Can someone plase have a look on my logs
Results 1 to 13 of 13

Thread: Can someone plase have a look on my logs

  1. January 24th, 2010, 11:52 AM #1
    Lars-J
    Lars-J is offline Virtual Med Student
    Join Date
    Nov 2008
    Posts
    18

    Can someone plase have a look on my logs

    Hi Guys

    Can you please have a look on my logs, my computer is acting a bit weird and I can't really put my finger on it.

    Thanks.
    Lars

    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 01/24/2010 at 02:10 PM

    Application Version : 4.26.1000

    Core Rules Database Version : 4511
    Trace Rules Database Version: 2323

    Scan type : Complete Scan
    Total Scan Time : 01:21:32

    Memory items scanned : 281
    Memory threats detected : 0
    Registry items scanned : 7406
    Registry threats detected : 0
    File items scanned : 149649
    File threats detected : 22

    Adware.Tracking Cookie
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\lars@clicksor[1].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\lars@clicksor[2].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\lars@imrworldwide[2].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\lars@media6degrees[2].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\lars@mediafire[1].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\lars@mediaonenetwork[1].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\lars@myroitracking[2].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\lars@partyaccount[1].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\lars@partypoker[2].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\lars@statcounter[1].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\lars@warez-dk[1].txt
    C:\Users\Lars\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt


    Malwarebytes' Anti-Malware 1.44
    Database version: 3510
    Windows 6.0.6002 Service Pack 2
    Internet Explorer 8.0.6001.18865

    24-01-2010 15:49:12
    mbam-log-2010-01-24 (15-49-12).txt

    Skan type: Fuldstændig skanning (C:\|D:\|E:\|)
    Objekter skannet: 218984
    Tid tilbagelagt: 1 hour(s), 22 minute(s), 14 second(s)

    Inficerede Hukommelses Processer: 0
    Inficerede Hukommelses Moduler: 0
    Inficerede Registeringsdatabase Nøgler: 0
    Inficerede Registeringsdatabase Værdier: 0
    Inficerede Registeringsdatabase Filer: 0
    Inficerede Mapper: 0
    Inficerede Filer: 0

    Inficerede Hukommelses Processer:
    (Ingen mistænkelige filer fundet)

    Inficerede Hukommelses Moduler:
    (Ingen mistænkelige filer fundet)

    Inficerede Registeringsdatabase Nøgler:
    (Ingen mistænkelige filer fundet)

    Inficerede Registeringsdatabase Værdier:
    (Ingen mistænkelige filer fundet)

    Inficerede Registeringsdatabase Filer:
    (Ingen mistænkelige filer fundet)

    Inficerede Mapper:
    (Ingen mistænkelige filer fundet)

    Inficerede Filer:
    (Ingen mistænkelige filer fundet)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 16:40:20, on 24-01-2010
    Platform: Windows Vista SP2 (WinNT 6.00.1906)
    MSIE: Internet Explorer v8.00 (8.00.6001.18865)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\AVG\AVG8\avgtray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Windows\RtHDVCpl.exe
    C:\Users\Lars\AppData\Local\Temp\RtkBtMnt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\conime.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/yco...//uk.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://da.intl.acer.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://da.intl.acer.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/yco...//uk.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    R3 - URLSearchHook: IObitCom Toolbar - {31c7d459-9cc3-44f2-9dca-fc11795309b4} - C:\Program Files\IObitCom\tbIObi.dll
    O1 - Hosts: ::1 localhost 127.0.0.1 q4master.idsoftware.com
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: IObitCom Toolbar - {31c7d459-9cc3-44f2-9dca-fc11795309b4} - C:\Program Files\IObitCom\tbIObi.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: ZoneAlarm Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
    O2 - BHO: Hjælp til tilmelding til Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O3 - Toolbar: IObitCom Toolbar - {31c7d459-9cc3-44f2-9dca-fc11795309b4} - C:\Program Files\IObitCom\tbIObi.dll
    O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETVÆRKSTJENESTE')
    O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
    O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...oUploader5.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1240306800017
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1240306917283
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
    O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/a.../e-Safekey.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
    O23 - Service: Tjenesten Google Update (gupdate1c9e3758e5a9082) (gupdate1c9e3758e5a9082) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
    O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\Windows\runservice.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
    O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
    O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Player\vmware-authd.exe
    O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe
    O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
    O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

    --
    End of file - 8613 bytes


    Is the Gmer log neccessary? the forum said my post had to many characters

    Thanks again
    Reply With Quote Reply With Quote
  2. January 24th, 2010, 11:56 AM #2
    Train
    Train is offline Friend of Site Staff
    Join Date
    Apr 2000
    Location
    Sheboygan, WI
    Posts
    53,391
    GMER - Split and paste it in consecutive post.
    Reply With Quote Reply With Quote
  3. January 24th, 2010, 01:31 PM #3
    Lars-J
    Lars-J is offline Virtual Med Student
    Join Date
    Nov 2008
    Posts
    18
    GMER 1.0.15.15281 - http://www.gmer.net
    Rootkit scan 2010-01-24 16:34:38
    Windows 6.0.6002 Service Pack 2
    Running: 7c21qmxg[1].exe; Driver: C:\Users\Lars\AppData\Local\Temp\kgtdapoc.sys


    ---- System - GMER 1.0.15 ----

    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwAlpcConnectPort [0x8D58E0A2]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwAlpcCreatePort [0x8D58E972]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwConnectPort [0x8D58DAF8]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateFile [0x8D5870D8]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateKey [0x8D5A5AA6]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreatePort [0x8D58E602]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateProcess [0x8D5A1F6A]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateProcessEx [0x8D5A2392]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateSection [0x8D5AA36A]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0x8D58E760]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteFile [0x8D587F9A]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteKey [0x8D5A74BC]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteValueKey [0x8D5A6DB2]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDuplicateObject [0x8D5A0DA8]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey [0x8D5A7E86]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0x8D5A80C4]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKeyEx [0x8D5A8576]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenFile [0x8D587A8C]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenProcess [0x8D5A3FC2]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRenameKey [0x8D5A930C]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwReplaceKey [0x8D5A8840]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0x8D58D690]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRestoreKey [0x8D5A8F4C]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSecureConnectPort [0x8D58DDC4]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0x8D5883A4]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetSecurityObject [0x8D5A9894]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetValueKey [0x8D5A64D6]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSystemDebugControl [0x8D5A308E]
    SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys ZwTerminateProcess [0x8D1D7F20]
    SSDT \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateUserProcess [0x8D5A2806]

    ---- Kernel code sections - GMER 1.0.15 ----

    .text ntkrnlpa.exe!KeSetEvent + 13D 822C1880 8 Bytes [A2, E0, 58, 8D, 72, E9, 58, ...]
    .text ntkrnlpa.exe!KeSetEvent + 1C1 822C1904 4 Bytes [F8, DA, 58, 8D] {CLC ; FICOMP DWORD [EAX-0x73]}
    .text ntkrnlpa.exe!KeSetEvent + 1D9 822C191C 4 Bytes [D8, 70, 58, 8D]
    .text ntkrnlpa.exe!KeSetEvent + 1E9 822C192C 4 Bytes [A6, 5A, 5A, 8D]
    .text ntkrnlpa.exe!KeSetEvent + 205 822C1948 12 Bytes [02, E6, 58, 8D, 6A, 1F, 5A, ...]
    .text ...
    ? C:\Windows\System32\Drivers\sptd.sys Processen kan ikke få adgang til filen, da den bruges af en anden proces.
    .text USBPORT.SYS!DllUnload 87BA641B 5 Bytes JMP 85BDC770
    .text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8C00A340, 0x3FA057, 0xE8000020]
    .text atsa74ft.SYS 8C80A000 22 Bytes [82, 53, 5D, 82, 6C, 52, 5D, ...]
    .text atsa74ft.SYS 8C80A017 45 Bytes [00, 32, 57, 4F, 87, 3D, 55, ...]
    .text atsa74ft.SYS 8C80A045 99 Bytes [BA, 2B, 82, A0, BE, 25, 82, ...]
    .text atsa74ft.SYS 8C80A0A9 35 Bytes [E0, 2B, 82, 00, 00, 00, 00, ...]
    .text atsa74ft.SYS 8C80A0CE 73 Bytes [00, 00, 00, 00, 01, C2, 03, ...]
    .text ...

    ---- User code sections - GMER 1.0.15 ----

    .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[512] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[512] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[512] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[512] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[512] kernel32.dll!SetUnhandledExceptionFilter 7738A84F 5 Bytes JMP 209A37DD C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWDMP.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[512] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[512] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[512] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wininit.exe[620] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wininit.exe[620] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wininit.exe[620] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wininit.exe[620] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wininit.exe[620] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wininit.exe[620] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wininit.exe[620] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wininit.exe[620] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wininit.exe[620] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\services.exe[676] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\services.exe[676] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\services.exe[676] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\services.exe[676] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\services.exe[676] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\services.exe[676] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\services.exe[676] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\services.exe[676] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\services.exe[676] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    Reply With Quote Reply With Quote
  4. January 24th, 2010, 01:32 PM #4
    Lars-J
    Lars-J is offline Virtual Med Student
    Join Date
    Nov 2008
    Posts
    18
    .text C:\Windows\system32\lsass.exe[696] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\lsass.exe[696] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\lsass.exe[696] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\lsass.exe[696] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\lsass.exe[696] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\lsass.exe[696] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\lsass.exe[696] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\lsass.exe[696] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\lsm.exe[704] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\lsm.exe[704] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\lsm.exe[704] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\lsm.exe[704] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\lsm.exe[704] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\lsm.exe[704] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\lsm.exe[704] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\lsm.exe[704] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\lsm.exe[704] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[956] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[956] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[956] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[956] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[956] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[956] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[956] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[956] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[956] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\nvvsvc.exe[1004] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\nvvsvc.exe[1004] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\nvvsvc.exe[1004] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\nvvsvc.exe[1004] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\nvvsvc.exe[1004] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\nvvsvc.exe[1004] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\nvvsvc.exe[1004] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\nvvsvc.exe[1004] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\nvvsvc.exe[1004] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1036] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1036] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1036] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1036] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1036] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1036] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1036] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1036] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1036] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1068] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1068] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1068] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1068] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1068] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1068] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1068] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1068] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1068] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wuauclt.exe[1188] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wuauclt.exe[1188] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wuauclt.exe[1188] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text
    Reply With Quote Reply With Quote
  6. January 24th, 2010, 01:33 PM #5
    Lars-J
    Lars-J is offline Virtual Med Student
    Join Date
    Nov 2008
    Posts
    18
    C:\Windows\system32\wuauclt.exe[1188] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wuauclt.exe[1188] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wuauclt.exe[1188] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wuauclt.exe[1188] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wuauclt.exe[1188] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wuauclt.exe[1188] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1196] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1196] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1196] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1196] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1196] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1196] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1196] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1196] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1196] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1240] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1240] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1240] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1240] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1240] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1240] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1240] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1240] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\svchost.exe[1240] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1256] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1256] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1256] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1256] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1256] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1256] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1256] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1256] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1256] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1360] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1360] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1360] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1360] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1360] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1360] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1360] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1360] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1360] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\spoolsv.exe[1408] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\spoolsv.exe[1408] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\spoolsv.exe[1408] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\spoolsv.exe[1408] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\spoolsv.exe[1408] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\spoolsv.exe[1408] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\spoolsv.exe[1408] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\spoolsv.exe[1408] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\System32\spoolsv.exe[1408] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1420] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1420] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    Reply With Quote Reply With Quote
  7. January 24th, 2010, 01:33 PM #6
    Lars-J
    Lars-J is offline Virtual Med Student
    Join Date
    Nov 2008
    Posts
    18
    .text C:\Windows\system32\svchost.exe[1420] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1420] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1420] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1420] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1420] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1420] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1420] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1580] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1580] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1580] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1580] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1580] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1580] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1580] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1580] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1580] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1676] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1676] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1676] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1676] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1676] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1676] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1676] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1676] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[1676] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Users\Lars\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPK17DXN\7c21qmxg[1].exe[1824] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Users\Lars\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPK17DXN\7c21qmxg[1].exe[1824] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Users\Lars\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPK17DXN\7c21qmxg[1].exe[1824] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Users\Lars\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPK17DXN\7c21qmxg[1].exe[1824] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Users\Lars\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPK17DXN\7c21qmxg[1].exe[1824] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Users\Lars\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPK17DXN\7c21qmxg[1].exe[1824] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Users\Lars\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPK17DXN\7c21qmxg[1].exe[1824] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Users\Lars\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPK17DXN\7c21qmxg[1].exe[1824] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Users\Lars\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPK17DXN\7c21qmxg[1].exe[1824] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\conime.exe[1960] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\conime.exe[1960] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\conime.exe[1960] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\conime.exe[1960] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\conime.exe[1960] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\conime.exe[1960] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\conime.exe[1960] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\conime.exe[1960] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\conime.exe[1960] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[1984] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[1984] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[1984] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[1984] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[1984] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[1984] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[1984] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[1984] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[1984] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[2016] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[2016] USER32.dll!IsWindowUnicode + 37 76A490B5 5 Bytes JMP 20C291E8 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\taskeng.exe[2128] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\taskeng.exe[2128] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program
    Reply With Quote Reply With Quote
  8. January 24th, 2010, 01:34 PM #7
    Lars-J
    Lars-J is offline Virtual Med Student
    Join Date
    Nov 2008
    Posts
    18
    Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\taskeng.exe[2128] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\taskeng.exe[2128] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\taskeng.exe[2128] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\taskeng.exe[2128] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\taskeng.exe[2128] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\taskeng.exe[2128] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\taskeng.exe[2128] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Users\Lars\AppData\Local\Temp\RtkBtMnt.exe[2240] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Users\Lars\AppData\Local\Temp\RtkBtMnt.exe[2240] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Users\Lars\AppData\Local\Temp\RtkBtMnt.exe[2240] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Users\Lars\AppData\Local\Temp\RtkBtMnt.exe[2240] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Users\Lars\AppData\Local\Temp\RtkBtMnt.exe[2240] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Users\Lars\AppData\Local\Temp\RtkBtMnt.exe[2240] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Users\Lars\AppData\Local\Temp\RtkBtMnt.exe[2240] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Users\Lars\AppData\Local\Temp\RtkBtMnt.exe[2240] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Users\Lars\AppData\Local\Temp\RtkBtMnt.exe[2240] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\taskeng.exe[2304] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\taskeng.exe[2304] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\taskeng.exe[2304] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\taskeng.exe[2304] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\taskeng.exe[2304] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\taskeng.exe[2304] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\taskeng.exe[2304] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\taskeng.exe[2304] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\taskeng.exe[2304] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wbem\wmiprvse.exe[2492] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wbem\wmiprvse.exe[2492] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wbem\wmiprvse.exe[2492] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wbem\wmiprvse.exe[2492] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wbem\wmiprvse.exe[2492] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wbem\wmiprvse.exe[2492] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wbem\wmiprvse.exe[2492] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wbem\wmiprvse.exe[2492] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wbem\wmiprvse.exe[2492] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2804] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2804] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2804] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2804] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2804] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2804] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2804] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2804] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2804] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wbem\wmiprvse.exe[2820] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wbem\wmiprvse.exe[2820] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wbem\wmiprvse.exe[2820] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wbem\wmiprvse.exe[2820] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wbem\wmiprvse.exe[2820] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wbem\wmiprvse.exe[2820] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wbem\wmiprvse.exe[2820] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wbem\wmiprvse.exe[2820] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\wbem\wmiprvse.exe[2820] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[2832] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[2832] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    Reply With Quote Reply With Quote
  9. January 24th, 2010, 01:34 PM #8
    Lars-J
    Lars-J is offline Virtual Med Student
    Join Date
    Nov 2008
    Posts
    18
    .text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[2832] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[2832] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[2832] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[2832] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[2832] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[2832] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[2832] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Bonjour\mDNSResponder.exe[2852] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Bonjour\mDNSResponder.exe[2852] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Bonjour\mDNSResponder.exe[2852] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Bonjour\mDNSResponder.exe[2852] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Bonjour\mDNSResponder.exe[2852] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Bonjour\mDNSResponder.exe[2852] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Bonjour\mDNSResponder.exe[2852] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Bonjour\mDNSResponder.exe[2852] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Bonjour\mDNSResponder.exe[2852] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\runservice.exe[2912] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\runservice.exe[2912] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\runservice.exe[2912] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\runservice.exe[2912] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\runservice.exe[2912] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\runservice.exe[2912] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\runservice.exe[2912] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\runservice.exe[2912] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\runservice.exe[2912] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[2968] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[2968] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[2968] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[2968] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[2968] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[2968] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[2968] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[2968] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[2968] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] kernel32.dll!SetUnhandledExceptionFilter 7738A84F 5 Bytes JMP 209A37DD C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWDMP.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] USER32.dll!CreateDialogParamW 76A472A2 5 Bytes JMP 100C9ADC C:\Program Files\IObitCom\tbIObi.dll (Conduit Toolbar/Conduit Ltd.)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] USER32.dll!SetWindowsHookExW 76A487AD 5 Bytes JMP 6F0397FD C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] USER32.dll!CallNextHookEx 76A48E3B 5 Bytes JMP 6F02CE81 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] USER32.dll!IsWindowUnicode + 37 76A490B5 5 Bytes JMP 20C291E8 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] USER32.dll!UnhookWindowsHookEx 76A498DB 5 Bytes JMP 6EFA4620 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] USER32.dll!CreateWindowExW 76A51305 5 Bytes JMP 6F03D684 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] USER32.dll!DialogBoxParamW 76A710B0 5 Bytes JMP 100C9CAC C:\Program Files\IObitCom\tbIObi.dll (Conduit Toolbar/Conduit Ltd.)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] USER32.dll!DialogBoxIndirectParamW 76A72EF5 5 Bytes JMP 6F1343FF C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] USER32.dll!DialogBoxParamA 76A88152 5 Bytes JMP 6F13439C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] USER32.dll!DialogBoxIndirectParamA 76A8847D 5 Bytes JMP 6F134462 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] USER32.dll!MessageBoxIndirectA 76A9D4D9 5 Bytes JMP 6F134331 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] USER32.dll!MessageBoxIndirectW 76A9D5D3 5 Bytes JMP 6F1342C6 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] USER32.dll!MessageBoxExA 76A9D639 5 Bytes JMP 6F134264 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    Reply With Quote Reply With Quote
  11. January 24th, 2010, 01:35 PM #9
    Lars-J
    Lars-J is offline Virtual Med Student
    Join Date
    Nov 2008
    Posts
    18
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] USER32.dll!MessageBoxExW 76A9D65D 5 Bytes JMP 6F134202 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] ole32.dll!OleLoadFromStream 76911E12 5 Bytes JMP 6F134780 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] ole32.dll!CoCreateInstance 76949EA6 5 Bytes JMP 6F03D6E0 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] WS2_32.dll!closesocket 76AE330C 5 Bytes JMP 20A93BA8 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] WS2_32.dll!recv 76AE343A 5 Bytes JMP 20A93C29 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] WS2_32.dll!WSASend 76AE4496 5 Bytes JMP 20A93F07 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] WS2_32.dll!send 76AE659B 5 Bytes JMP 20A93CD3 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] WS2_32.dll!sendto 76AE67C5 5 Bytes JMP 20A93D71 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] WS2_32.dll!WSARecv 76AE8400 5 Bytes JMP 20A93E15 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] WS2_32.dll!WSASendDisconnect 76AFA3E9 5 Bytes JMP 20A9409B C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[2976] WS2_32.dll!WSASendTo 76AFA474 5 Bytes JMP 20A93FCE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Maxtor\Sync\SyncServices.exe[3020] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Maxtor\Sync\SyncServices.exe[3020] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Maxtor\Sync\SyncServices.exe[3020] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Maxtor\Sync\SyncServices.exe[3020] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Maxtor\Sync\SyncServices.exe[3020] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Maxtor\Sync\SyncServices.exe[3020] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Maxtor\Sync\SyncServices.exe[3020] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Maxtor\Sync\SyncServices.exe[3020] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Maxtor\Sync\SyncServices.exe[3020] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[3164] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[3164] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[3164] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[3164] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[3164] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[3164] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[3164] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[3164] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\svchost.exe[3164] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe[3216] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe[3216] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe[3216] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe[3216] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe[3216] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe[3216] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe[3216] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe[3216] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe[3216] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\iPod\bin\iPodService.exe[3248] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\iPod\bin\iPodService.exe[3248] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\iPod\bin\iPodService.exe[3248] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\iPod\bin\iPodService.exe[3248] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\iPod\bin\iPodService.exe[3248] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\iPod\bin\iPodService.exe[3248] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\iPod\bin\iPodService.exe[3248] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\iPod\bin\iPodService.exe[3248] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\iPod\bin\iPodService.exe[3248] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text \\?\C:\Windows\system32\wbem\WMIADAP.EXE[3280] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text \\?\C:\Windows\system32\wbem\WMIADAP.EXE[3280] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text \\?\C:\Windows\system32\wbem\WMIADAP.EXE[3280] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text \\?\C:\Windows\system32\wbem\WMIADAP.EXE[3280] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text \\?\C:\Windows\system32\wbem\WMIADAP.EXE[3280] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text \\?\C:\Windows\system32\wbem\WMIADAP.EXE[3280] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text \\?\C:\Windows\system32\wbem\WMIADAP.EXE[3280] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    Reply With Quote Reply With Quote
  12. January 24th, 2010, 01:35 PM #10
    Lars-J
    Lars-J is offline Virtual Med Student
    Join Date
    Nov 2008
    Posts
    18
    .text \\?\C:\Windows\system32\wbem\WMIADAP.EXE[3280] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text \\?\C:\Windows\system32\wbem\WMIADAP.EXE[3280] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\vmnat.exe[3392] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\vmnat.exe[3392] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\vmnat.exe[3392] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\vmnat.exe[3392] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\vmnat.exe[3392] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\vmnat.exe[3392] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\vmnat.exe[3392] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\vmnat.exe[3392] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\vmnat.exe[3392] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\DRIVERS\xaudio.exe[3432] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\DRIVERS\xaudio.exe[3432] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\DRIVERS\xaudio.exe[3432] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\DRIVERS\xaudio.exe[3432] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\DRIVERS\xaudio.exe[3432] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\DRIVERS\xaudio.exe[3432] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\DRIVERS\xaudio.exe[3432] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\DRIVERS\xaudio.exe[3432] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\DRIVERS\xaudio.exe[3432] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\VMware\VMware Player\vmware-authd.exe[3644] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\VMware\VMware Player\vmware-authd.exe[3644] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\VMware\VMware Player\vmware-authd.exe[3644] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\VMware\VMware Player\vmware-authd.exe[3644] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\VMware\VMware Player\vmware-authd.exe[3644] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\VMware\VMware Player\vmware-authd.exe[3644] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\VMware\VMware Player\vmware-authd.exe[3644] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\VMware\VMware Player\vmware-authd.exe[3644] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\VMware\VMware Player\vmware-authd.exe[3644] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\vmnetdhcp.exe[3684] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\vmnetdhcp.exe[3684] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\vmnetdhcp.exe[3684] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\vmnetdhcp.exe[3684] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\vmnetdhcp.exe[3684] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\vmnetdhcp.exe[3684] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\vmnetdhcp.exe[3684] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\vmnetdhcp.exe[3684] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Windows\system32\vmnetdhcp.exe[3684] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\PROGRA~1\AVG\AVG8\avgrsx.exe[3748] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\PROGRA~1\AVG\AVG8\avgrsx.exe[3748] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\PROGRA~1\AVG\AVG8\avgrsx.exe[3748] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\PROGRA~1\AVG\AVG8\avgrsx.exe[3748] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\PROGRA~1\AVG\AVG8\avgrsx.exe[3748] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\PROGRA~1\AVG\AVG8\avgrsx.exe[3748] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\PROGRA~1\AVG\AVG8\avgrsx.exe[3748] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\PROGRA~1\AVG\AVG8\avgrsx.exe[3748] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\PROGRA~1\AVG\AVG8\avgrsx.exe[3748] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] ntdll.dll!NtAccessCheckByType 775E4044 5 Bytes JMP 20C28709 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] ntdll.dll!NtAlpcImpersonateClientOfPort 775E4214 5 Bytes JMP 20C28D51 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] ntdll.dll!NtImpersonateClientOfPort 775E49E4 5 Bytes JMP 20C28CD0 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] ntdll.dll!NtSetInformationProcess 775E5324 5 Bytes JMP 20C28923 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] kernel32.dll!SetUnhandledExceptionFilter 7738A84F 5 Bytes JMP 209A37DD C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWDMP.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] kernel32.dll!OpenProcess 773A7267 5 Bytes JMP 20C283E4 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] ADVAPI32.dll!ImpersonateNamedPipeClient 77253A48 5 Bytes JMP 20C28DD5 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] ADVAPI32.dll!SetThreadToken 77268E21 5 Bytes JMP 20C28FAE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] USER32.dll!CreateDialogParamW 76A472A2 5 Bytes JMP 100C9ADC C:\Program Files\IObitCom\tbIObi.dll (Conduit Toolbar/Conduit Ltd.)
    Reply With Quote Reply With Quote
  13. January 24th, 2010, 01:36 PM #11
    Lars-J
    Lars-J is offline Virtual Med Student
    Join Date
    Nov 2008
    Posts
    18
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] USER32.dll!IsWindowUnicode + 37 76A490B5 5 Bytes JMP 20C291E8 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] USER32.dll!FindWindowA 76A49D76 5 Bytes JMP 20C28207 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] USER32.dll!CreateWindowExW 76A51305 5 Bytes JMP 6F03D684 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] USER32.dll!FindWindowW 76A5A441 5 Bytes JMP 20C281D2 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] USER32.dll!DialogBoxParamW 76A710B0 5 Bytes JMP 100C9CAC C:\Program Files\IObitCom\tbIObi.dll (Conduit Toolbar/Conduit Ltd.)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] USER32.dll!DialogBoxIndirectParamW 76A72EF5 5 Bytes JMP 6F1343FF C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] USER32.dll!DialogBoxParamA 76A88152 5 Bytes JMP 6F13439C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] USER32.dll!DialogBoxIndirectParamA 76A8847D 5 Bytes JMP 6F134462 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] USER32.dll!MessageBoxIndirectA 76A9D4D9 5 Bytes JMP 6F134331 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] USER32.dll!MessageBoxIndirectW 76A9D5D3 5 Bytes JMP 6F1342C6 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] USER32.dll!MessageBoxExA 76A9D639 5 Bytes JMP 6F134264 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] USER32.dll!MessageBoxExW 76A9D65D 5 Bytes JMP 6F134202 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] WS2_32.dll!closesocket 76AE330C 5 Bytes JMP 20A93BA8 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] WS2_32.dll!recv 76AE343A 5 Bytes JMP 20A93C29 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] WS2_32.dll!WSASend 76AE4496 5 Bytes JMP 20A93F07 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] WS2_32.dll!send 76AE659B 5 Bytes JMP 20A93CD3 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] WS2_32.dll!sendto 76AE67C5 5 Bytes JMP 20A93D71 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] WS2_32.dll!WSARecv 76AE8400 5 Bytes JMP 20A93E15 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] WS2_32.dll!WSASendDisconnect 76AFA3E9 5 Bytes JMP 20A9409B C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    .text C:\Program Files\Internet Explorer\iexplore.exe[3924] WS2_32.dll!WSASendTo 76AFA474 5 Bytes JMP 20A93FCE C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll (ZoneAlarm ForceField/Check Point Software Technologies)

    ---- Kernel IAT/EAT - GMER 1.0.15 ----

    IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [8740261E] \SystemRoot\System32\Drivers\sptd.sys
    IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [87401AD4] \SystemRoot\System32\Drivers\sptd.sys
    IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [87402748] \SystemRoot\System32\Drivers\sptd.sys
    IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort] [87401B9C] \SystemRoot\System32\Drivers\sptd.sys
    IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [87401C1A] \SystemRoot\System32\Drivers\sptd.sys
    IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [8741729A] \SystemRoot\System32\Drivers\sptd.sys
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortNotification] 000000DC
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortWritePortUchar] 000000A2
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortWritePortUlong] 00000333
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortGetPhysicalAddress] 000003D8
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong] 0000024D
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortGetScatterGatherList] 00000201
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortReadPortUchar] 000001EF
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortStallExecution] 0000031F
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortGetParentBusType] 000000A1
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortRequestCallback] 0000025C
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortWritePortBufferUshort] 000003BE
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortGetUnCachedExtension] 00000215
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortCompleteRequest] 000000DD
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortMoveMemory] 00000190
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests] 00000182
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb] 00000363
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb] 00000258
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortReadPortUshort] 0000030E
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortReadPortBufferUshort] 0000017E
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortInitialize] 00000254
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortGetDeviceBase] 0000019E
    IAT \SystemRoot\System32\Drivers\atsa74ft.SYS[ataport.SYS!AtaPortDeviceStateChange] 000000AB

    ---- User IAT/EAT - GMER 1.0.15 ----

    IAT C:\Windows\Explorer.EXE[12] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [74527817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
    IAT C:\Windows\Explorer.EXE[12] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [7457A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
    IAT C:\Windows\Explorer.EXE[12] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7452BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
    IAT C:\Windows\Explorer.EXE[12] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [7451F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
    IAT C:\Windows\Explorer.EXE[12] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [745275E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
    IAT C:\Windows\Explorer.EXE[12] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [7451E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
    IAT C:\Windows\Explorer.EXE[12] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [74558395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
    IAT C:\Windows\Explorer.EXE[12] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [7452DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
    IAT C:\Windows\Explorer.EXE[12] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [7451FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
    IAT C:\Windows\Explorer.EXE[12] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [7451FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
    IAT C:\Windows\Explorer.EXE[12] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [745171CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
    IAT C:\Windows\Explorer.EXE[12] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [745ACAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
    IAT C:\Windows\Explorer.EXE[12] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [7454C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
    IAT C:\Windows\Explorer.EXE[12] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [7451D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
    IAT C:\Windows\Explorer.EXE[12] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [74516853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
    IAT C:\Windows\Explorer.EXE[12] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [7451687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
    IAT C:\Windows\Explorer.EXE[12] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [74522AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
    IAT C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[512] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\wininit.exe[620] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    Reply With Quote Reply With Quote
  14. January 24th, 2010, 01:37 PM #12
    Lars-J
    Lars-J is offline Virtual Med Student
    Join Date
    Nov 2008
    Posts
    18
    IAT C:\Windows\system32\services.exe[676] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\lsass.exe[696] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\lsm.exe[704] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\svchost.exe[956] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\nvvsvc.exe[1004] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\svchost.exe[1036] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\System32\svchost.exe[1068] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\wuauclt.exe[1188] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\System32\svchost.exe[1196] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\System32\svchost.exe[1240] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\svchost.exe[1256] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\svchost.exe[1360] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\System32\spoolsv.exe[1408] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\svchost.exe[1420] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\svchost.exe[1580] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\svchost.exe[1676] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Users\Lars\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPK17DXN\7c21qmxg[1].exe[1824] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\conime.exe[1960] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe[1984] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\taskeng.exe[2128] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Users\Lars\AppData\Local\Temp\RtkBtMnt.exe[2240] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\taskeng.exe[2304] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\wbem\wmiprvse.exe[2492] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2804] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\wbem\wmiprvse.exe[2820] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe[2832] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Program Files\Bonjour\mDNSResponder.exe[2852] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\runservice.exe[2912] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Program Files\Common Files\LightScribe\LSSrvc.exe[2968] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Program Files\Internet Explorer\iexplore.exe[2976] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Program Files\Maxtor\Sync\SyncServices.exe[3020] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\svchost.exe[3164] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe[3216] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Program Files\iPod\bin\iPodService.exe[3248] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT \\?\C:\Windows\system32\wbem\WMIADAP.EXE[3280] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\vmnat.exe[3392] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\DRIVERS\xaudio.exe[3432] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Program Files\VMware\VMware Player\vmware-authd.exe[3644] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Windows\system32\vmnetdhcp.exe[3684] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\PROGRA~1\AVG\AVG8\avgrsx.exe[3748] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)
    IAT C:\Program Files\Internet Explorer\iexplore.exe[3924] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C282D4] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm ForceField/Check Point Software Technologies)

    ---- Devices - GMER 1.0.15 ----

    Device \FileSystem\Ntfs \Ntfs 83F841E8
    Device \Driver\netbt \Device\NetBT_Tcpip_{2C1E63C9-B4B8-4D9F-991B-B33D917046D2} 86EC0790

    AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 VMkbd.sys
    AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 VMkbd.sys

    Device \Driver\volmgr \Device\VolMgrControl 83F811E8
    Device \Driver\usbohci \Device\USBPDO-0 85BDF1E8
    Device \Driver\usbehci \Device\USBPDO-1 85BE51E8
    Device \Driver\usbohci \Device\USBPDO-2 85BDF1E8
    Device \Driver\usbehci \Device\USBPDO-3 85BE51E8
    Device \Driver\volmgr \Device\HarddiskVolume1 83F811E8
    Device \Driver\volmgr \Device\HarddiskVolume2 83F811E8
    Device \Driver\cdrom \Device\CdRom0 86F891E8
    Device \Driver\volmgr \Device\HarddiskVolume3 83F811E8
    Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-4 83F831E8
    Device \Driver\atapi \Device\Ide\IdePort0 83F831E8
    Device \Driver\atapi \Device\Ide\IdePort1 83F831E8
    Device \Driver\atapi \Device\Ide\IdePort2 83F831E8
    Device \Driver\atapi \Device\Ide\IdePort3 83F831E8
    Device \Driver\atapi \Device\Ide\IdeDeviceP2T1L0-5 83F831E8
    Device \Driver\cdrom \Device\CdRom1 86F891E8
    Device \Driver\volmgr \Device\HarddiskVolume4 83F811E8
    Device \Driver\netbt \Device\NetBt_Wins_Export 86EC0790
    Device \Driver\PCI_NTPNP1583 \Device\0000005a sptd.sys
    Device \Driver\netbt \Device\NetBT_Tcpip_{6889AFDC-D732-4B89-BB44-9CF84AE5D749} 86EC0790
    Device \Driver\iScsiPrt \Device\RaidPort0 85C5D1E8
    Device \Driver\usbohci \Device\USBFDO-0 85BDF1E8
    Device \Driver\usbohci \Device\USBFDO-0 hcmon.sys
    Device \Driver\usbehci \Device\USBFDO-1 85BE51E8
    Device \Driver\usbehci \Device\USBFDO-1 hcmon.sys
    Device \Driver\usbhub \Device\0000006d hcmon.sys
    Device \Driver\usbohci \Device\USBFDO-2
    Reply With Quote Reply With Quote
  15. January 24th, 2010, 01:37 PM #13
    Lars-J
    Lars-J is offline Virtual Med Student
    Join Date
    Nov 2008
    Posts
    18
    85BDF1E8
    Device \Driver\usbohci \Device\USBFDO-2 hcmon.sys
    Device \Driver\usbhub \Device\0000006e hcmon.sys
    Device \Driver\usbehci \Device\USBFDO-3 85BE51E8
    Device \Driver\usbehci \Device\USBFDO-3 hcmon.sys
    Device \Driver\usbhub \Device\0000006f hcmon.sys
    Device \Driver\atsa74ft \Device\Scsi\atsa74ft1Port5Path0Target1Lun0 85C591E8
    Device \Driver\atsa74ft \Device\Scsi\atsa74ft1 85C591E8
    Device \Driver\atsa74ft \Device\Scsi\atsa74ft1Port5Path0Target0Lun0 85C591E8

    ---- Registry - GMER 1.0.15 ----

    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x16 0x56 0x9E 0x71 ...
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xB4 0x42 0x16 0xF7 ...
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x64 0x7D 0x36 0x42 ...
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x29 0x05 0x5E 0xB7 ...
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42
    Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0x8C 0x03 0xD5 0x90 ...
    Reg HKLM\SYSTEM\ControlSet010\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet010\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
    Reg HKLM\SYSTEM\ControlSet010\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
    Reg HKLM\SYSTEM\ControlSet010\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x16 0x56 0x9E 0x71 ...
    Reg HKLM\SYSTEM\ControlSet010\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet010\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
    Reg HKLM\SYSTEM\ControlSet010\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xB4 0x42 0x16 0xF7 ...
    Reg HKLM\SYSTEM\ControlSet010\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet010\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x64 0x7D 0x36 0x42 ...
    Reg HKLM\SYSTEM\ControlSet010\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet010\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x29 0x05 0x5E 0xB7 ...
    Reg HKLM\SYSTEM\ControlSet010\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42 (not active ControlSet)
    Reg HKLM\SYSTEM\ControlSet010\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0x8C 0x03 0xD5 0x90 ...

    ---- EOF - GMER 1.0.15 ----
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules