] {JP 0x61}
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [68, 5F]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtUnloadKey 7C90DECE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtUnloadKey + 4 7C90DED2 2 Bytes [6B, 5F]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtWriteFile 7C90DF7E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!NtWriteFile + 4 7C90DF82 2 Bytes [7D, 5F] {JGE 0x61}
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!LdrLoadDll 7C9163C3 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] ntdll.dll!LdrLoadDll + 4 7C9163C7 2 Bytes [4A, 5F] {DEC EDX; POP EDI}
.text C:\WINDOWS\Explorer.EXE[2372] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 5F310F5A
.text C:\WINDOWS\Explorer.EXE[2372] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 5F370F5A

.text C:\WINDOWS\Explorer.EXE[2372] kernel32.dll!CreateFileMappingW 7C80943C 6 Bytes JMP 5F3D0F5A
.text C:\WINDOWS\Explorer.EXE[2372] kernel32.dll!MapViewOfFileEx 7C80B936 6 Bytes JMP 5F340F5A
.text C:\WINDOWS\Explorer.EXE[2372] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [41, 5F] {INC ECX; POP EDI}
.text C:\WINDOWS\Explorer.EXE[2372] kernel32.dll!CreateProcessInternalW 7C8197B0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] kernel32.dll!CreateProcessInternalW + 4 7C8197B4 2 Bytes [47, 5F] {INC EDI; POP EDI}
.text C:\WINDOWS\Explorer.EXE[2372] kernel32.dll!MoveFileWithProgressW 7C81F72E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] kernel32.dll!MoveFileWithProgressW + 4 7C81F732 2 Bytes [44, 5F] {INC ESP; POP EDI}
.text C:\WINDOWS\Explorer.EXE[2372] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 5F3A0F5A
.text C:\WINDOWS\Explorer.EXE[2372] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\Explorer.EXE[2372] ADVAPI32.dll!OpenServiceW 77DE6FFD 6 Bytes JMP 5F220F5A
.text C:\WINDOWS\Explorer.EXE[2372] ADVAPI32.dll!StartServiceA 77DEFB58 6 Bytes JMP 5F250F5A
.text C:\WINDOWS\Explorer.EXE[2372] ADVAPI32.dll!StartServiceW 77DF3E94 6 Bytes JMP 5F280F5A
.text C:\WINDOWS\Explorer.EXE[2372] ADVAPI32.dll!ControlService 77DF4A09 6 Bytes JMP 5F130F5A
.text C:\WINDOWS\Explorer.EXE[2372] ADVAPI32.dll!OpenServiceA 77DF4C66 6 Bytes JMP 5F1F0F5A
.text C:\WINDOWS\Explorer.EXE[2372] ADVAPI32.dll!LsaAddAccountRights 77E1ABF1 6 Bytes JMP 5F2B0F5A
.text C:\WINDOWS\Explorer.EXE[2372] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 5F2E0F5A
.text C:\WINDOWS\Explorer.EXE[2372] ADVAPI32.dll!ChangeServiceConfigA 77E36E69 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\Explorer.EXE[2372] ADVAPI32.dll!ChangeServiceConfigW 77E37001 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\Explorer.EXE[2372] ADVAPI32.dll!ChangeServiceConfig2A 77E37101 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\Explorer.EXE[2372] ADVAPI32.dll!ChangeServiceConfig2W 77E37189 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] ADVAPI32.dll!ChangeServiceConfig2W + 4 77E3718D 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\Explorer.EXE[2372] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F160F5A
.text C:\WINDOWS\Explorer.EXE[2372] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F190F5A
.text C:\WINDOWS\Explorer.EXE[2372] ADVAPI32.dll!DeleteService 77E374B1 6 Bytes JMP 5F1C0F5A
.text C:\WINDOWS\Explorer.EXE[2372] USER32.dll!DispatchMessageW 7E418A01 6 Bytes JMP 5FA30F5A
.text C:\WINDOWS\Explorer.EXE[2372] USER32.dll!TranslateMessage 7E418BF6 6 Bytes JMP 5F8E0F5A
.text C:\WINDOWS\Explorer.EXE[2372] USER32.dll!DispatchMessageA 7E4196B8 6 Bytes JMP 5F8B0F5A
.text C:\WINDOWS\Explorer.EXE[2372] USER32.dll!CreateAcceleratorTableW 7E41D9BB 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] USER32.dll!CreateAcceleratorTableW + 4 7E41D9BF 2 Bytes [9E, 5F] {SAHF ; POP EDI}
.text C:\WINDOWS\Explorer.EXE[2372] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 5FA00F5A
.text C:\WINDOWS\Explorer.EXE[2372] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 5F9A0F5A
.text C:\WINDOWS\Explorer.EXE[2372] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 5F910F5A
.text C:\WINDOWS\Explorer.EXE[2372] USER32.dll!BeginDeferWindowPos 7E42AFB9 6 Bytes JMP 5F880F5A
.text C:\WINDOWS\Explorer.EXE[2372] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [98, 5F] {CWDE ; POP EDI}
.text C:\WINDOWS\Explorer.EXE[2372] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 5F850F5A
.text C:\WINDOWS\Explorer.EXE[2372] USER32.dll!AttachThreadInput 7E431E52 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2372] USER32.dll!AttachThreadInput + 4 7E431E56 2 Bytes [95, 5F] {XCHG EBP, EAX; POP EDI}
.text C:\WINDOWS\Explorer.EXE[2372] ole32.dll!CLSIDFromProgID 775187F2 6 Bytes JMP 5F820F5A
.text C:\WINDOWS\Explorer.EXE[2372] ole32.dll!CLSIDFromProgIDEx 7755620D 6 Bytes JMP 5F7F0F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtClose 7C90CFEE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtClose + 4 7C90CFF2 2 Bytes [4D, 5F] {DEC EBP; POP EDI}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtCreateFile 7C90D0AE 1 Byte [FF]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtCreateFile 7C90D0AE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtCreateFile + 4 7C90D0B2 2 Bytes [6E, 5F] {OUTSB ; POP EDI}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [50, 5F] {PUSH EAX; POP EDI}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtDeleteFile 7C90D23E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtDeleteFile + 4 7C90D242 2 Bytes [71, 5F] {JNO 0x61}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtDeleteKey 7C90D24E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtDeleteKey + 4 7C90D252 2 Bytes [53, 5F] {PUSH EBX; POP EDI}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtDeleteValueKey 7C90D26E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtDeleteValueKey + 4 7C90D272 2 Bytes [56, 5F] {PUSH ESI; POP EDI}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtDuplicateObject 7C90D29E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtDuplicateObject + 4 7C90D2A2 2 Bytes [59, 5F] {POP ECX; POP EDI}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtEnumerateKey 7C90D2CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtEnumerateKey + 4 7C90D2D2 2 Bytes [5C, 5F] {POP ESP; POP EDI}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtEnumerateValueKey 7C90D2EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtEnumerateValueKey + 4 7C90D2F2 2 Bytes [5F, 5F] {POP EDI; POP EDI}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtOpenFile 7C90D59E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtOpenFile + 4 7C90D5A2 2 Bytes [74, 5F] {JZ 0x61}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtQueryMultipleValueKey 7C90D86E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtQueryMultipleValueKey + 4 7C90D872 2 Bytes [62, 5F]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtQueryValueKey 7C90D96E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtQueryValueKey + 4 7C90D972 2 Bytes [65, 5F]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtReadFile 7C90D9CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtReadFile + 4 7C90D9D2 2 Bytes [77, 5F] {JA 0x61}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtSetInformationFile 7C90DC5E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtSetInformationFile + 4 7C90DC62 2 Bytes [7A, 5F] {JP 0x61}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [68, 5F]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtUnloadKey 7C90DECE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtUnloadKey + 4 7C90DED2 2 Bytes [6B, 5F]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtWriteFile 7C90DF7E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!NtWriteFile + 4 7C90DF82 2 Bytes [7D, 5F] {JGE 0x61}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!LdrLoadDll 7C9163C3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ntdll.dll!LdrLoadDll + 4 7C9163C7 2 Bytes [4A, 5F] {DEC EDX; POP EDI}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 5F310F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 5F370F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] kernel32.dll!CreateFileMappingW 7C80943C 6 Bytes JMP 5F3D0F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] kernel32.dll!MapViewOfFileEx 7C80B936 6 Bytes JMP 5F340F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [41, 5F] {INC ECX; POP EDI}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] kernel32.dll!CreateProcessInternalW 7C8197B0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] kernel32.dll!CreateProcessInternalW + 4 7C8197B4 2 Bytes [47, 5F] {INC EDI; POP EDI}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] kernel32.dll!MoveFileWithProgressW 7C81F72E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] kernel32.dll!MoveFileWithProgressW + 4 7C81F732 2 Bytes [44, 5F] {INC ESP; POP EDI}

.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 5F3A0F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] USER32.dll!DispatchMessageW 7E418A01 6 Bytes JMP 5FA90F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] USER32.dll!TranslateMessage 7E418BF6 6 Bytes JMP 5F940F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] USER32.dll!DispatchMessageA 7E4196B8 6 Bytes JMP 5F910F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] USER32.dll!CreateAcceleratorTableW 7E41D9BB 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] USER32.dll!CreateAcceleratorTableW + 4 7E41D9BF 2 Bytes [A4, 5F] {MOVSB ; POP EDI}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 5FA60F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 5FA00F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 5F970F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] USER32.dll!BeginDeferWindowPos 7E42AFB9 6 Bytes JMP 5F8E0F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [9E, 5F] {SAHF ; POP EDI}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 5F8B0F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] USER32.dll!AttachThreadInput 7E431E52 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] USER32.dll!AttachThreadInput + 4 7E431E56 2 Bytes [9B, 5F] {WAIT ; POP EDI}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 6 Bytes JMP 5F100F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ADVAPI32.dll!OpenServiceW 77DE6FFD 6 Bytes JMP 5F220F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ADVAPI32.dll!StartServiceA 77DEFB58 6 Bytes JMP 5F250F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ADVAPI32.dll!StartServiceW 77DF3E94 6 Bytes JMP 5F280F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ADVAPI32.dll!ControlService 77DF4A09 6 Bytes JMP 5F130F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ADVAPI32.dll!OpenServiceA 77DF4C66 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ADVAPI32.dll!LsaAddAccountRights 77E1ABF1 6 Bytes JMP 5F2B0F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 5F2E0F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ADVAPI32.dll!ChangeServiceConfigA 77E36E69 6 Bytes JMP 5F040F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ADVAPI32.dll!ChangeServiceConfigW 77E37001 6 Bytes JMP 5F070F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ADVAPI32.dll!ChangeServiceConfig2A 77E37101 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ADVAPI32.dll!ChangeServiceConfig2W 77E37189 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ADVAPI32.dll!ChangeServiceConfig2W + 4 77E3718D 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F160F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F190F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ADVAPI32.dll!DeleteService 77E374B1 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ole32.dll!CoCreateInstanceEx 77500526 6 Bytes JMP 5F880F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ole32.dll!CoGetClassObject 775156C5 6 Bytes JMP 5F850F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ole32.dll!CLSIDFromProgID 775187F2 6 Bytes JMP 5F820F5A
.text C:\Program Files\Dell\Media Experience\DMXLauncher.exe[2536] ole32.dll!CLSIDFromProgIDEx 7755620D 6 Bytes JMP 5F7F0F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtClose 7C90CFEE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtClose + 4 7C90CFF2 2 Bytes [4D, 5F] {DEC EBP; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtCreateFile 7C90D0AE 1 Byte [FF]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtCreateFile 7C90D0AE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtCreateFile + 4 7C90D0B2 2 Bytes [6E, 5F] {OUTSB ; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [50, 5F] {PUSH EAX; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtDeleteFile 7C90D23E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtDeleteFile + 4 7C90D242 2 Bytes [71, 5F] {JNO 0x61}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtDeleteKey 7C90D24E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtDeleteKey + 4 7C90D252 2 Bytes [53, 5F] {PUSH EBX; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtDeleteValueKey 7C90D26E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtDeleteValueKey + 4 7C90D272 2 Bytes [56, 5F] {PUSH ESI; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtDuplicateObject 7C90D29E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtDuplicateObject + 4 7C90D2A2 2 Bytes [59, 5F] {POP ECX; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtEnumerateKey 7C90D2CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtEnumerateKey + 4 7C90D2D2 2 Bytes [5C, 5F] {POP ESP; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtEnumerateValueKey 7C90D2EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtEnumerateValueKey + 4 7C90D2F2 2 Bytes [5F, 5F] {POP EDI; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtOpenFile 7C90D59E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtOpenFile + 4 7C90D5A2 2 Bytes [74, 5F] {JZ 0x61}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtQueryMultipleValueKey 7C90D86E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtQueryMultipleValueKey + 4 7C90D872 2 Bytes [62, 5F]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtQueryValueKey 7C90D96E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtQueryValueKey + 4 7C90D972 2 Bytes [65, 5F]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtReadFile 7C90D9CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtReadFile + 4 7C90D9D2 2 Bytes [77, 5F] {JA 0x61}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtSetInformationFile 7C90DC5E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtSetInformationFile + 4 7C90DC62 2 Bytes [7A, 5F] {JP 0x61}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [68, 5F]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtUnloadKey 7C90DECE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtUnloadKey + 4 7C90DED2 2 Bytes [6B, 5F]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtWriteFile 7C90DF7E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!NtWriteFile + 4 7C90DF82 2 Bytes [7D, 5F] {JGE 0x61}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!LdrLoadDll 7C9163C3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ntdll.dll!LdrLoadDll + 4 7C9163C7 2 Bytes [4A, 5F] {DEC EDX; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 5F310F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 5F370F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] kernel32.dll!CreateFileMappingW 7C80943C 6 Bytes JMP 5F3D0F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] kernel32.dll!MapViewOfFileEx 7C80B936 6 Bytes JMP 5F340F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [41, 5F] {INC ECX; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] kernel32.dll!CreateProcessInternalW 7C8197B0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] kernel32.dll!CreateProcessInternalW + 4 7C8197B4 2 Bytes [47, 5F] {INC EDI; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] kernel32.dll!MoveFileWithProgressW 7C81F72E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] kernel32.dll!MoveFileWithProgressW + 4 7C81F732 2 Bytes [44, 5F] {INC ESP; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 5F3A0F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 6 Bytes JMP 5F100F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ADVAPI32.dll!OpenServiceW 77DE6FFD 6 Bytes JMP 5F220F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ADVAPI32.dll!StartServiceA 77DEFB58 6 Bytes JMP 5F250F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ADVAPI32.dll!StartServiceW 77DF3E94 6 Bytes JMP 5F280F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ADVAPI32.dll!ControlService 77DF4A09 6 Bytes JMP 5F130F5A

.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ADVAPI32.dll!OpenServiceA 77DF4C66 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ADVAPI32.dll!LsaAddAccountRights 77E1ABF1 6 Bytes JMP 5F2B0F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 5F2E0F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ADVAPI32.dll!ChangeServiceConfigA 77E36E69 6 Bytes JMP 5F040F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ADVAPI32.dll!ChangeServiceConfigW 77E37001 6 Bytes JMP 5F070F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ADVAPI32.dll!ChangeServiceConfig2A 77E37101 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ADVAPI32.dll!ChangeServiceConfig2W 77E37189 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ADVAPI32.dll!ChangeServiceConfig2W + 4 77E3718D 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F160F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F190F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ADVAPI32.dll!DeleteService 77E374B1 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] USER32.dll!DispatchMessageW 7E418A01 6 Bytes JMP 5FA90F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] USER32.dll!TranslateMessage 7E418BF6 6 Bytes JMP 5F940F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] USER32.dll!DispatchMessageA 7E4196B8 6 Bytes JMP 5F910F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] USER32.dll!CreateAcceleratorTableW 7E41D9BB 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] USER32.dll!CreateAcceleratorTableW + 4 7E41D9BF 2 Bytes [A4, 5F] {MOVSB ; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 5FA60F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 5FA00F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 5F970F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] USER32.dll!BeginDeferWindowPos 7E42AFB9 6 Bytes JMP 5F8E0F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [9E, 5F] {SAHF ; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 5F8B0F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] USER32.dll!AttachThreadInput 7E431E52 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] USER32.dll!AttachThreadInput + 4 7E431E56 2 Bytes [9B, 5F] {WAIT ; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ole32.dll!CoCreateInstanceEx 77500526 6 Bytes JMP 5F880F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ole32.dll!CoGetClassObject 775156C5 6 Bytes JMP 5F850F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ole32.dll!CLSIDFromProgID 775187F2 6 Bytes JMP 5F820F5A
.text C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe[2764] ole32.dll!CLSIDFromProgIDEx 7755620D 6 Bytes JMP 5F7F0F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtClose 7C90CFEE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtClose + 4 7C90CFF2 2 Bytes [4D, 5F] {DEC EBP; POP EDI}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtCreateFile 7C90D0AE 1 Byte [FF]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtCreateFile 7C90D0AE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtCreateFile + 4 7C90D0B2 2 Bytes [6E, 5F] {OUTSB ; POP EDI}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [50, 5F] {PUSH EAX; POP EDI}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtDeleteFile 7C90D23E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtDeleteFile + 4 7C90D242 2 Bytes [71, 5F] {JNO 0x61}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtDeleteKey 7C90D24E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtDeleteKey + 4 7C90D252 2 Bytes [53, 5F] {PUSH EBX; POP EDI}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtDeleteValueKey 7C90D26E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtDeleteValueKey + 4 7C90D272 2 Bytes [56, 5F] {PUSH ESI; POP EDI}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtDuplicateObject 7C90D29E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtDuplicateObject + 4 7C90D2A2 2 Bytes [59, 5F] {POP ECX; POP EDI}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtEnumerateKey 7C90D2CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtEnumerateKey + 4 7C90D2D2 2 Bytes [5C, 5F] {POP ESP; POP EDI}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtEnumerateValueKey 7C90D2EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtEnumerateValueKey + 4 7C90D2F2 2 Bytes [5F, 5F] {POP EDI; POP EDI}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtOpenFile 7C90D59E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtOpenFile + 4 7C90D5A2 2 Bytes [74, 5F] {JZ 0x61}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtQueryMultipleValueKey 7C90D86E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtQueryMultipleValueKey + 4 7C90D872 2 Bytes [62, 5F]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtQueryValueKey 7C90D96E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtQueryValueKey + 4 7C90D972 2 Bytes [65, 5F]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtReadFile 7C90D9CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtReadFile + 4 7C90D9D2 2 Bytes [77, 5F] {JA 0x61}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtSetInformationFile 7C90DC5E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtSetInformationFile + 4 7C90DC62 2 Bytes [7A, 5F] {JP 0x61}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [68, 5F]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtUnloadKey 7C90DECE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtUnloadKey + 4 7C90DED2 2 Bytes [6B, 5F]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtWriteFile 7C90DF7E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!NtWriteFile + 4 7C90DF82 2 Bytes [7D, 5F] {JGE 0x61}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!LdrLoadDll 7C9163C3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ntdll.dll!LdrLoadDll + 4 7C9163C7 2 Bytes [4A, 5F] {DEC EDX; POP EDI}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 5F310F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 5F370F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] kernel32.dll!CreateFileMappingW 7C80943C 6 Bytes JMP 5F3D0F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] kernel32.dll!MapViewOfFileEx 7C80B936 6 Bytes JMP 5F340F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [41, 5F] {INC ECX; POP EDI}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] kernel32.dll!CreateProcessInternalW 7C8197B0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] kernel32.dll!CreateProcessInternalW + 4 7C8197B4 2 Bytes [47, 5F] {INC EDI; POP EDI}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] kernel32.dll!MoveFileWithProgressW 7C81F72E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] kernel32.dll!MoveFileWithProgressW + 4 7C81F732 2 Bytes [44, 5F] {INC ESP; POP EDI}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 5F3A0F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] USER32.dll!DispatchMessageW 7E418A01 6 Bytes JMP 5FA90F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] USER32.dll!TranslateMessage 7E418BF6 6 Bytes JMP 5F940F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] USER32.dll!DispatchMessageA 7E4196B8 6 Bytes JMP 5F910F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] USER32.dll!CreateAcceleratorTableW 7E41D9BB 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] USER32.dll!CreateAcceleratorTableW + 4 7E41D9BF 2 Bytes [A4, 5F] {MOVSB ; POP EDI}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 5FA60F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 5FA00F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 5F970F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] USER32.dll!BeginDeferWindowPos 7E42AFB9 6 Bytes JMP 5F8E0F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [9E, 5F] {SAHF ; POP EDI}

.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 5F8B0F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] USER32.dll!AttachThreadInput 7E431E52 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] USER32.dll!AttachThreadInput + 4 7E431E56 2 Bytes [9B, 5F] {WAIT ; POP EDI}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 6 Bytes JMP 5F100F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ADVAPI32.dll!OpenServiceW 77DE6FFD 6 Bytes JMP 5F220F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ADVAPI32.dll!StartServiceA 77DEFB58 6 Bytes JMP 5F250F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ADVAPI32.dll!StartServiceW 77DF3E94 6 Bytes JMP 5F280F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ADVAPI32.dll!ControlService 77DF4A09 6 Bytes JMP 5F130F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ADVAPI32.dll!OpenServiceA 77DF4C66 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ADVAPI32.dll!LsaAddAccountRights 77E1ABF1 6 Bytes JMP 5F2B0F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 5F2E0F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ADVAPI32.dll!ChangeServiceConfigA 77E36E69 6 Bytes JMP 5F040F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ADVAPI32.dll!ChangeServiceConfigW 77E37001 6 Bytes JMP 5F070F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ADVAPI32.dll!ChangeServiceConfig2A 77E37101 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ADVAPI32.dll!ChangeServiceConfig2W 77E37189 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ADVAPI32.dll!ChangeServiceConfig2W + 4 77E3718D 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F160F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F190F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ADVAPI32.dll!DeleteService 77E374B1 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ole32.dll!CoCreateInstanceEx 77500526 6 Bytes JMP 5F880F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ole32.dll!CoGetClassObject 775156C5 6 Bytes JMP 5F850F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ole32.dll!CLSIDFromProgID 775187F2 6 Bytes JMP 5F820F5A
.text C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe[2960] ole32.dll!CLSIDFromProgIDEx 7755620D 6 Bytes JMP 5F7F0F5A
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtClose 7C90CFEE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtClose + 4 7C90CFF2 2 Bytes [4D, 5F] {DEC EBP; POP EDI}
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtCreateFile 7C90D0AE 1 Byte [FF]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtCreateFile 7C90D0AE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtCreateFile + 4 7C90D0B2 2 Bytes [6E, 5F] {OUTSB ; POP EDI}
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [50, 5F] {PUSH EAX; POP EDI}
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtDeleteFile 7C90D23E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtDeleteFile + 4 7C90D242 2 Bytes [71, 5F] {JNO 0x61}
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtDeleteKey 7C90D24E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtDeleteKey + 4 7C90D252 2 Bytes [53, 5F] {PUSH EBX; POP EDI}
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtDeleteValueKey 7C90D26E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtDeleteValueKey + 4 7C90D272 2 Bytes [56, 5F] {PUSH ESI; POP EDI}
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtDuplicateObject 7C90D29E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtDuplicateObject + 4 7C90D2A2 2 Bytes [59, 5F] {POP ECX; POP EDI}
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtEnumerateKey 7C90D2CE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtEnumerateKey + 4 7C90D2D2 2 Bytes [5C, 5F] {POP ESP; POP EDI}
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtEnumerateValueKey 7C90D2EE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtEnumerateValueKey + 4 7C90D2F2 2 Bytes [5F, 5F] {POP EDI; POP EDI}
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtOpenFile 7C90D59E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtOpenFile + 4 7C90D5A2 2 Bytes [74, 5F] {JZ 0x61}
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtQueryMultipleValueKey 7C90D86E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtQueryMultipleValueKey + 4 7C90D872 2 Bytes [62, 5F]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtQueryValueKey 7C90D96E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtQueryValueKey + 4 7C90D972 2 Bytes [65, 5F]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtReadFile 7C90D9CE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtReadFile + 4 7C90D9D2 2 Bytes [77, 5F] {JA 0x61}
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtSetInformationFile 7C90DC5E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtSetInformationFile + 4 7C90DC62 2 Bytes [7A, 5F] {JP 0x61}
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [68, 5F]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtUnloadKey 7C90DECE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtUnloadKey + 4 7C90DED2 2 Bytes [6B, 5F]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtWriteFile 7C90DF7E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!NtWriteFile + 4 7C90DF82 2 Bytes [7D, 5F] {JGE 0x61}
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!LdrLoadDll 7C9163C3 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] ntdll.dll!LdrLoadDll + 4 7C9163C7 2 Bytes [4A, 5F] {DEC EDX; POP EDI}
.text C:\WINDOWS\stsystra.exe[3268] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 5F310F5A
.text C:\WINDOWS\stsystra.exe[3268] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 5F370F5A
.text C:\WINDOWS\stsystra.exe[3268] kernel32.dll!CreateFileMappingW 7C80943C 6 Bytes JMP 5F3D0F5A
.text C:\WINDOWS\stsystra.exe[3268] kernel32.dll!MapViewOfFileEx 7C80B936 6 Bytes JMP 5F340F5A
.text C:\WINDOWS\stsystra.exe[3268] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [41, 5F] {INC ECX; POP EDI}
.text C:\WINDOWS\stsystra.exe[3268] kernel32.dll!CreateProcessInternalW 7C8197B0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] kernel32.dll!CreateProcessInternalW + 4 7C8197B4 2 Bytes [47, 5F] {INC EDI; POP EDI}
.text C:\WINDOWS\stsystra.exe[3268] kernel32.dll!MoveFileWithProgressW 7C81F72E 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] kernel32.dll!MoveFileWithProgressW + 4 7C81F732 2 Bytes [44, 5F] {INC ESP; POP EDI}
.text C:\WINDOWS\stsystra.exe[3268] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 5F3A0F5A
.text C:\WINDOWS\stsystra.exe[3268] USER32.dll!DispatchMessageW 7E418A01 6 Bytes JMP 5FB90F5A
.text C:\WINDOWS\stsystra.exe[3268] USER32.dll!TranslateMessage 7E418BF6 6 Bytes JMP 5FA40F5A
.text C:\WINDOWS\stsystra.exe[3268] USER32.dll!DispatchMessageA 7E4196B8 6 Bytes JMP 5FA10F5A
.text C:\WINDOWS\stsystra.exe[3268] USER32.dll!CreateAcceleratorTableW 7E41D9BB 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] USER32.dll!CreateAcceleratorTableW + 4 7E41D9BF 2 Bytes [B4, 5F] {MOV AH, 0x5f}
.text C:\WINDOWS\stsystra.exe[3268] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 5FB60F5A
.text C:\WINDOWS\stsystra.exe[3268] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 5FB00F5A
.text C:\WINDOWS\stsystra.exe[3268] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 5FA70F5A
.text C:\WINDOWS\stsystra.exe[3268] USER32.dll!BeginDeferWindowPos 7E42AFB9 6 Bytes JMP 5F9E0F5A
.text C:\WINDOWS\stsystra.exe[3268] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [AE, 5F] {SCASB ; POP EDI}
.text C:\WINDOWS\stsystra.exe[3268] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 5F9B0F5A
.text C:\WINDOWS\stsystra.exe[3268] USER32.dll!AttachThreadInput 7E431E52 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] USER32.dll!AttachThreadInput + 4 7E431E56 2 Bytes [AB, 5F] {STOSD ; POP EDI}
.text C:\WINDOWS\stsystra.exe[3268] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\stsystra.exe[3268] ADVAPI32.dll!OpenServiceW 77DE6FFD 6 Bytes JMP 5F220F5A
.text C:\WINDOWS\stsystra.exe[3268] ADVAPI32.dll!StartServiceA 77DEFB58 6 Bytes JMP 5F250F5A

.text C:\WINDOWS\stsystra.exe[3268] ADVAPI32.dll!StartServiceW 77DF3E94 6 Bytes JMP 5F280F5A
.text C:\WINDOWS\stsystra.exe[3268] ADVAPI32.dll!ControlService 77DF4A09 6 Bytes JMP 5F130F5A
.text C:\WINDOWS\stsystra.exe[3268] ADVAPI32.dll!OpenServiceA 77DF4C66 6 Bytes JMP 5F1F0F5A
.text C:\WINDOWS\stsystra.exe[3268] ADVAPI32.dll!LsaAddAccountRights 77E1ABF1 6 Bytes JMP 5F2B0F5A
.text C:\WINDOWS\stsystra.exe[3268] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 5F2E0F5A
.text C:\WINDOWS\stsystra.exe[3268] ADVAPI32.dll!ChangeServiceConfigA 77E36E69 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\stsystra.exe[3268] ADVAPI32.dll!ChangeServiceConfigW 77E37001 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\stsystra.exe[3268] ADVAPI32.dll!ChangeServiceConfig2A 77E37101 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\stsystra.exe[3268] ADVAPI32.dll!ChangeServiceConfig2W 77E37189 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[3268] ADVAPI32.dll!ChangeServiceConfig2W + 4 77E3718D 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINDOWS\stsystra.exe[3268] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F160F5A
.text C:\WINDOWS\stsystra.exe[3268] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F190F5A
.text C:\WINDOWS\stsystra.exe[3268] ADVAPI32.dll!DeleteService 77E374B1 6 Bytes JMP 5F1C0F5A
.text C:\WINDOWS\stsystra.exe[3268] ole32.dll!CoCreateInstanceEx 77500526 6 Bytes JMP 5F980F5A
.text C:\WINDOWS\stsystra.exe[3268] ole32.dll!CoGetClassObject 775156C5 6 Bytes JMP 5F950F5A
.text C:\WINDOWS\stsystra.exe[3268] ole32.dll!CLSIDFromProgID 775187F2 6 Bytes JMP 5F920F5A
.text C:\WINDOWS\stsystra.exe[3268] ole32.dll!CLSIDFromProgIDEx 7755620D 6 Bytes JMP 5F7F0F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtClose 7C90CFEE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtClose + 4 7C90CFF2 2 Bytes [4D, 5F] {DEC EBP; POP EDI}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtCreateFile 7C90D0AE 1 Byte [FF]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtCreateFile 7C90D0AE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtCreateFile + 4 7C90D0B2 2 Bytes [6E, 5F] {OUTSB ; POP EDI}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [50, 5F] {PUSH EAX; POP EDI}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtDeleteFile 7C90D23E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtDeleteFile + 4 7C90D242 2 Bytes [71, 5F] {JNO 0x61}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtDeleteKey 7C90D24E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtDeleteKey + 4 7C90D252 2 Bytes [53, 5F] {PUSH EBX; POP EDI}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtDeleteValueKey 7C90D26E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtDeleteValueKey + 4 7C90D272 2 Bytes [56, 5F] {PUSH ESI; POP EDI}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtDuplicateObject 7C90D29E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtDuplicateObject + 4 7C90D2A2 2 Bytes [59, 5F] {POP ECX; POP EDI}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtEnumerateKey 7C90D2CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtEnumerateKey + 4 7C90D2D2 2 Bytes [5C, 5F] {POP ESP; POP EDI}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtEnumerateValueKey 7C90D2EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtEnumerateValueKey + 4 7C90D2F2 2 Bytes [5F, 5F] {POP EDI; POP EDI}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtOpenFile 7C90D59E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtOpenFile + 4 7C90D5A2 2 Bytes [74, 5F] {JZ 0x61}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtQueryMultipleValueKey 7C90D86E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtQueryMultipleValueKey + 4 7C90D872 2 Bytes [62, 5F]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtQueryValueKey 7C90D96E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtQueryValueKey + 4 7C90D972 2 Bytes [65, 5F]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtReadFile 7C90D9CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtReadFile + 4 7C90D9D2 2 Bytes [77, 5F] {JA 0x61}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtSetInformationFile 7C90DC5E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtSetInformationFile + 4 7C90DC62 2 Bytes [7A, 5F] {JP 0x61}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [68, 5F]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtUnloadKey 7C90DECE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtUnloadKey + 4 7C90DED2 2 Bytes [6B, 5F]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtWriteFile 7C90DF7E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!NtWriteFile + 4 7C90DF82 2 Bytes [7D, 5F] {JGE 0x61}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!LdrLoadDll 7C9163C3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ntdll.dll!LdrLoadDll + 4 7C9163C7 2 Bytes [4A, 5F] {DEC EDX; POP EDI}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 5F310F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 5F370F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] kernel32.dll!CreateFileMappingW 7C80943C 6 Bytes JMP 5F3D0F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] kernel32.dll!MapViewOfFileEx 7C80B936 6 Bytes JMP 5F340F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [41, 5F] {INC ECX; POP EDI}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] kernel32.dll!CreateProcessInternalW 7C8197B0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] kernel32.dll!CreateProcessInternalW + 4 7C8197B4 2 Bytes [47, 5F] {INC EDI; POP EDI}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] kernel32.dll!MoveFileWithProgressW 7C81F72E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] kernel32.dll!MoveFileWithProgressW + 4 7C81F732 2 Bytes [44, 5F] {INC ESP; POP EDI}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 5F3A0F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] USER32.dll!DispatchMessageW 7E418A01 6 Bytes JMP 5FA90F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] USER32.dll!TranslateMessage 7E418BF6 6 Bytes JMP 5F940F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] USER32.dll!DispatchMessageA 7E4196B8 6 Bytes JMP 5F910F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] USER32.dll!CreateAcceleratorTableW 7E41D9BB 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] USER32.dll!CreateAcceleratorTableW + 4 7E41D9BF 2 Bytes [A4, 5F] {MOVSB ; POP EDI}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 5FA60F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 5FA00F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 5F970F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] USER32.dll!BeginDeferWindowPos 7E42AFB9 6 Bytes JMP 5F8E0F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [9E, 5F] {SAHF ; POP EDI}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 5F8B0F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] USER32.dll!AttachThreadInput 7E431E52 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] USER32.dll!AttachThreadInput + 4 7E431E56 2 Bytes [9B, 5F] {WAIT ; POP EDI}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 6 Bytes JMP 5F100F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ADVAPI32.dll!OpenServiceW 77DE6FFD 6 Bytes JMP 5F220F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ADVAPI32.dll!StartServiceA 77DEFB58 6 Bytes JMP 5F250F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ADVAPI32.dll!StartServiceW 77DF3E94 6 Bytes JMP 5F280F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ADVAPI32.dll!ControlService 77DF4A09 6 Bytes JMP 5F130F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ADVAPI32.dll!OpenServiceA 77DF4C66 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ADVAPI32.dll!LsaAddAccountRights 77E1ABF1 6 Bytes JMP 5F2B0F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 5F2E0F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ADVAPI32.dll!ChangeServiceConfigA 77E36E69 6 Bytes JMP 5F040F5A

.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ADVAPI32.dll!ChangeServiceConfigW 77E37001 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ADVAPI32.dll!ChangeServiceConfig2A 77E37101 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ADVAPI32.dll!ChangeServiceConfig2W 77E37189 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ADVAPI32.dll!ChangeServiceConfig2W + 4 77E3718D 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F160F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F190F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ADVAPI32.dll!DeleteService 77E374B1 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ole32.dll!CoCreateInstanceEx 77500526 6 Bytes JMP 5F880F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ole32.dll!CoGetClassObject 775156C5 6 Bytes JMP 5F850F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ole32.dll!CLSIDFromProgID 775187F2 6 Bytes JMP 5F820F5A
.text C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[3580] ole32.dll!CLSIDFromProgIDEx 7755620D 6 Bytes JMP 5F7F0F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtClose 7C90CFEE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtClose + 4 7C90CFF2 2 Bytes [4D, 5F] {DEC EBP; POP EDI}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtCreateFile 7C90D0AE 1 Byte [FF]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtCreateFile 7C90D0AE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtCreateFile + 4 7C90D0B2 2 Bytes [6E, 5F] {OUTSB ; POP EDI}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [50, 5F] {PUSH EAX; POP EDI}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtDeleteFile 7C90D23E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtDeleteFile + 4 7C90D242 2 Bytes [71, 5F] {JNO 0x61}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtDeleteKey 7C90D24E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtDeleteKey + 4 7C90D252 2 Bytes [53, 5F] {PUSH EBX; POP EDI}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtDeleteValueKey 7C90D26E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtDeleteValueKey + 4 7C90D272 2 Bytes [56, 5F] {PUSH ESI; POP EDI}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtDuplicateObject 7C90D29E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtDuplicateObject + 4 7C90D2A2 2 Bytes [59, 5F] {POP ECX; POP EDI}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtEnumerateKey 7C90D2CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtEnumerateKey + 4 7C90D2D2 2 Bytes [5C, 5F] {POP ESP; POP EDI}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtEnumerateValueKey 7C90D2EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtEnumerateValueKey + 4 7C90D2F2 2 Bytes [5F, 5F] {POP EDI; POP EDI}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtOpenFile 7C90D59E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtOpenFile + 4 7C90D5A2 2 Bytes [74, 5F] {JZ 0x61}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtQueryMultipleValueKey 7C90D86E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtQueryMultipleValueKey + 4 7C90D872 2 Bytes [62, 5F]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtQueryValueKey 7C90D96E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtQueryValueKey + 4 7C90D972 2 Bytes [65, 5F]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtReadFile 7C90D9CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtReadFile + 4 7C90D9D2 2 Bytes [77, 5F] {JA 0x61}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtSetInformationFile 7C90DC5E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtSetInformationFile + 4 7C90DC62 2 Bytes [7A, 5F] {JP 0x61}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [68, 5F]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtUnloadKey 7C90DECE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtUnloadKey + 4 7C90DED2 2 Bytes [6B, 5F]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtWriteFile 7C90DF7E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!NtWriteFile + 4 7C90DF82 2 Bytes [7D, 5F] {JGE 0x61}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!LdrLoadDll 7C9163C3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ntdll.dll!LdrLoadDll + 4 7C9163C7 2 Bytes [4A, 5F] {DEC EDX; POP EDI}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 5F310F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 5F370F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] kernel32.dll!CreateFileMappingW 7C80943C 6 Bytes JMP 5F3D0F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] kernel32.dll!MapViewOfFileEx 7C80B936 6 Bytes JMP 5F340F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [41, 5F] {INC ECX; POP EDI}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] kernel32.dll!CreateProcessInternalW 7C8197B0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] kernel32.dll!CreateProcessInternalW + 4 7C8197B4 2 Bytes [47, 5F] {INC EDI; POP EDI}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] kernel32.dll!MoveFileWithProgressW 7C81F72E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] kernel32.dll!MoveFileWithProgressW + 4 7C81F732 2 Bytes [44, 5F] {INC ESP; POP EDI}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 5F3A0F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] USER32.dll!DispatchMessageW 7E418A01 6 Bytes JMP 5FA90F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] USER32.dll!TranslateMessage 7E418BF6 6 Bytes JMP 5F940F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] USER32.dll!DispatchMessageA 7E4196B8 6 Bytes JMP 5F910F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] USER32.dll!CreateAcceleratorTableW 7E41D9BB 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] USER32.dll!CreateAcceleratorTableW + 4 7E41D9BF 2 Bytes [A4, 5F] {MOVSB ; POP EDI}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 5FA60F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 5FA00F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 5F970F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] USER32.dll!BeginDeferWindowPos 7E42AFB9 6 Bytes JMP 5F8E0F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [9E, 5F] {SAHF ; POP EDI}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 5F8B0F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] USER32.dll!AttachThreadInput 7E431E52 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] USER32.dll!AttachThreadInput + 4 7E431E56 2 Bytes [9B, 5F] {WAIT ; POP EDI}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 6 Bytes JMP 5F100F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ADVAPI32.dll!OpenServiceW 77DE6FFD 6 Bytes JMP 5F220F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ADVAPI32.dll!StartServiceA 77DEFB58 6 Bytes JMP 5F250F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ADVAPI32.dll!StartServiceW 77DF3E94 6 Bytes JMP 5F280F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ADVAPI32.dll!ControlService 77DF4A09 6 Bytes JMP 5F130F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ADVAPI32.dll!OpenServiceA 77DF4C66 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ADVAPI32.dll!LsaAddAccountRights 77E1ABF1 6 Bytes JMP 5F2B0F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 5F2E0F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ADVAPI32.dll!ChangeServiceConfigA 77E36E69 6 Bytes JMP 5F040F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ADVAPI32.dll!ChangeServiceConfigW 77E37001 6 Bytes JMP 5F070F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ADVAPI32.dll!ChangeServiceConfig2A 77E37101 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ADVAPI32.dll!ChangeServiceConfig2W 77E37189 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ADVAPI32.dll!ChangeServiceConfig2W + 4 77E3718D 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F160F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F190F5A

.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ADVAPI32.dll!DeleteService 77E374B1 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ole32.dll!CoCreateInstanceEx 77500526 6 Bytes JMP 5F880F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ole32.dll!CoGetClassObject 775156C5 6 Bytes JMP 5F850F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ole32.dll!CLSIDFromProgID 775187F2 6 Bytes JMP 5F820F5A
.text C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe[3836] ole32.dll!CLSIDFromProgIDEx 7755620D 6 Bytes JMP 5F7F0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtClose 7C90CFEE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtClose + 4 7C90CFF2 2 Bytes [4D, 5F] {DEC EBP; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtCreateFile 7C90D0AE 1 Byte [FF]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtCreateFile 7C90D0AE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtCreateFile + 4 7C90D0B2 2 Bytes [6E, 5F] {OUTSB ; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [50, 5F] {PUSH EAX; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtDeleteFile 7C90D23E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtDeleteFile + 4 7C90D242 2 Bytes [71, 5F] {JNO 0x61}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtDeleteKey 7C90D24E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtDeleteKey + 4 7C90D252 2 Bytes [53, 5F] {PUSH EBX; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtDeleteValueKey 7C90D26E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtDeleteValueKey + 4 7C90D272 2 Bytes [56, 5F] {PUSH ESI; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtDuplicateObject 7C90D29E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtDuplicateObject + 4 7C90D2A2 2 Bytes [59, 5F] {POP ECX; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtEnumerateKey 7C90D2CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtEnumerateKey + 4 7C90D2D2 2 Bytes [5C, 5F] {POP ESP; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtEnumerateValueKey 7C90D2EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtEnumerateValueKey + 4 7C90D2F2 2 Bytes [5F, 5F] {POP EDI; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtOpenFile 7C90D59E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtOpenFile + 4 7C90D5A2 2 Bytes [74, 5F] {JZ 0x61}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtQueryMultipleValueKey 7C90D86E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtQueryMultipleValueKey + 4 7C90D872 2 Bytes [62, 5F]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtQueryValueKey 7C90D96E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtQueryValueKey + 4 7C90D972 2 Bytes [65, 5F]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtReadFile 7C90D9CE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtReadFile + 4 7C90D9D2 2 Bytes [77, 5F] {JA 0x61}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtSetInformationFile 7C90DC5E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtSetInformationFile + 4 7C90DC62 2 Bytes [7A, 5F] {JP 0x61}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [68, 5F]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtUnloadKey 7C90DECE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtUnloadKey + 4 7C90DED2 2 Bytes [6B, 5F]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtWriteFile 7C90DF7E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!NtWriteFile + 4 7C90DF82 2 Bytes [7D, 5F] {JGE 0x61}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!LdrLoadDll 7C9163C3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ntdll.dll!LdrLoadDll + 4 7C9163C7 2 Bytes [4A, 5F] {DEC EDX; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 5F310F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 5F370F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] kernel32.dll!CreateFileMappingW 7C80943C 6 Bytes JMP 5F3D0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] kernel32.dll!MapViewOfFileEx 7C80B936 6 Bytes JMP 5F340F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [41, 5F] {INC ECX; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] kernel32.dll!CreateProcessInternalW 7C8197B0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] kernel32.dll!CreateProcessInternalW + 4 7C8197B4 2 Bytes [47, 5F] {INC EDI; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] kernel32.dll!MoveFileWithProgressW 7C81F72E 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] kernel32.dll!MoveFileWithProgressW + 4 7C81F732 2 Bytes [44, 5F] {INC ESP; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 5F3A0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 6 Bytes JMP 5F100F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ADVAPI32.dll!OpenServiceW 77DE6FFD 6 Bytes JMP 5F220F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ADVAPI32.dll!StartServiceA 77DEFB58 6 Bytes JMP 5F250F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ADVAPI32.dll!StartServiceW 77DF3E94 6 Bytes JMP 5F280F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ADVAPI32.dll!ControlService 77DF4A09 6 Bytes JMP 5F130F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ADVAPI32.dll!OpenServiceA 77DF4C66 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ADVAPI32.dll!LsaAddAccountRights 77E1ABF1 6 Bytes JMP 5F2B0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 5F2E0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ADVAPI32.dll!ChangeServiceConfigA 77E36E69 6 Bytes JMP 5F040F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ADVAPI32.dll!ChangeServiceConfigW 77E37001 6 Bytes JMP 5F070F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ADVAPI32.dll!ChangeServiceConfig2A 77E37101 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ADVAPI32.dll!ChangeServiceConfig2W 77E37189 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ADVAPI32.dll!ChangeServiceConfig2W + 4 77E3718D 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F160F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F190F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ADVAPI32.dll!DeleteService 77E374B1 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] USER32.dll!DispatchMessageW 7E418A01 6 Bytes JMP 5FA90F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] USER32.dll!TranslateMessage 7E418BF6 6 Bytes JMP 5F940F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] USER32.dll!DispatchMessageA 7E4196B8 6 Bytes JMP 5F910F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] USER32.dll!CreateAcceleratorTableW 7E41D9BB 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] USER32.dll!CreateAcceleratorTableW + 4 7E41D9BF 2 Bytes [A4, 5F] {MOVSB ; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 5FA60F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 5FA00F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 5F970F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] USER32.dll!BeginDeferWindowPos 7E42AFB9 6 Bytes JMP 5F8E0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [9E, 5F] {SAHF ; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 5F8B0F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] USER32.dll!AttachThreadInput 7E431E52 3 Bytes [FF, 25, 1E]
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] USER32.dll!AttachThreadInput + 4 7E431E56 2 Bytes [9B, 5F] {WAIT ; POP EDI}
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ole32.dll!CoCreateInstanceEx 77500526 6 Bytes JMP 5F880F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ole32.dll!CoGetClassObject 775156C5 6 Bytes JMP 5F850F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ole32.dll!CLSIDFromProgID 775187F2 6 Bytes JMP 5F820F5A
.text C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe[4092] ole32.dll!CLSIDFromProgIDEx 7755620D 6 Bytes JMP 5F7F0F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtClose 7C90CFEE 3 Bytes [FF, 25, 1E]

.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtClose + 4 7C90CFF2 2 Bytes [4D, 5F] {DEC EBP; POP EDI}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtCreateFile 7C90D0AE 1 Byte [FF]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtCreateFile 7C90D0AE 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtCreateFile + 4 7C90D0B2 2 Bytes [6E, 5F] {OUTSB ; POP EDI}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [50, 5F] {PUSH EAX; POP EDI}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtDeleteFile 7C90D23E 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtDeleteFile + 4 7C90D242 2 Bytes [71, 5F] {JNO 0x61}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtDeleteKey 7C90D24E 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtDeleteKey + 4 7C90D252 2 Bytes [53, 5F] {PUSH EBX; POP EDI}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtDeleteValueKey 7C90D26E 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtDeleteValueKey + 4 7C90D272 2 Bytes [56, 5F] {PUSH ESI; POP EDI}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtDuplicateObject 7C90D29E 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtDuplicateObject + 4 7C90D2A2 2 Bytes [59, 5F] {POP ECX; POP EDI}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtEnumerateKey 7C90D2CE 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtEnumerateKey + 4 7C90D2D2 2 Bytes [5C, 5F] {POP ESP; POP EDI}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtEnumerateValueKey 7C90D2EE 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtEnumerateValueKey + 4 7C90D2F2 2 Bytes [5F, 5F] {POP EDI; POP EDI}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtOpenFile 7C90D59E 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtOpenFile + 4 7C90D5A2 2 Bytes [74, 5F] {JZ 0x61}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtQueryMultipleValueKey 7C90D86E 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtQueryMultipleValueKey + 4 7C90D872 2 Bytes [62, 5F]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtQueryValueKey 7C90D96E 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtQueryValueKey + 4 7C90D972 2 Bytes [65, 5F]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtReadFile 7C90D9CE 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtReadFile + 4 7C90D9D2 2 Bytes [77, 5F] {JA 0x61}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtSetInformationFile 7C90DC5E 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtSetInformationFile + 4 7C90DC62 2 Bytes [7A, 5F] {JP 0x61}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [68, 5F]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtUnloadKey 7C90DECE 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtUnloadKey + 4 7C90DED2 2 Bytes [6B, 5F]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtWriteFile 7C90DF7E 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!NtWriteFile + 4 7C90DF82 2 Bytes [7D, 5F] {JGE 0x61}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!LdrLoadDll 7C9163C3 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ntdll.dll!LdrLoadDll + 4 7C9163C7 2 Bytes [4A, 5F] {DEC EDX; POP EDI}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 5F310F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 5F370F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] kernel32.dll!CreateFileMappingW 7C80943C 6 Bytes JMP 5F3D0F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] kernel32.dll!MapViewOfFileEx 7C80B936 6 Bytes JMP 5F340F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [41, 5F] {INC ECX; POP EDI}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] kernel32.dll!CreateProcessInternalW 7C8197B0 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] kernel32.dll!CreateProcessInternalW + 4 7C8197B4 2 Bytes [47, 5F] {INC EDI; POP EDI}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] kernel32.dll!MoveFileWithProgressW 7C81F72E 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] kernel32.dll!MoveFileWithProgressW + 4 7C81F732 2 Bytes [44, 5F] {INC ESP; POP EDI}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 5F3A0F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] USER32.dll!DispatchMessageW 7E418A01 6 Bytes JMP 5FA90F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] USER32.dll!TranslateMessage 7E418BF6 6 Bytes JMP 5F940F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] USER32.dll!DispatchMessageA 7E4196B8 6 Bytes JMP 5F910F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] USER32.dll!CreateAcceleratorTableW 7E41D9BB 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] USER32.dll!CreateAcceleratorTableW + 4 7E41D9BF 2 Bytes [A4, 5F] {MOVSB ; POP EDI}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 5FA60F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 5FA00F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 5F970F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] USER32.dll!BeginDeferWindowPos 7E42AFB9 6 Bytes JMP 5F8E0F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [9E, 5F] {SAHF ; POP EDI}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 5F8B0F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] USER32.dll!AttachThreadInput 7E431E52 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] USER32.dll!AttachThreadInput + 4 7E431E56 2 Bytes [9B, 5F] {WAIT ; POP EDI}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 6 Bytes JMP 5F100F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ADVAPI32.dll!OpenServiceW 77DE6FFD 6 Bytes JMP 5F220F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ADVAPI32.dll!StartServiceA 77DEFB58 6 Bytes JMP 5F250F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ADVAPI32.dll!StartServiceW 77DF3E94 6 Bytes JMP 5F280F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ADVAPI32.dll!ControlService 77DF4A09 6 Bytes JMP 5F130F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ADVAPI32.dll!OpenServiceA 77DF4C66 6 Bytes JMP 5F1F0F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ADVAPI32.dll!LsaAddAccountRights 77E1ABF1 6 Bytes JMP 5F2B0F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 5F2E0F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ADVAPI32.dll!ChangeServiceConfigA 77E36E69 6 Bytes JMP 5F040F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ADVAPI32.dll!ChangeServiceConfigW 77E37001 6 Bytes JMP 5F070F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ADVAPI32.dll!ChangeServiceConfig2A 77E37101 6 Bytes JMP 5F0A0F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ADVAPI32.dll!ChangeServiceConfig2W 77E37189 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ADVAPI32.dll!ChangeServiceConfig2W + 4 77E3718D 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F160F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F190F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ADVAPI32.dll!DeleteService 77E374B1 6 Bytes JMP 5F1C0F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ole32.dll!CoCreateInstanceEx 77500526 6 Bytes JMP 5F880F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ole32.dll!CoGetClassObject 775156C5 6 Bytes JMP 5F850F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ole32.dll!CLSIDFromProgID 775187F2 6 Bytes JMP 5F820F5A
.text C:\Documents and Settings\Jane Bower\Desktop\4mg2kcxk.exe[4384] ole32.dll!CLSIDFromProgIDEx 7755620D 6 Bytes JMP 5F7F0F5A

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs ShlDrv51.sys (PandaShield driver/Panda Software)


AttachedDevice \FileSystem\Ntfs \Ntfs pavdrv51.sys (Antivirus Filter Driver for Windows XP/2003 x86/Panda Software International)
AttachedDevice \FileSystem\Ntfs \Ntfs av5flt.sys
AttachedDevice \Driver\Tcpip \Device\Ip NETFLTDI.SYS (Panda TDI Filter/Panda Software)
AttachedDevice \Driver\Tcpip \Device\Tcp NETFLTDI.SYS (Panda TDI Filter/Panda Software)
AttachedDevice \Driver\Tcpip \Device\Udp NETFLTDI.SYS (Panda TDI Filter/Panda Software)
AttachedDevice \Driver\Tcpip \Device\RawIp NETFLTDI.SYS (Panda TDI Filter/Panda Software)

Device \FileSystem\Fastfat \Fat ShlDrv51.sys (PandaShield driver/Panda Software)
Device \FileSystem\Fastfat \Fat B8AA97B4

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat pavdrv51.sys (Antivirus Filter Driver for Windows XP/2003 x86/Panda Software International)
AttachedDevice \FileSystem\Fastfat \Fat av5flt.sys

Device \FileSystem\Cdfs \Cdfs DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions)
Device -> \Driver\iastor \Device\Harddisk0\DR0 86F2B2F6

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Classes\CLSID\{175AF4D7-9CF3-F457-BF0E37CACC73FC6B}\{467C247B-D237-138A-478D2C475DF76751}\{0F112251-81FD-FF65-E1D4489D8D443FBC}
Reg HKLM\SOFTWARE\Classes\CLSID\{175AF4D7-9CF3-F457-BF0E37CACC73FC6B}\{467C247B-D237-138A-478D2C475DF76751}\{0F112251-81FD-FF65-E1D4489D8D443FBC}@WHRUBFTNUT3JMXQXKMKSXOBADA1 0x01 0x00 0x01 0x00 ...

---- EOF - GMER 1.0.15 ----

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:41:40 PM, on 11/18/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\AVENGINE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\PsCtrls.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe
c:\program files\panda software\panda internet security 2007\firewall\PSHOST.EXE
C:\Program Files\Panda Software\Panda Internet Security 2007\psimsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Internet Security 2007\ApvxdWin.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\SRVLOAD.EXE
C:\Program Files\Panda Software\Panda Internet Security 2007\WebProxy.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\PavBckPT.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...us&ibd=5061101
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:80
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Internet Security 2007\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NETGEAR WG311v3 Smart Wizard.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1164155393781
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Intel(R) Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv51.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe
O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda software\panda internet security 2007\firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\psimsvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe

--
End of file - 10810 bytes

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
[list=1][*]Please, never rename Combofix unless instructed.[*]Close any open browsers.[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE. If Combofix asks you to install Recovery Console, please allow it.

• Close any open browsers.
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
• Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
• If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
• Double click on combofix.exe & follow the prompts.
• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Here's the new Combofix log. Incidentally, after running it and restarting the PC, I was finally able to get Malwarebytes and SUPER Antispyware through Panda's firewall for updating:


ComboFix 09-11-20.01 - Jane Bower 11/20/2009 10:11.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.596 [GMT -8:00]
Running from: c:\documents and settings\Jane Bower\Desktop\ComboFix.exe
AV: Panda Internet Security 2008 *On-access scanning disabled* (Outdated) {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0}
FW: Panda Internet Security 2008 *disabled* {7B090DC0-8905-4BAF-8040-FD98A41C8FB8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\kb913800.exe
c:\windows\system32\drivers\pciide.sys

.
((((((((((((((((((((((((( Files Created from 2009-10-20 to 2009-11-20 )))))))))))))))))))))))))))))))
.

2009-11-19 00:41 . 2009-11-19 00:41 -------- d-----w- c:\program files\Trend Micro
2009-11-18 22:20 . 2009-09-10 22:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-18 22:20 . 2009-09-10 22:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-18 22:10 . 2009-11-18 22:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-18 19:37 . 2009-11-18 19:37 117760 ----a-w- c:\documents and settings\Jane Bower\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-11-18 19:37 . 2009-11-18 19:37 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-11-18 19:37 . 2009-11-18 19:37 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-11-18 19:37 . 2009-11-18 19:37 -------- d-----w- c:\documents and settings\Jane Bower\Application Data\SUPERAntiSpyware.com
2009-11-18 13:29 . 2009-11-18 13:29 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-20 18:31 . 2007-11-20 02:22 345480 ----a-w- c:\windows\system32\drivers\APPFCONT.DAT.bck
2009-11-20 18:31 . 2007-11-20 02:22 1244 ----a-w- c:\windows\system32\drivers\APPFLTR.CFG.bck
2009-11-20 18:31 . 2006-11-12 03:04 345480 ----a-w- c:\windows\system32\drivers\APPFCONT.DAT
2009-11-20 18:31 . 2006-11-12 03:04 1244 ----a-w- c:\windows\system32\drivers\APPFLTR.CFG
2009-11-19 20:30 . 2007-08-12 20:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-11-18 23:53 . 2006-11-01 16:42 246784 ----a-w- c:\windows\system32\drivers\iaStor.sys
2009-11-18 19:36 . 2007-08-16 03:44 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-10-16 10:01 . 2006-11-01 17:10 -------- d-----w- c:\program files\Microsoft Works
2009-10-03 18:57 . 2009-10-02 02:11 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-11 14:18 . 2005-08-16 10:18 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03 . 2005-08-16 10:18 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 08:08 . 2005-08-16 10:18 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-26 08:00 . 2005-08-16 10:19 247326 ----a-w- c:\windows\system32\strmdll.dll
2008-08-30 21:53 . 2007-08-30 23:48 122880 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2007-10-27 16:34 . 2007-08-07 17:32 88 --sh--r- c:\windows\system32\940D167E79.sys
2007-10-27 16:36 . 2007-08-07 17:32 2828 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-28 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-30 29744]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-26 172032]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 49152]
"DeviceDiscovery"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2002-12-03 40960]
"SCANINICIO"="c:\program files\Panda Software\Panda Internet Security 2007\Inicio.exe" [2007-07-11 27952]
"APVXDWIN"="c:\program files\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE" [2007-07-24 406832]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-16 7323648]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-11-01 98304]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-13 1121792]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-03-12 185896]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-07-24 282624]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
NETGEAR WG311v3 Smart Wizard.lnk - c:\windows\Installer\{70014586-7BBA-4A92-A610-CDC896C48F8F}\NewShortcut1_1.exe [2006-11-3 1078]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
2007-02-16 04:02 50736 ----a-w- c:\windows\system32\avldr.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"110:TCP"= 110:TCP:svchost

R1 APPFLT;App Filter Plugin;c:\windows\system32\drivers\APPFLT.SYS [11/11/2006 7:04 PM 71736]
R1 DSAFLT;DSA Filter Plugin;c:\windows\system32\drivers\dsaflt.sys [11/11/2006 7:04 PM 51256]
R1 FNETMON;NetMon Filter Plugin;c:\windows\system32\drivers\fnetmon.sys [11/11/2006 7:04 PM 22072]
R1 IDSFLT;Ids Filter Plugin;c:\windows\system32\drivers\idsflt.sys [11/11/2006 7:04 PM 191672]
R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\drivers\netfltdi.sys [11/11/2006 7:04 PM 132920]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [11/11/2009 10:44 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [11/11/2009 10:44 AM 74480]
R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\drivers\ShlDrv51.sys [11/19/2007 6:08 PM 38968]
R1 SMSFLT;SMS Filter Plugin;c:\windows\system32\drivers\smsflt.sys [11/11/2006 7:04 PM 37304]
R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\drivers\wnmflt.sys [11/11/2006 7:04 PM 30648]
R2 cpoint;Panda CPoint Driver;c:\windows\system32\drivers\cpoint.sys [11/11/2006 7:04 PM 24760]
R2 PavProc;Panda Process Protection Driver;c:\windows\system32\drivers\PavProc.sys [11/11/2006 6:52 PM 178872]
R3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys --> c:\windows\system32\drivers\av5flt.sys [?]
R3 NETIMFLT;PANDA NDIS IM Filter Miniport;c:\windows\system32\drivers\netimflt.sys [11/19/2007 6:11 PM 142128]
R3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys --> c:\windows\system32\PavSRK.sys [?]
R3 PavTPK.sys;PavTPK.sys;\??\c:\windows\system32\PavTPK.sys --> c:\windows\system32\PavTPK.sys [?]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [11/1/2006 9:08 AM 29744]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [11/11/2009 10:44 AM 7408]
S3 sdthook;sdthook;\??\c:\windows\system32\drivers\sdthook.sys --> c:\windows\system32\drivers\sdthook.sys [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - CLASSPNP_2
*Deregistered* - CLASSPNP_2
.
Contents of the 'Scheduled Tasks' folder

2009-11-20 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-13 00:33]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyServer = http=127.0.0.1:80
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
LSP: c:\program files\panda software\panda internet security 2007\pavlsp.dll
FF - ProfilePath - c:\documents and settings\Jane Bower\Application Data\Mozilla\Firefox\Profiles\8cop1c9s.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.
.
------- File Associations -------
.
JSEFile=c:\progra~1\PANDAS~1\PANDAI~1\PAVSCRIP.EXE "%1" %*
VBEFile=c:\progra~1\PANDAS~1\PANDAI~1\PAVSCRIP.EXE "%1" %*
VBSFile=c:\progra~1\PANDAS~1\PANDAI~1\PAVSCRIP.EXE "%1" %*
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-20 10:29
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x871242F6]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7543f28
\Driver\ACPI -> ACPI.sys @ 0xf73d6cb8
\Driver\iaStor -> iastor.sys @ 0xf72cbf80
IoDeviceObjectType -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Intel(R) 82562V 10/100 Network Connection -> SendCompleteHandler -> NDIS.sys @ 0xf71bfbb0
PacketIndicateHandler -> NDIS.sys @ 0xf71cca21
SendHandler -> NDIS.sys @ 0xf71aa87b
user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{175AF4D7-9CF3-F457-BF0E37CACC73FC6B}\{467C247B-D237-138A-478D2C475DF76751}\{0F112251-81FD-FF65-E1D4489D8D443FBC}*]
"WHRUBFTNUT3JMXQXKMKSXOBADA1"=hex:01,00,01,00,00,00,00,00,7d,86,67,30,10,5d,1c,
b8,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1120)
c:\windows\system32\WININET.dll
c:\windows\system32\MrvGINA.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\avldr.dll

- - - - - - - > 'lsass.exe'(1184)
c:\windows\system32\WININET.dll

- - - - - - - > 'Explorer.exe'(7060)
c:\windows\system32\WININET.dll
c:\program files\Panda Software\Panda Internet Security 2007\pavoepl.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\NETGEAR\WG311v3\WinDomainlogon.exe
c:\program files\Panda Software\Panda Internet Security 2007\pavsrv51.exe
c:\program files\Panda Software\Panda Internet Security 2007\AVENGINE.EXE
c:\program files\Panda Software\Panda Internet Security 2007\TPSrv.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\program files\Panda Software\Panda Internet Security 2007\PsCtrls.exe
c:\program files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe
c:\program files\Common Files\Panda Software\PavShld\pavprsrv.exe
c:\program files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe
c:\program files\panda software\panda internet security 2007\firewall\PSHOST.EXE
c:\program files\Panda Software\Panda Internet Security 2007\psimsvc.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\program files\NETGEAR\WG311v3\WinDomainlogon.exe
c:\program files\NETGEAR\WG311v3\wlancfg5.exe
c:\windows\eHome\ehmsas.exe
c:\program files\Panda Software\Panda Internet Security 2007\SRVLOAD.EXE
c:\program files\Panda Software\Panda Internet Security 2007\WebProxy.exe
c:\program files\Panda Software\Panda Internet Security 2007\PavBckPT.exe
.
**************************************************************************
.
Completion time: 2009-11-20 10:36 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-20 18:36

Pre-Run: 137,819,525,120 bytes free
Post-Run: 138,168,979,456 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

- - End Of File - - 115EB8DA65E9802C7E767185241CB924

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:52:02 AM, on 11/20/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\AVENGINE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\PsCtrls.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe
c:\program files\panda software\panda internet security 2007\firewall\PSHOST.EXE
C:\Program Files\Panda Software\Panda Internet Security 2007\psimsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\SRVLOAD.EXE
C:\Program Files\Panda Software\Panda Internet Security 2007\WebProxy.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\PavBckPT.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...us&ibd=5061101
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:80
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Internet Security 2007\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NETGEAR WG311v3 Smart Wizard.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1164155393781
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Intel(R) Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv51.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe
O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda software\panda internet security 2007\firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\psimsvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe

--
End of file - 10271 bytes

1. Please open Notepad

• Click Start , then Run
• Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

---

KillAll::

File::
c:\windows\system32\940D167E79.sys

mbr::

Folder::

Driver::

Registry::

RegLockDel::

---

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

https://discussions.virtualdr.com/im.../2016/03/2.gif


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt
• A new HijackThis log.

This time after Combofix finished running after the reboot, I started getting warnings from Panda about every 2 seconds about an attempted hijack for a few minutes.


ComboFix 09-11-20.01 - Jane Bower 11/20/2009 19:41.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.605 [GMT -8:00]
Running from: c:\documents and settings\Jane Bower\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Jane Bower\Desktop\CFScript.txt
AV: Panda Internet Security 2008 *On-access scanning disabled* (Outdated) {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0}
FW: Panda Internet Security 2008 *disabled* {7B090DC0-8905-4BAF-8040-FD98A41C8FB8}

FILE ::
"c:\windows\system32\940D167E79.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\940D167E79.sys

.
((((((((((((((((((((((((( Files Created from 2009-10-21 to 2009-11-21 )))))))))))))))))))))))))))))))
.

2009-11-19 00:41 . 2009-11-19 00:41 -------- d-----w- c:\program files\Trend Micro
2009-11-18 22:20 . 2009-09-10 22:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-18 22:20 . 2009-09-10 22:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-18 22:10 . 2009-11-18 22:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-18 19:37 . 2009-11-20 18:57 117760 ----a-w- c:\documents and settings\Jane Bower\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-11-18 19:37 . 2009-11-18 19:37 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-11-18 19:37 . 2009-11-18 19:37 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-11-18 19:37 . 2009-11-18 19:37 -------- d-----w- c:\documents and settings\Jane Bower\Application Data\SUPERAntiSpyware.com
2009-11-18 13:29 . 2009-11-18 13:29 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-21 04:14 . 2007-11-20 02:22 349232 ----a-w- c:\windows\system32\drivers\APPFCONT.DAT.bck
2009-11-21 04:14 . 2007-11-20 02:22 1244 ----a-w- c:\windows\system32\drivers\APPFLTR.CFG.bck
2009-11-21 04:14 . 2006-11-12 03:04 349232 ----a-w- c:\windows\system32\drivers\APPFCONT.DAT
2009-11-21 04:14 . 2006-11-12 03:04 1244 ----a-w- c:\windows\system32\drivers\APPFLTR.CFG
2009-11-21 01:44 . 2007-08-12 20:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-11-18 23:53 . 2006-11-01 16:42 246784 ----a-w- c:\windows\system32\drivers\iaStor.sys
2009-11-18 19:36 . 2007-08-16 03:44 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-10-16 10:01 . 2006-11-01 17:10 -------- d-----w- c:\program files\Microsoft Works
2009-10-03 18:57 . 2009-10-02 02:11 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-11 14:18 . 2005-08-16 10:18 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03 . 2005-08-16 10:18 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 08:08 . 2005-08-16 10:18 916480 ------w- c:\windows\system32\wininet.dll
2009-08-26 08:00 . 2005-08-16 10:19 247326 ----a-w- c:\windows\system32\strmdll.dll
2008-08-30 21:53 . 2007-08-30 23:48 122880 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2007-10-27 16:36 . 2007-08-07 17:32 2828 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-11-20_18.29.33 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-11-03 05:23 . 2009-11-21 03:54 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2006-11-03 05:23 . 2009-11-20 18:25 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2006-11-03 05:23 . 2009-11-21 03:54 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2006-11-03 05:23 . 2009-11-20 18:25 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-11-18 13:29 . 2009-11-20 18:25 16384 c:\windows\system32\config\systemprofile\IETldCache\index.dat
+ 2009-11-18 13:29 . 2009-11-21 03:54 16384 c:\windows\system32\config\systemprofile\IETldCache\index.dat
+ 2006-11-03 05:23 . 2009-11-21 03:54 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2006-11-03 05:23 . 2009-11-20 18:25 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-28 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-30 29744]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-26 172032]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 49152]
"DeviceDiscovery"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2002-12-03 40960]
"SCANINICIO"="c:\program files\Panda Software\Panda Internet Security 2007\Inicio.exe" [2007-07-11 27952]
"APVXDWIN"="c:\program files\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE" [2007-07-24 406832]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-16 7323648]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-11-01 98304]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-13 1121792]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-03-12 185896]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-07-24 282624]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
NETGEAR WG311v3 Smart Wizard.lnk - c:\windows\Installer\{70014586-7BBA-4A92-A610-CDC896C48F8F}\NewShortcut1_1.exe [2006-11-3 1078]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
2007-02-16 04:02 50736 ----a-w- c:\windows\system32\avldr.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"&#37;windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"110:TCP"= 110:TCP:svchost

R1 APPFLT;App Filter Plugin;c:\windows\system32\drivers\APPFLT.SYS [11/11/2006 7:04 PM 71736]
R1 DSAFLT;DSA Filter Plugin;c:\windows\system32\drivers\dsaflt.sys [11/11/2006 7:04 PM 51256]
R1 FNETMON;NetMon Filter Plugin;c:\windows\system32\drivers\fnetmon.sys [11/11/2006 7:04 PM 22072]
R1 IDSFLT;Ids Filter Plugin;c:\windows\system32\drivers\idsflt.sys [11/11/2006 7:04 PM 191672]
R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\drivers\netfltdi.sys [11/11/2006 7:04 PM 132920]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [11/11/2009 10:44 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [11/11/2009 10:44 AM 74480]
R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\drivers\ShlDrv51.sys [11/19/2007 6:08 PM 38968]
R1 SMSFLT;SMS Filter Plugin;c:\windows\system32\drivers\smsflt.sys [11/11/2006 7:04 PM 37304]
R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\drivers\wnmflt.sys [11/11/2006 7:04 PM 30648]
R2 cpoint;Panda CPoint Driver;c:\windows\system32\drivers\cpoint.sys [11/11/2006 7:04 PM 24760]
R2 PavProc;Panda Process Protection Driver;c:\windows\system32\drivers\PavProc.sys [11/11/2006 6:52 PM 178872]
R3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys --> c:\windows\system32\drivers\av5flt.sys [?]
R3 NETIMFLT;PANDA NDIS IM Filter Miniport;c:\windows\system32\drivers\netimflt.sys [11/19/2007 6:11 PM 142128]
R3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys --> c:\windows\system32\PavSRK.sys [?]
R3 PavTPK.sys;PavTPK.sys;\??\c:\windows\system32\PavTPK.sys --> c:\windows\system32\PavTPK.sys [?]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [11/1/2006 9:08 AM 29744]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [11/11/2009 10:44 AM 7408]
S3 sdthook;sdthook;\??\c:\windows\system32\drivers\sdthook.sys --> c:\windows\system32\drivers\sdthook.sys [?]

--- Other Services/Drivers In Memory ---

*Deregistered* - CLASSPNP_2
.
Contents of the 'Scheduled Tasks' folder

2009-11-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-13 00:33]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyServer = http=127.0.0.1:80
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
LSP: c:\program files\panda software\panda internet security 2007\pavlsp.dll
FF - ProfilePath - c:\documents and settings\Jane Bower\Application Data\Mozilla\Firefox\Profiles\8cop1c9s.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-20 20:12
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x86F2A2F6]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7508f28
\Driver\ACPI -> ACPI.sys @ 0xf739bcb8
\Driver\iaStor -> iastor.sys @ 0xf7290f80
IoDeviceObjectType -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Intel(R) 82562V 10/100 Network Connection -> SendCompleteHandler -> NDIS.sys @ 0xf7184bb0
PacketIndicateHandler -> NDIS.sys @ 0xf7191a21
SendHandler -> NDIS.sys @ 0xf716f87b
user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{175AF4D7-9CF3-F457-BF0E37CACC73FC6B}\{467C247B-D237-138A-478D2C475DF76751}\{0F112251-81FD-FF65-E1D4489D8D443FBC}*]
"WHRUBFTNUT3JMXQXKMKSXOBADA1"=hex:01,00,01,00,00,00,00,00,7d,86,67,30,10,5d,1c,
b8,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1120)
c:\windows\system32\WININET.dll
c:\windows\system32\MrvGINA.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\avldr.dll

- - - - - - - > 'lsass.exe'(1184)
c:\windows\system32\WININET.dll

- - - - - - - > 'Explorer.exe'(5644)
c:\windows\system32\WININET.dll
c:\program files\Panda Software\Panda Internet Security 2007\pavoepl.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\NETGEAR\WG311v3\WinDomainlogon.exe
c:\program files\Panda Software\Panda Internet Security 2007\pavsrv51.exe
c:\program files\Panda Software\Panda Internet Security 2007\AVENGINE.EXE
c:\program files\Panda Software\Panda Internet Security 2007\TPSrv.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\program files\Panda Software\Panda Internet Security 2007\PsCtrls.exe
c:\program files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe
c:\program files\Common Files\Panda Software\PavShld\pavprsrv.exe
c:\program files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe
c:\program files\panda software\panda internet security 2007\firewall\PSHOST.EXE
c:\program files\Panda Software\Panda Internet Security 2007\psimsvc.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\program files\NETGEAR\WG311v3\WinDomainlogon.exe
c:\program files\NETGEAR\WG311v3\WinDomainlogon.exe
c:\program files\NETGEAR\WG311v3\wlancfg5.exe
c:\windows\eHome\ehmsas.exe
c:\program files\Panda Software\Panda Internet Security 2007\SRVLOAD.EXE
c:\program files\Panda Software\Panda Internet Security 2007\WebProxy.exe
c:\program files\Panda Software\Panda Internet Security 2007\PavBckPT.exe
.
**************************************************************************
.
Completion time: 2009-11-20 20:19 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-21 04:19
ComboFix2.txt 2009-11-20 18:37

Pre-Run: 138,162,212,864 bytes free
Post-Run: 138,104,283,136 bytes free

- - End Of File - - 3E3A2A3D6AA21A9E44D2AF9DDB0F16B3

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:21:09 PM, on 11/20/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\AVENGINE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\PsCtrls.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe
c:\program files\panda software\panda internet security 2007\firewall\PSHOST.EXE
C:\Program Files\Panda Software\Panda Internet Security 2007\psimsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe
C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe
C:\ComboFix\CF1852.cfxxe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\SRVLOAD.EXE
C:\Program Files\Panda Software\Panda Internet Security 2007\WebProxy.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\PavBckPT.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\avciman.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\psimreal.exe
C:\WINDOWS\regedit.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...us&ibd=5061101
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:80
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Internet Security 2007\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NETGEAR WG311v3 Smart Wizard.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1164155393781
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Intel(R) Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv51.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe
O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda software\panda internet security 2007\firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\psimsvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe

--
End of file - 10522 bytes

Uninstall Combofix:
Go Start > Run [Vista users, go Start>"Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall"
Restart computer.

===============================================================

Please download JavaRa to your desktop and unzip it to its own folder

• Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
• Accept any prompts.
• Open JavaRa.exe again and select Search For Updates.
• Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

=============================================================

Print this post out, since you won't have an access to it, at some point.

1. Open HijackThis.

2. Close all windows, except for HijackThis.

3. Put checkmarks next to the following HijackThis entries:

- O4 - Global Startup: NETGEAR WG311v3 Smart Wizard.lnk = ?


4. You should also checkmark following entries (these are unnecessary startups; no actual programs will be removed):

- O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
- O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
- O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
- O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
- O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
- O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
- O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
- O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll


5. Click on Fix checked button.

6. Restart computer.

7. Post new HijackThis log.

Sorry for the delay. I was out of town for the last week-and-a-half.



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:45:09 PM, on 12/3/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\AVENGINE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\PsCtrls.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe
c:\program files\panda software\panda internet security 2007\firewall\PSHOST.EXE
C:\Program Files\Panda Software\Panda Internet Security 2007\psimsvc.exe
C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\ApvxdWin.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\SRVLOAD.EXE
C:\Program Files\Panda Software\Panda Internet Security 2007\WebProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...us&ibd=5061101
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:80
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Internet Security 2007\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1164155393781
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Intel(R) Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv51.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe
O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda software\panda internet security 2007\firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\psimsvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe

--
End of file - 9789 bytes

Your computer is clean https://discussions.virtualdr.com/

1. Download Temp File Cleaner (TFC)
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

2. Turn off System Restore:

- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK

3. Restart computer.

4. Turn System Restore on.

5. Make sure, Windows Updates are current.

6. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

7. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

8. Run defrag at your convenience.

9. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

10. Please, let me know, how is your computer doing.

Everything looks good, and thankfully, I can say I know exactly where the infection most likely came from. After a quick refresher on not opening unusual email links/attachments, I think that PC should be safe for a long while.

Very good :)
Happy surfing :)