Ok everything went great with ComboFix, I've noticed a huge difference already. It's still really laggy though.
Combo fix log:
ComboFix 08-05-21.3 - Nitro 2008-05-23 1:24:08.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1649 [GMT -3:00]
Running from: C:\Documents and Settings\Nitro\Desktop\Combo-Fix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\Google\googletoolbar1.dll
C:\WINDOWS\BM93b340a6.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\afwqfnhp.exe
C:\WINDOWS\system32\awtqoMdd.dll
C:\WINDOWS\system32\clbdll.dll
C:\WINDOWS\system32\clbinit.dll
C:\WINDOWS\system32\drivers\clbdriver.sys
C:\WINDOWS\system32\dwsxleot.dll
C:\WINDOWS\system32\elqdiwao.dll
C:\WINDOWS\system32\FgMlkUtv.ini
C:\WINDOWS\system32\FgMlkUtv.ini2
C:\WINDOWS\system32\hfnfsffn.dll
C:\WINDOWS\system32\iumftfhi.exe
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mnTsttwa.ini
C:\WINDOWS\system32\mnTsttwa.ini2
C:\WINDOWS\system32\noeujqfw.dll
C:\WINDOWS\system32\rcoytiwk.exe
C:\WINDOWS\system32\ruscvrau.dll
C:\WINDOWS\system32\sbomrfik.dll
C:\WINDOWS\system32\wpfdcxpj.exe
C:\WINDOWS\system32\wwtdaduo.dll
C:\WINDOWS\system32\yualryip.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_CLBDRIVER
((((((((((((((((((((((((( Files Created from 2008-04-23 to 2008-05-23 )))))))))))))))))))))))))))))))
.
2008-05-21 21:26 . 2008-05-21 21:26 <DIR> d-------- C:\WINDOWS\ERUNT
2008-05-21 21:25 . 2008-05-21 21:25 <DIR> d-------- C:\SDfix
2008-05-21 03:04 . 2008-05-21 03:04 <DIR> d-------- C:\Documents and Settings\Nitro\Application Data\TrojanHunter
2008-05-20 23:31 . 2008-05-20 23:32 <DIR> d-------- C:\Program Files\TrojanHunter 5.0
2008-05-19 22:34 . 2008-05-19 22:34 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-05-19 22:34 . 2008-05-19 22:34 <DIR> d-------- C:\Documents and Settings\Nitro\Application Data\SUPERAntiSpyware.com
2008-05-19 22:34 . 2008-05-19 22:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-05-19 22:32 . 2008-05-22 22:45 326 --a------ C:\WINDOWS\wininit.ini
2008-05-18 20:21 . 2008-05-18 20:21 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-18 20:20 . 2008-05-18 20:20 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-18 20:20 . 2008-05-18 20:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-18 16:29 . 2008-05-18 16:29 <DIR> d-------- C:\Program Files\CCleaner
2008-05-18 16:15 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\
000001_.tmp
2008-05-18 16:15 . 2004-08-04 00:56 10,752 --a------ C:\WINDOWS\system32\smtpapi.dll
2008-05-18 16:15 . 2004-08-04 00:56 9,728 --a------ C:\WINDOWS\system32\rwnh.dll
2008-05-18 16:04 . 2008-05-18 16:04 0 --a------ C:\WINDOWS\system32\HFX11C9.tmp
2008-05-18 16:02 . 2008-05-18 16:02 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-05-18 16:02 . 2008-05-18 16:02 <DIR> d-------- C:\WINDOWS\system32\en
2008-05-18 16:02 . 2008-05-18 16:05 <DIR> d-------- C:\WINDOWS\system32\bits
2008-05-18 16:02 . 2008-05-18 16:02 <DIR> d-------- C:\WINDOWS\l2schemas
2008-05-18 16:02 . 2008-04-14 05:42 354,304 --a------ C:\WINDOWS\system32\SETFAA.tmp
2008-05-18 16:02 . 2008-04-14 05:40 177,152 --a------ C:\WINDOWS\system32\SETFDC.tmp
2008-05-18 16:00 . 2008-04-14 05:42 8,461,312 --a------ C:\WINDOWS\system32\SET1B6.tmp
2008-05-18 15:59 . 2007-10-26 00:36 8,454,656 --a------ C:\WINDOWS\system32\dllcache\shell32.dll
2008-05-18 15:56 . 2008-05-18 16:04 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-05-18 01:17 . 2001-08-23 09:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-05-18 01:16 . 2008-05-18 01:16 4 --a------ C:\WINDOWS\system32\hljwugsf.bin
2008-05-18 01:15 . 2008-05-18 01:15 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-18 01:15 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-18 01:15 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-17 00:30 . 2008-05-17 00:30 <DIR> d-------- C:\Deckard
2008-05-17 00:24 . 2008-05-22 21:16 <DIR> d-------- C:\HJT
2008-05-17 00:17 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
2008-05-17 00:16 . 2008-05-17 00:16 <DIR> d-------- C:\Program Files\MSBuild
2008-05-17 00:16 . 2008-05-17 00:16 <DIR> d-------- C:\Program Files\Microsoft Works
2008-05-17 00:15 . 2008-05-17 00:15 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-05-17 00:13 . 2008-05-17 00:13 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-05-17 00:12 . 2008-05-17 00:15 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-05-17 00:12 . 2008-05-17 00:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-05-17 00:11 . 2008-05-17 00:11 <DIR> dr-h----- C:\MSOCache
2008-05-16 21:24 . 2008-05-17 15:46 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-16 21:24 . 2008-05-16 21:24 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-16 03:57 . 2008-05-16 03:57 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-05-15 20:53 . 2008-05-15 20:53 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-05-15 19:53 . 2008-05-15 19:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Drivers Headquarters
2008-05-15 19:33 . 2008-05-15 19:33 1,160 --a------ C:\WINDOWS\mozver.dat
2008-05-15 15:21 . 2008-05-15 15:21 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Nero
2008-05-15 15:21 . 2008-05-15 15:21 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-15 01:52 . 2008-05-15 01:52 <DIR> d-------- C:\WINDOWS\Application Data
2008-05-15 00:16 . 2008-05-15 01:03 41,776,360 --a------ C:\WINDOWS\system32\amtmp.wav
2008-05-15 00:16 . 2008-05-15 01:03 326,368 --a------ C:\amt1
2008-05-15 00:14 . 2008-05-15 01:03 521 --a------ C:\WINDOWS\MP3trtg.ini
2008-05-15 00:08 . 2008-05-15 00:12 <DIR> d-------- C:\Program Files\Coding Workshop Ringtone Converter
2008-05-15 00:08 . 2004-02-19 05:11 511,488 --a------ C:\WINDOWS\system32\cwmdtl50a.dll
2008-05-15 00:08 . 1998-10-07 05:53 305,432 --a------ C:\WINDOWS\system32\Threed20.ocx
2008-05-15 00:08 . 2003-06-30 16:39 102,400 --a------ C:\WINDOWS\system32\cwsmaf40.dll
2008-05-12 20:02 . 2008-05-12 20:02 <DIR> d-------- C:\Documents and Settings\Nitro\Application Data\CSOdessa
2008-05-12 20:01 . 2008-05-13 00:46 <DIR> d-------- C:\Program Files\CS Odessa
2008-05-11 15:22 . 2008-05-11 15:22 <DIR> d-------- C:\WINDOWS\system32\QuickTime
2008-05-11 15:22 . 2008-05-11 15:22 <DIR> d-------- C:\Program Files\Common Files\TechSmith Shared
2008-05-11 15:22 . 2008-05-11 15:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TechSmith
2008-05-11 15:22 . 2007-08-27 10:53 107,864 --a------ C:\WINDOWS\system32\tsccvid.dll
2008-05-11 15:21 . 2008-05-11 15:21 <DIR> d-------- C:\Program Files\TechSmith
2008-05-10 21:57 . 2008-05-10 22:54 <DIR> d-------- C:\Program Files\EDraw Max
2008-05-10 20:32 . 2004-03-05 01:13 644,400 --a------ C:\WINDOWS\system32\MSCOMCT2.OCX
2008-05-10 20:29 . 2008-05-10 20:29 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2008-05-10 19:42 . 2008-05-10 19:42 <DIR> d-------- C:\Program Files\IGC
2008-05-10 18:52 . 2008-05-10 18:52 <DIR> d-------- C:\Documents and Settings\Nitro\Application Data\Apple Computer
2008-05-10 18:50 . 2008-05-10 18:50 <DIR> d-------- C:\Program Files\Apple Software Update
2008-05-10 18:50 . 2008-05-10 18:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-10 18:50 . 2008-05-10 18:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-05-10 17:13 . 2008-05-10 17:17 <DIR> d-------- C:\Documents and Settings\Nitro\Application Data\DivX
2008-05-10 17:12 . 2008-05-10 19:47 <DIR> d-------- C:\Program Files\DivX
2008-05-10 17:12 . 2008-01-04 18:58 120,056 --a------ C:\WINDOWS\system32\pxcpyi64.exe
2008-05-10 17:12 . 2008-01-04 18:58 118,520 --a------ C:\WINDOWS\system32\pxinsi64.exe
2008-05-09 00:04 . 2008-05-09 00:04 <DIR> d-------- C:\Program Files\IMSI
2008-05-08 23:58 . 2008-05-09 21:55 <DIR> d-------- C:\Program Files\MagicISO
2008-05-08 20:08 . 2008-05-08 20:08 22,328 --a------ C:\Documents and Settings\Nitro\Application Data\PnkBstrK.sys
2008-05-08 19:50 . 2008-05-08 19:50 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-05-07 19:53 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
2008-05-07 19:53 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2008-05-07 19:53 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2008-05-06 22:15 . 2008-05-06 22:15 0 --a------ C:\WINDOWS\nsreg.dat
2008-05-01 21:33 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
2008-05-01 21:33 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
2008-05-01 21:33 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
2008-05-01 21:33 . 2007-05-31 19:30 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
2008-05-01 21:33 . 2007-05-31 19:29 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
2008-05-01 21:32 . 2008-05-01 21:32 319 --a------ C:\WINDOWS\game.ini
2008-05-01 21:22 . 2008-05-01 21:22 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-04-30 23:39 . 2008-04-30 23:45 <DIR> d-------- C:\Documents and Settings\Nitro\Application Data\HP
2008-04-30 23:39 . 2006-04-12 22:04 49,664 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys
2008-04-30 23:39 . 2006-04-12 22:04 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2008-04-30 23:26 . 2008-04-30 23:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\HP
2008-04-30 23:25 . 2008-04-30 23:26 <DIR> d-------- C:\Program Files\Common Files\HP
2008-04-30 23:23 . 2008-04-30 23:23 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-04-30 23:23 . 2008-04-30 23:23 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-04-30 23:18 . 2008-04-30 23:40 117,132 --a------ C:\WINDOWS\hpoins11.dat
2008-04-30 22:44 . 2006-01-04 06:12 77,824 -ra------ C:\WINDOWS\system32\HPZIDS01.dll
2008-04-30 22:44 . 2006-04-10 14:03 38,400 --a------ C:\WINDOWS\system32\hpz3l054.dll
2008-04-30 22:43 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-04-30 22:43 . 2006-03-03 21:03 282,680 --a------ C:\WINDOWS\system32\HPZidr12.dll
2008-04-30 22:43 . 2006-03-03 21:02 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2008-04-30 22:43 . 2006-03-03 21:02 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2008-04-30 22:43 . 2006-03-03 21:03 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2008-04-30 22:43 . 2006-03-03 21:03 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe
2008-04-30 22:43 . 2006-03-03 21:02 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2008-04-30 00:54 . 2008-05-10 19:48 <DIR> d-------- C:\Documents and Settings\Nitro\Application Data\Microsoft Games
2008-04-28 23:51 . 2008-04-28 23:51 <DIR> d-------- C:\Documents and Settings\Nitro\System
2008-04-28 23:51 . 2008-04-29 00:23 <DIR> d-------- C:\Documents and Settings\Nitro\Application Data\SmartDraw
2008-04-28 23:38 . 2008-05-09 21:58 <DIR> d-------- C:\Program Files\SmartDraw 2008
2008-04-28 21:34 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
2008-04-28 21:34 . 2007-03-12 16:42 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll
2008-04-28 21:34 . 2007-03-15 16:57 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll
2008-04-28 21:34 . 2007-04-04 18:55 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll
2008-04-28 21:34 . 2007-01-24 15:27 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll
2008-04-27 23:23 . 2008-05-10 17:59 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-04-26 19:54 . 2008-04-26 19:54 <DIR> d-------- C:\Program Files\Common Files\Control Panels
2008-04-26 19:51 . 2008-04-26 19:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ALM
2008-04-26 19:44 . 2008-05-10 18:51 <DIR> d-------- C:\Program Files\QuickTime
2008-04-26 19:40 . 2007-02-20 16:04 2,463,976 --a------ C:\WINDOWS\system32\NPSWF32.dll
2008-04-26 19:40 . 2007-02-20 16:04 190,696 --a------ C:\WINDOWS\system32\NPSWF32_FlashUtil.exe
2008-04-26 19:33 . 2008-04-26 19:33 <DIR> d-------- C:\Program Files\Bonjour
2008-04-26 19:23 . 2008-04-26 19:23 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-04-25 19:42 . 2008-05-23 01:32 51 --a------ C:\WINDOWS\iTouch.ini
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-23 04:24 --------- d-----w C:\Program Files\Google
2008-05-23 04:07 --------- d-----w C:\Documents and Settings\Nitro\Application Data\uTorrent
2008-05-21 02:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-05-18 04:19 --------- d-----w C:\Program Files\Driver Magician
2008-05-15 22:53 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-01 02:26 --------- d-----w C:\Program Files\HP
2008-04-25 22:38 --------- d-----w C:\Program Files\Logitech
2008-04-25 22:37 --------- d-----w C:\Program Files\Common Files\Logitech
2008-04-23 21:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2008-04-23 02:47 --------- d-----w C:\Program Files\DIFX
2008-04-23 02:42 --------- d-----w C:\Program Files\NVIDIA Corporation
2008-04-23 01:53 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-04-23 01:05 --------- d-----w C:\Documents and Settings\Nitro\Application Data\InstallShield
2008-04-22 23:25 --------- d-----w C:\Program Files\uTorrent
2008-04-22 22:27 --------- d-----w C:\Program Files\XPC Tools
2008-04-22 21:43 --------- d-----w C:\Program Files\Realtek
2008-04-22 21:11 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-04-22 08:58 --------- d-----w C:\Program Files\microsoft frontpage
2008-04-14 08:45 218,134 ----a-w C:\WINDOWS\AppPatch\SET4FC.tmp
2008-04-14 08:45 204,396 ----a-w C:\WINDOWS\AppPatch\SET4FB.tmp
2008-04-14 08:45 1,202,774 ----a-w C:\WINDOWS\AppPatch\SET4FA.tmp
2008-04-14 08:41 97,280 ----a-w C:\WINDOWS\system32\SET2E6.tmp
2008-04-14 08:39 9,344 ----a-w C:\WINDOWS\system32\SET33B.tmp
2008-04-14 08:39 285,696 ----a-w C:\WINDOWS\system32\SET3EF.tmp
2008-04-14 02:07 208,384 ----a-w C:\WINDOWS\system32\SET1DB.tmp
2008-04-14 01:56 94,208 ----a-w C:\WINDOWS\system32\SET22E.tmp
2008-04-14 01:56 90,112 ----a-w C:\WINDOWS\system32\SET199.tmp
2008-04-14 01:56 12,288 ----a-w C:\WINDOWS\system32\SET2B1.tmp
2008-04-14 01:56 12,288 ----a-w C:\WINDOWS\system32\SET22B.tmp
2008-04-14 01:54 20,480 ----a-w C:\WINDOWS\system32\SET289.tmp
2008-04-14 01:33 63,488 ----a-w C:\WINDOWS\system32\SET3E2.tmp
2008-04-14 01:33 549,376 ----a-w C:\WINDOWS\system32\SET1B8.tmp
2008-04-14 00:53 48,128 ----a-w C:\WINDOWS\system32\SET284.tmp
2008-04-14 00:09 884,736 ----a-w C:\WINDOWS\system32\SET296.tmp
2008-03-26 21:37 4,713,472 ----a-w C:\WINDOWS\system32\drivers\RtkHDAud.sys
2008-03-26 19:14 16,859,136 ----a-w C:\WINDOWS\RTHDCPL.exe
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
2008-03-19 09:47 1,845,248 ------w C:\WINDOWS\system32\_006192_.tmp.dll
2008-03-05 21:07 520,192 ----a-w C:\WINDOWS\RtlExUpd.dll
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{78ED0603-1147-4185-ADF5-43A82C4511E3}]
C:\WINDOWS\system32\vtUklMgF.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E9E4E7D5-2E98-4FB5-8A5E-1A7FB287171C}]
C:\WINDOWS\system32\cbXNGwwt.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-22 18:15 68856]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2007-12-13 19:10 1688872]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-13 12:43 1510640]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-03-26 16:14 16859136 C:\WINDOWS\RTHDCPL.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 09:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-04-09 09:23 200704]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-03-27 03:35 36352]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-11-01 19:12 582992]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6261\SiteAdv.exe" [2007-08-24 18:57 36640]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 14:57 153136]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-12-03 14:21 2213160]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2002-11-23 02:15 631362]
"Acrobat Assistant 8.0"="M:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 23:24 620152]
"Adobe_ID0EYTHM"="C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 16:40 1884160]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-31 23:13 385024]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"9080733a"="C:\WINDOWS\system32\purxxgha.dll" [ ]
"THGuard"="C:\Program Files\TrojanHunter 5.0\THGuard.exe" [2008-03-25 19:08 1047712]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000003}\_SC_Acrobat.exe [2008-04-26 19:44:04 295606]
Adobe Acrobat Synchronizer.lnk - M:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 00:01:50 734872]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22 288472]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-04-25 19:38:39 169472]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 10:13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli scecli
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 13:24 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2008-04-22 18:15 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server
R2 mbamdrvservice;MBAMDrvService;C:\WINDOWS\system32\drivers\mbam.sys [2008-05-05 20:46]
R2 mbamservice;MBAMService;"C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe" [2008-05-05 20:46]
R3 hcw18bda;Hauppauge WinTV 418 Driver;C:\WINDOWS\system32\drivers\hcw18bda.sys [2007-04-18 16:30]
R3 LCcfltr;Logitech USB Filter Driver;C:\WINDOWS\system32\Drivers\LCcFltr.Sys [2003-12-17 09:50]
S2 windows action script;Windows Action Script;"C:\WINDOWS\system32\scvhost.exe" []
S3 MBAMCatchMe;MBAMCatchMe;C:\WINDOWS\system32\drivers\mbamcatchme.sys [2008-05-05 20:46]
*Newly Created Service* - SITEADVISOR_SERVICE
.
Contents of the 'Scheduled Tasks' folder
"2008-05-15 04:07:21 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-05-01 04:17:02 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-05-23 01:32:20
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\PROGRA~1\COMMON~1\McAfee\MNA\McNASvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE
C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
C:\Program Files\McAfee\VirusScan\Mcshield.exe
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamtrayctrl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
C:\Program Files\SiteAdvisor\6261\SAService.exe
C:\PROGRA~1\McAfee\MSC\mcuimgr.exe
.
**************************************************************************
.
Completion time: 2008-05-23 1:37:54 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-23 04:37:20
Pre-Run: 28,423,901,184 bytes free
Post-Run: 28,305,932,288 bytes free
356 --- E O F --- 2008-04-23 21:52:47
GMER log:
GMER 1.0.14.14205 -
http://www.gmer.netRootkit scan 2008-05-23 18:08:34
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.14 ----
SSDT \??\C:\WINDOWS\system32\drivers\mbam.sys ZwCreateSection [0xB0EAB700]
SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xB15F7F20]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xB153C9AA]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xB153C958]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xB153C96C]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xB153C9EA]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xB153C930]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xB153C944]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xB153C9BE]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0xB153C996]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xB153C982]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xB153CA19]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xB153CA00]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xB153C9D4]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess
---- Kernel code sections - GMER 1.0.14 ----
.text ntkrnlpa.exe!ZwYieldExecution 80503FC8 7 Bytes JMP B153C9D8 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
---- User code sections - GMER 1.0.14 ----
.text C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe[344] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 0137F6E0 C:\Program Files\SiteAdvisor\6261\saPlugin.dll
.text C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe[344] kernel32.dll!SetUnhandledExceptionFilter 7C84467D 5 Bytes JMP 0056DBBD C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe (Windows Live Messenger/Microsoft Corporation)
.text C:\WINDOWS\system32\services.exe[808] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00FE0FEF
.text C:\WINDOWS\system32\services.exe[808] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00FE0076
.text C:\WINDOWS\system32\services.exe[808] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00FE0F81
.text C:\WINDOWS\system32\services.exe[808] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00FE0F92
.text C:\WINDOWS\system32\services.exe[808] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00FE005B
.text C:\WINDOWS\system32\services.exe[808] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00FE0FC3
.text C:\WINDOWS\system32\services.exe[808] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00FE00BF
.text C:\WINDOWS\system32\services.exe[808] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00FE00AE
.text C:\WINDOWS\system32\services.exe[808] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00FE00EB
.text C:\WINDOWS\system32\services.exe[808] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00FE00DA
.text C:\WINDOWS\system32\services.exe[808] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 00FE00FC
.text C:\WINDOWS\system32\services.exe[808] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 00FE004A
.text C:\WINDOWS\system32\services.exe[808] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 00FE000A
.text C:\WINDOWS\system32\services.exe[808] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 00FE0087
.text C:\WINDOWS\system32\services.exe[808] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 00FE0FD4
.text C:\WINDOWS\system32\services.exe[808] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 00FE0025
.text C:\WINDOWS\system32\services.exe[808] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00FE0F5C
.text C:\WINDOWS\system32\services.exe[808] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00FD0F9E
.text C:\WINDOWS\system32\services.exe[808] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 00FD0025
.text C:\WINDOWS\system32\services.exe[808] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00FD0FB9
.text C:\WINDOWS\system32\services.exe[808] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00FD0FCA
.text C:\WINDOWS\system32\services.exe[808] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00FD0F72
.text C:\WINDOWS\system32\services.exe[808] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00FD0F8D
.text C:\WINDOWS\system32\services.exe[808] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00FD0FE5
.text C:\WINDOWS\system32\services.exe[808] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00FD0014
.text C:\WINDOWS\system32\services.exe[808] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00A40FEF
.text C:\WINDOWS\system32\lsass.exe[820] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00F70FEF
.text C:\WINDOWS\system32\lsass.exe[820] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00F70F79
.text C:\WINDOWS\system32\lsass.exe[820] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00F70F94
.text C:\WINDOWS\system32\lsass.exe[820] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00F70FA5
.text C:\WINDOWS\system32\lsass.exe[820] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00F70062
.text C:\WINDOWS\system32\lsass.exe[820] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00F70051
.text C:\WINDOWS\system32\lsass.exe[820] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00F70093
.text C:\WINDOWS\system32\lsass.exe[820] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00F70F57
.text C:\WINDOWS\system32\lsass.exe[820] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00F700BF
.text C:\WINDOWS\system32\lsass.exe[820] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00F70F30
.text C:\WINDOWS\system32\lsass.exe[820] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 00F70F15
.text C:\WINDOWS\system32\lsass.exe[820] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 00F70FCA
.text C:\WINDOWS\system32\lsass.exe[820] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 00F7000A
.text C:\WINDOWS\system32\lsass.exe[820] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 00F70F68
.text C:\WINDOWS\system32\lsass.exe[820] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 00F70036
.text C:\WINDOWS\system32\lsass.exe[820] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 00F7001B
.text C:\WINDOWS\system32\lsass.exe[820] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00F700AE
.text C:\WINDOWS\system32\lsass.exe[820] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00F6001B
.text C:\WINDOWS\system32\lsass.exe[820] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 00F60F68
.text C:\WINDOWS\system32\lsass.exe[820] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00F60FD4
.text C:\WINDOWS\system32\lsass.exe[820] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00F60FE5
.text C:\WINDOWS\system32\lsass.exe[820] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00F60F83
.text C:\WINDOWS\system32\lsass.exe[820] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00F60F94
.text C:\WINDOWS\system32\lsass.exe[820] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00F60000
.text C:\WINDOWS\system32\lsass.exe[820] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00F60FAF
.text C:\WINDOWS\system32\lsass.exe[820] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00BC0000
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00920FEF
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00920093
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00920F9E
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00920FAF
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 0092006C
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00920036
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00920F55
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00920F66
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00920F04
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00920F15
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 009200C2
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 00920051
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 00920FDE
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 00920F83
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 00920025
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 00920014
.text C:\WINDOWS\system32\svchost.exe[1000] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00920F3A
.text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00910FB9
.text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 0091004A
.text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00910FCA
.text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00910FE5
.text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00910F83
.text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 0091002F
.text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00910000
.text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00910FA8
.text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 008D0000
.text C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00B10FEF
.text C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00B100AC
.text C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00B10FB7
.text C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00B10FC8
.text C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00B10087
.text C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00B1005B
.text C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00B100F5
.text C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00B100D8
.text C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00B10F92
.text C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00B1012B
.text C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 00B10F81
.text C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 00B10076
.text C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 00B10014
.text C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 00B100C7
.text C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 00B10036
.text C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 00B10025
.text C:\WINDOWS\system32\svchost.exe[1084] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00B10110
.text C:\WINDOWS\system32\svchost.exe[1084] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00B00FC3
.text C:\WINDOWS\system32\svchost.exe[1084] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 00B0006F
.text C:\WINDOWS\system32\svchost.exe[1084] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00B00FDE
.text C:\WINDOWS\system32\svchost.exe[1084] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00B00FEF
.text C:\WINDOWS\system32\svchost.exe[1084] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00B00FA8
.text C:\WINDOWS\system32\svchost.exe[1084] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00B00054
.text C:\WINDOWS\system32\svchost.exe[1084] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00B0000A
.text C:\WINDOWS\system32\svchost.exe[1084] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00B00039
.text C:\WINDOWS\system32\svchost.exe[1084] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00AE0000
.text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 01F8000A
.text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 01F80FB7
.text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 01F800A2
.text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 01F80091
.text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 01F80080
.text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 01F80FD4
.text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 01F80F95
.text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 01F80FA6
.text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 01F80F69
.text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 01F80F7A
.text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 01F80F58
.text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 01F8005B
.text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 01F80FE5
.text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 01F800C7
.text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 01F80036
.text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 01F8001B
.text C:\WINDOWS\System32\svchost.exe[1180] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 01F800F8
.text C:\WINDOWS\System32\svchost.exe[1180] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 01F00FB9
.text C:\WINDOWS\System32\svchost.exe[1180] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 01F0001B
.text C:\WINDOWS\System32\svchost.exe[1180] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 01F00FCA
.text C:\WINDOWS\System32\svchost.exe[1180] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 01F00FDB
.text C:\WINDOWS\System32\svchost.exe[1180] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 01F00F5E
.text C:\WINDOWS\System32\svchost.exe[1180] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 01F00F79
.text C:\WINDOWS\System32\svchost.exe[1180] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 01F00000
.text C:\WINDOWS\System32\svchost.exe[1180] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 01F00F94
.text C:\WINDOWS\System32\svchost.exe[1180] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 01EE0000
.text C:\WINDOWS\System32\svchost.exe[1180] WININET.dll!InternetOpenA 42C2C851 5 Bytes JMP 01ED0FEF
.text C:\WINDOWS\System32\svchost.exe[1180] WININET.dll!InternetOpenW 42C2CE81 5 Bytes JMP 01ED000A
.text C:\WINDOWS\System32\svchost.exe[1180] WININET.dll!InternetOpenUrlA 42C30BAA 5 Bytes JMP 01ED0FD4
.text C:\WINDOWS\System32\svchost.exe[1180] WININET.dll!InternetOpenUrlW 42C7AE09 5 Bytes JMP 01ED0025
.text C:\WINDOWS\System32\svchost.exe[1244] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 007A0000
.text C:\WINDOWS\System32\svchost.exe[1244] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 007A007A
.text C:\WINDOWS\System32\svchost.exe[1244] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 007A0F8F
.text C:\WINDOWS\System32\svchost.exe[1244] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 007A0FA0
.text C:\WINDOWS\System32\svchost.exe[1244] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 007A0069
.text C:\WINDOWS\System32\svchost.exe[1244] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 007A0033
.text C:\WINDOWS\System32\svchost.exe[1244] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 007A00B2
.text C:\WINDOWS\System32\svchost.exe[1244] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 007A0095
.text C:\WINDOWS\System32\svchost.exe[1244] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 007A0F34
.text C:\WINDOWS\System32\svchost.exe[1244] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 007A00C3
.text C:\WINDOWS\System32\svchost.exe[1244] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 007A00F2
.text C:\WINDOWS\System32\svchost.exe[1244] kernel32.dll!LoadLibraryW