[TXVA John]

Hello,

I ran Trend Micro's Housecall just to double-check my system after McAfee said it cleaned a trojan (Artemis, I think) from my system and came across Trend's Rootkit Buster. When I ran Rootkit Buster, it found 2 hidden registry keys - KeyPath : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data 2 and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data.

I have no idea if those are really rootkits or false positives. I don't want RootKiller to "fix" them until I know what the potential impact is of doing that.

Could someone help me with that?

Here is the OTL log:


OTL logfile created on: 5/2/2012 7:54:44 PM - Run 1
OTL by OldTimer - Version 3.2.42.2 Folder = C:\Documents and Settings\John\My Documents\Downloads
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.33 Gb Available Physical Memory | 66.50% Memory free
3.85 Gb Paging File | 2.43 Gb Available in Paging File | 63.16% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 67.84 Gb Total Space | 8.59 Gb Free Space | 12.66% Space Free | Partition Type: NTFS

Computer Name: JNH-LAP | User Name: John | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/05/02 19:46:52 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\John\My Documents\Downloads\OTL.exe
PRC - [2012/04/12 03:37:36 | 001,224,176 | ---- | M] (Google Inc.) -- C:\Documents and Settings\John\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
PRC - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/03/21 21:16:10 | 001,318,816 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2012/03/20 13:11:32 | 000,151,880 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\system32\mfevtps.exe
PRC - [2012/03/20 13:05:00 | 000,161,632 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\Mcafee\SystemCore\mfefire.exe
PRC - [2012/03/20 13:04:32 | 000,166,288 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\Mcafee\SystemCore\mcshield.exe
PRC - [2012/02/18 08:59:28 | 000,282,648 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee\SiteAdvisor\saUI.exe
PRC - [2012/01/18 02:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe
PRC - [2011/12/23 17:00:00 | 000,611,144 | R--- | M] (WinZip Computing, S.L.) -- C:\Program Files\WinZip\WZQKPICK32.EXE
PRC - [2011/11/26 17:01:03 | 000,296,056 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe
PRC - [2011/11/11 14:08:06 | 000,205,336 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
PRC - [2011/11/11 14:07:54 | 000,265,240 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
PRC - [2011/08/12 13:19:40 | 000,680,984 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2011/04/12 16:40:58 | 000,660,848 | ---- | M] (Juniper Networks) -- C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
PRC - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
PRC - [2011/01/12 22:01:28 | 006,129,496 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\Vid HD\Vid.exe
PRC - [2010/12/17 09:33:10 | 000,439,632 | ---- | M] (Trend Micro Inc.) -- C:\Program Files\Trend Micro\RUBotted\RUBotSrv.exe
PRC - [2010/04/13 20:11:14 | 000,229,688 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Online Backup\MOBKbackup.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/03/24 17:30:44 | 000,282,624 | ---- | M] (SigmaTel, Inc.) -- C:\WINDOWS\stsystra.exe
PRC - [2006/01/02 17:41:22 | 000,045,056 | ---- | M] (ATI Technologies Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe


========== Modules (No Company Name) ==========

MOD - [2012/04/12 03:37:34 | 000,444,400 | ---- | M] () -- C:\Documents and Settings\John\Local Settings\Application Data\Google\Chrome\Application\18.0.1025.162\ppgooglenaclpluginchrome.dll
MOD - [2012/04/12 03:37:33 | 003,915,248 | ---- | M] () -- C:\Documents and Settings\John\Local Settings\Application Data\Google\Chrome\Application\18.0.1025.162\pdf.dll
MOD - [2012/04/12 03:36:08 | 000,122,880 | ---- | M] () -- C:\Documents and Settings\John\Local Settings\Application Data\Google\Chrome\Application\18.0.1025.162\avutil-51.dll
MOD - [2012/04/12 03:36:06 | 000,220,672 | ---- | M] () -- C:\Documents and Settings\John\Local Settings\Application Data\Google\Chrome\Application\18.0.1025.162\avformat-53.dll
MOD - [2012/04/12 03:36:05 | 001,747,456 | ---- | M] () -- C:\Documents and Settings\John\Local Settings\Application Data\Google\Chrome\Application\18.0.1025.162\avcodec-53.dll
MOD - [2012/04/12 02:51:55 | 008,743,584 | ---- | M] () -- C:\Documents and Settings\John\Local Settings\Application Data\Google\Chrome\Application\18.0.1025.162\gcswf32.dll
MOD - [2012/04/11 20:40:54 | 000,843,776 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_4b314ca3\system.drawing.dll
MOD - [2012/04/11 20:40:27 | 003,035,136 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_299c2c1e\system.windows.forms.dll
MOD - [2012/04/11 20:39:36 | 000,471,040 | ---- | M] () -- c:\windows\assembly\gac\system.drawing\1.0.5000.0__b03f5f7f11d50a3a\system.drawing.dll
MOD - [2011/12/30 10:58:20 | 003,391,488 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_2e9872a2\mscorlib.dll
MOD - [2011/12/30 10:58:09 | 002,088,960 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_1f2e5e60\system.xml.dll
MOD - [2011/12/30 10:57:49 | 001,966,080 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_884639c5\system.dll
MOD - [2011/12/30 10:57:29 | 001,232,896 | ---- | M] () -- c:\windows\assembly\gac\system\1.0.5000.0__b77a5c561934e089\system.dll
MOD - [2011/12/30 10:57:28 | 001,269,760 | ---- | M] () -- c:\windows\assembly\gac\system.web\1.0.5000.0__b03f5f7f11d50a3a\system.web.dll
MOD - [2011/12/30 10:57:25 | 002,064,384 | ---- | M] () -- c:\windows\assembly\gac\system.windows.forms\1.0.5000.0__b77a5c561934e089\system.windows.forms.dll
MOD - [2011/11/11 14:09:20 | 000,336,408 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
MOD - [2011/11/11 14:07:54 | 000,265,240 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
MOD - [2011/11/03 11:28:36 | 001,292,288 | ---- | M] () -- C:\WINDOWS\system32\quartz.dll
MOD - [2011/08/12 13:19:40 | 000,680,984 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
MOD - [2011/04/03 15:07:51 | 000,372,736 | ---- | M] () -- c:\windows\assembly\gac\system.management\1.0.5000.0__b03f5f7f11d50a3a\system.management.dll
MOD - [2011/04/03 15:07:50 | 001,339,392 | ---- | M] () -- c:\windows\assembly\gac\system.xml\1.0.5000.0__b77a5c561934e089\system.xml.dll
MOD - [2011/04/03 15:07:50 | 000,323,584 | ---- | M] () -- c:\windows\assembly\gac\system.runtime.remoting\1.0.5000.0__b77a5c561934e089\system.runtime.remoting.dll
MOD - [2011/03/01 23:15:28 | 000,126,808 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll
MOD - [2011/03/01 23:15:28 | 000,027,480 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll
MOD - [2011/03/01 23:15:04 | 000,340,824 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTXml4.dll
MOD - [2011/03/01 23:14:42 | 007,954,776 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTGui4.dll
MOD - [2011/03/01 23:14:30 | 002,143,576 | ---- | M] () -- C:\Program Files\Logitech\LWS\Webcam Software\QTCore4.dll
MOD - [2011/02/04 17:48:30 | 000,291,840 | ---- | M] () -- C:\WINDOWS\system32\sbe.dll
MOD - [2011/01/12 21:57:34 | 000,751,616 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\vpxmd.dll
MOD - [2011/01/12 21:55:28 | 000,027,472 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\SDL.dll
MOD - [2010/08/24 19:06:46 | 000,085,840 | ---- | M] () -- C:\Program Files\Trend Micro\RUBotted\hc_help.dll
MOD - [2010/04/13 20:11:16 | 000,077,624 | ---- | M] () -- C:\Program Files\McAfee Online Backup\librs2.dll
MOD - [2009/11/05 08:39:40 | 000,087,552 | ---- | M] () -- C:\WINDOWS\system32\cpwmon2k.dll
MOD - [2009/04/22 17:53:56 | 000,969,040 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\QtNetwork4.dll
MOD - [2009/04/09 19:04:56 | 002,141,008 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\QtCore4.dll
MOD - [2009/03/03 18:18:08 | 000,138,064 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\plugins\imageformats\qjpeg4.dll
MOD - [2009/03/03 18:18:06 | 000,035,152 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\plugins\imageformats\qico4.dll
MOD - [2009/03/03 18:18:06 | 000,029,008 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\plugins\imageformats\qgif4.dll
MOD - [2009/03/03 18:17:46 | 011,311,952 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\QtWebKit4.dll
MOD - [2009/03/03 18:17:46 | 000,363,856 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\QtXml4.dll
MOD - [2009/03/03 18:17:44 | 000,200,016 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\QtSql4.dll
MOD - [2009/03/03 18:17:40 | 000,475,472 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\QtOpenGL4.dll
MOD - [2009/03/03 18:17:38 | 007,704,400 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\QtGui4.dll
MOD - [2009/03/03 18:17:32 | 000,291,664 | ---- | M] () -- C:\Program Files\Logitech\Vid HD\phonon4.dll
MOD - [2008/04/13 20:11:59 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2008/04/13 20:11:51 | 000,059,904 | ---- | M] () -- C:\WINDOWS\system32\devenum.dll
MOD - [2006/11/01 21:48:02 | 000,757,760 | ---- | M] () -- C:\WINDOWS\system32\bcm1xsup.dll


========== Win32 Services (SafeList) ==========

SRV - [2012/04/30 16:02:13 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/04/13 22:08:16 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/03/22 19:29:08 | 000,361,976 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)
SRV - [2012/03/20 13:11:32 | 000,151,880 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\WINDOWS\system32\mfevtps.exe -- (mfevtp)
SRV - [2012/03/20 13:05:00 | 000,161,632 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe -- (mfefire)
SRV - [2012/03/20 13:04:32 | 000,166,288 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield)
SRV - [2012/01/18 02:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2011/04/12 16:40:58 | 000,660,848 | ---- | M] (Juniper Networks) [Auto | Running] -- C:\Program Files\Juniper Networks\Common Files\dsNcService.exe -- (dsNcService)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (MSK80Service)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McProxy)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McNASvc)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McNaiAnn)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (mcmscsvc)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McMPFSvc)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McAfee SiteAdvisor Service)
SRV - [2011/01/26 11:30:32 | 000,822,104 | ---- | M] (McAfee, Inc.) [Auto | Stopped] -- C:\WINDOWS\Temp\0184281335920216mcinst.exe -- (0184281335920216mcinstcleanup) McAfee Application Installer Cleanup (0184281335920216)
SRV - [2010/12/17 09:33:10 | 000,439,632 | ---- | M] (Trend Micro Inc.) [Auto | Running] -- C:\Program Files\Trend Micro\RUBotted\RUBotSrv.exe -- (RUBotSrv)
SRV - [2010/04/13 20:11:14 | 000,229,688 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee Online Backup\MOBKbackup.exe -- (MOBKbackup)
SRV - [2009/10/20 14:19:48 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS -- (OMCI)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (mfeavfk01)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2012/04/04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012/02/22 13:29:46 | 000,464,304 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2012/02/22 13:29:46 | 000,340,920 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfefirek.sys -- (mfefirek)
DRV - [2012/02/22 13:29:46 | 000,180,848 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2012/02/22 13:29:46 | 000,121,544 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfeapfk.sys -- (mfeapfk)
DRV - [2012/02/22 13:29:46 | 000,089,792 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mfetdi2k.sys -- (mfetdi2k)
DRV - [2012/02/22 13:29:46 | 000,087,656 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mferkdet.sys -- (mferkdet)
DRV - [2012/02/22 13:29:46 | 000,083,856 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfendisk.sys -- (mfendiskmp)
DRV - [2012/02/22 13:29:46 | 000,083,856 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mfendisk.sys -- (mfendisk)
DRV - [2012/02/22 13:29:46 | 000,059,456 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2012/02/22 13:29:46 | 000,057,600 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cfwids.sys -- (cfwids)
DRV - [2012/01/18 02:44:52 | 004,332,960 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvuvc.sys -- (LVUVC) Logitech Webcam Pro 9000(UVC)
DRV - [2012/01/18 02:44:28 | 000,312,096 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvrs.sys -- (LVRS)
DRV - [2011/04/12 16:10:02 | 000,026,624 | ---- | M] (Juniper Networks) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dsNcAdpt.sys -- (dsNcAdpt)
DRV - [2010/04/13 20:10:22 | 000,054,776 | ---- | M] (Mozy, Inc.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\MOBK.sys -- (MOBKFilter)
DRV - [2009/10/20 14:19:44 | 000,050,704 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\npf.sys -- (NPF)
DRV - [2009/10/07 04:49:50 | 000,023,832 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvuvcflt.sys -- (FilterService)
DRV - [2006/10/13 00:28:42 | 000,604,928 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2006/08/17 08:55:16 | 000,044,544 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2006/05/23 22:06:36 | 001,578,496 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2006/03/24 17:34:30 | 001,156,648 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2005/07/22 12:02:12 | 001,035,008 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2005/07/22 12:01:08 | 000,201,600 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2005/07/22 12:01:00 | 000,717,952 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{20DCBDB4-000D-4DD6-916D-FA66CF27A841}: "URL" = http://search.yahoo....p={SearchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.google.com"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~1\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.0.198: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.0.198: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.669: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.0.198: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.0.198: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\John\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\John\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2012/02/25 17:17:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/09/18 12:35:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/11/26 17:01:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files\Common Files\McAfee\SystemCore [2012/05/01 19:30:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/30 16:02:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/09/18 12:35:46 | 000,000,000 | ---D | M]

[2011/12/18 21:29:46 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\John\Application Data\Mozilla\Extensions
[2012/04/03 13:27:12 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\md5nf5jq.default\extensions
[2012/04/03 13:27:12 | 000,000,000 | ---D | M] (Bitdefender QuickScan) -- C:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\md5nf5jq.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2012/03/05 14:20:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/04/30 16:02:13 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/03/05 14:19:52 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/03/05 14:19:52 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\John\Local Settings\Application Data\Google\Chrome\Application\18.0.1025.162\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\John\Local Settings\Application Data\Google\Chrome\Application\18.0.1025.162\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\John\Local Settings\Application Data\Google\Chrome\Application\18.0.1025.162\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Documents and Settings\John\Local Settings\Application Data\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll
CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Documents and Settings\John\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.41.123.2_0\McChPlg.dll
CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = c:\program files\real\realplayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = c:\program files\real\realplayer\Netscape6\nprpjplug.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\John\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Java™ Platform SE 6 U31 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = c:\program files\real\realplayer\Netscape6\nprjplug.dll
CHR - plugin: McAfee SecurityCenter (Enabled) = c:\progra~1\mcafee\msc\npmcsn~1.dll
CHR - Extension: YouTube = C:\Documents and Settings\John\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Documents and Settings\John\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: SiteAdvisor = C:\Documents and Settings\John\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.41.123.2_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Documents and Settings\John\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: Skype Click to Call = C:\Documents and Settings\John\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.8.0.8855_0\
CHR - Extension: Gmail = C:\Documents and Settings\John\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/04/03 15:03:08 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll File not found
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\Mcafee\SystemCore\ScriptSn.20120429165708.dll (McAfee, Inc.)
O2 - BHO: (Wishpot Button) - {9E40F4A8-6896-4b67-91F5-F6F287ECB5D9} - C:\Program Files\Wishpot\ietb.dll (VONeS.NET)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Wishpot Button) - {7DAAFFD0-5A88-447d-96C6-E6CA06AF0758} - C:\Program Files\Wishpot\ietb.dll (VONeS.NET)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Trend Micro RUBotted V2.0 Beta] C:\Program Files\Trend Micro\RUBotted\RUBottedGUI.exe (Trend Micro Inc.)
O4 - HKCU..\Run: [Logitech Vid] C:\Program Files\Logitech\Vid HD\Vid.exe (Logitech Inc.)
O4 - HKCU..\Run: [MusicManager] C:\Documents and Settings\John\Local Settings\Application Data\Programs\Google\MusicManager\MusicManager.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Sonic CinePlayer Quick Launch.lnk = C:\Program Files\Common Files\Sonic Shared\CineTray.exe (Sonic Solutions)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK32.EXE (WinZip Computing, S.L.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} http://support.dell....iler/SysPro.CAB (SysProWmi Class)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.micr...heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} http://ato10-wa-10ac...ca32/wficat.cab (Citrix ICA Client)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.aka...vex-2.2.6.0.cab (DLM Control)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.h...tDetection2.cab (GMNRev Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {983A9C21-8207-4B58-BBB8-0EBC3D7C5505} https://awamailcls2.faa.gov/dwa8W.cab (Domino Web Access 8 Control)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://frac.ftiharr...SetupClient.cab (JuniperSetupClientControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 71.252.0.12
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{73A28EA1-2B02-4CBE-A9EC-80E69C4B3392}: DhcpNameServer = 192.168.1.1 71.252.0.12
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\John\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\John\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/04/03 14:36:48 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{9ad5528e-8b8c-11e0-b0df-00188baa14db}\Shell - "" = AutoRun
O33 - MountPoints2\{9ad5528e-8b8c-11e0-b0df-00188baa14db}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9ad5528e-8b8c-11e0-b0df-00188baa14db}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/05/02 19:50:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Trend Micro
[2012/05/02 19:40:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\WinPcap
[2012/05/02 19:40:25 | 000,000,000 | ---D | C] -- C:\Program Files\WinPcap
[2012/05/02 19:39:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Trend Micro RUBotted
[2012/05/02 19:39:10 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2012/05/02 19:28:47 | 000,205,072 | ---- | C] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmcomm.sys
[2012/05/02 19:13:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\McAfee
[2012/05/01 20:56:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2012/04/30 16:02:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Mozilla
[2012/04/30 16:02:20 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2012/04/03 13:54:03 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Media Connect 2
[2012/04/03 13:51:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\UMDF

========== Files - Modified Within 30 Days ==========

[2012/05/02 20:08:01 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/05/02 20:02:05 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/05/02 20:02:03 | 000,000,878 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/05/02 19:40:27 | 000,000,073 | ---- | M] () -- C:\WINDOWS\System32\-1
[2012/05/02 19:28:44 | 000,205,072 | ---- | M] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmcomm.sys
[2012/05/02 19:28:04 | 000,299,924 | ---- | M] () -- C:\Documents and Settings\John\Local Settings\Application Data\census.cache
[2012/05/02 19:27:54 | 000,189,121 | ---- | M] () -- C:\Documents and Settings\John\Local Settings\Application Data\ars.cache
[2012/05/02 19:21:02 | 000,000,974 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1060284298-412668190-682003330-1003UA.job
[2012/05/02 19:21:02 | 000,000,922 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1060284298-412668190-682003330-1003Core.job
[2012/05/01 19:28:29 | 000,000,384 | ---- | M] () -- C:\WINDOWS\tasks\Final Media Player Update Checker.job
[2012/05/01 19:25:21 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1060284298-412668190-682003330-1003.job
[2012/05/01 19:25:08 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/05/01 19:25:07 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/04/30 16:04:35 | 000,002,187 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2012/04/29 19:14:32 | 000,039,936 | ---- | M] () -- C:\Documents and Settings\John\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/04/25 18:43:00 | 000,002,265 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2012/04/25 18:32:50 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\lvuvc.hs
[2012/04/19 19:10:58 | 000,143,250 | ---- | M] () -- C:\Documents and Settings\John\Desktop\548115_10150811822769574_169306659573_9203418_147732099_n.jpg
[2012/04/18 14:45:45 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/17 20:23:33 | 000,002,277 | ---- | M] () -- C:\Documents and Settings\John\Desktop\Google Chrome.lnk
[2012/04/17 20:23:33 | 000,002,255 | ---- | M] () -- C:\Documents and Settings\John\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/04/16 07:14:23 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/04/15 19:27:37 | 000,001,261 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Logitech Webcam Software .lnk
[2012/04/11 20:42:31 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/04/11 20:38:28 | 000,442,140 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/04/11 20:38:28 | 000,071,910 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/04/11 01:08:54 | 000,000,800 | ---- | M] () -- C:\Documents and Settings\John\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2012/04/07 16:12:09 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1060284298-412668190-682003330-1003.job
[2012/04/04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012/04/03 14:12:03 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2012/04/03 14:12:03 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2012/04/03 13:51:49 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf

========== Files Created - No Company Name ==========

[2012/05/02 19:40:27 | 000,000,073 | ---- | C] () -- C:\WINDOWS\System32\-1
[2012/04/19 19:11:05 | 000,143,250 | ---- | C] () -- C:\Documents and Settings\John\Desktop\548115_10150811822769574_169306659573_9203418_147732099_n.jpg
[2012/04/03 13:51:49 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2012/04/03 12:23:31 | 000,000,830 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/02/15 21:51:05 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/01/18 21:02:49 | 000,029,216 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2012/01/12 21:56:13 | 000,000,418 | ---- | C] () -- C:\WINDOWS\hpwmdl28.dat.temp
[2011/12/25 22:52:35 | 000,299,924 | ---- | C] () -- C:\Documents and Settings\John\Local Settings\Application Data\census.cache
[2011/12/25 22:52:30 | 000,189,121 | ---- | C] () -- C:\Documents and Settings\John\Local Settings\Application Data\ars.cache
[2011/12/25 22:43:14 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\John\Local Settings\Application Data\housecall.guid.cache
[2011/12/23 12:30:00 | 000,000,033 | ---- | C] () -- C:\WINDOWS\webica.ini
[2011/09/18 12:22:23 | 000,207,280 | ---- | C] () -- C:\WINDOWS\hpwins28.dat
[2011/09/18 12:22:23 | 000,000,418 | ---- | C] () -- C:\WINDOWS\hpwmdl28.dat
[2011/08/12 13:20:14 | 000,015,896 | ---- | C] () -- C:\WINDOWS\System32\drivers\iKeyLFT2.dll
[2011/07/12 19:06:09 | 000,102,032 | ---- | C] () -- C:\WINDOWS\hpoins04.dat
[2011/07/12 19:06:09 | 000,017,218 | ---- | C] () -- C:\WINDOWS\hpomdl04.dat
[2011/07/06 21:57:52 | 000,723,232 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/06/18 12:36:31 | 000,028,418 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2011/05/31 20:31:10 | 000,000,055 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2011/05/03 20:50:42 | 000,087,552 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll
[2011/04/03 20:36:33 | 000,039,936 | ---- | C] () -- C:\Documents and Settings\John\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/03 19:57:52 | 000,127,614 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2011/04/03 16:33:27 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/04/03 16:01:06 | 000,757,760 | ---- | C] () -- C:\WINDOWS\System32\bcm1xsup.dll
[2011/04/03 16:01:06 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\preflib.dll
[2011/04/03 16:01:06 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\WLTRYSVC.EXE
[2011/04/03 15:02:57 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\John\Local Settings\Application Data\fusioncache.dat
[2011/04/03 14:41:15 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011/04/03 14:32:31 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2011/04/03 11:21:02 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011/04/03 11:19:23 | 000,152,384 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/04/01 01:07:02 | 010,920,984 | ---- | C] () -- C:\WINDOWS\System32\LogiDPP.dll
[2011/04/01 01:07:02 | 000,104,472 | ---- | C] () -- C:\WINDOWS\System32\LogiDPPApp.exe
[2011/04/01 01:06:56 | 000,336,408 | ---- | C] () -- C:\WINDOWS\System32\DevManagerCore.dll

========== LOP Check ==========

[2011/04/03 15:03:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DIGStream
[2011/12/22 10:24:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Juniper Networks
[2011/07/17 14:42:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PMB Files
[2011/12/01 21:08:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\W3i
[2012/03/03 11:36:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2011/12/01 21:05:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John\Application Data\ElevatedDiagnostics
[2011/06/19 19:40:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John\Application Data\FinalMediaPlayer
[2011/12/22 11:09:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John\Application Data\ICAClient
[2011/12/22 14:33:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John\Application Data\Juniper Networks
[2011/06/18 12:37:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John\Application Data\Leadertech
[2011/04/03 21:29:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John\Application Data\Opera
[2012/01/15 17:52:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John\Application Data\PhotoScape
[2011/12/26 14:01:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John\Application Data\QuickScan
[2012/05/01 19:28:29 | 000,000,384 | ---- | M] () -- C:\WINDOWS\Tasks\Final Media Player Update Checker.job

========== Purity Check ==========



< End of report >


Thanks for any help.

JC

[Advertisements]

Hello TXVA John and welcome to my office here at G2G!

My nick is maliprog and I'll be your technical support on this issue. Before we start please read my notes carefully:

NOTE:

• Malware removal is NOT instantaneous, most infections require several courses of action to completely eradicate.
• Absence of symptoms does not always mean the computer is clean
• Kindly follow my instructions in the order posted. Order is crucial in cleaning process.
• Please DO NOT run any scans or fix on your own without my direction.
• Please read all of my response through at least once before attempting to follow the procedures described.
• If there's anything you don't understand or isn't totally clear, please come back to me for clarification.
• Please do not attach any log files to your replies unless I specifically ask you. Instead please copy and paste so as to include the log in your reply.
• You must reply within 3 days or your topic will be closed

Step 1

Please update your Malwarebytes and do Quick Scan. Post log after the scan here for me.

Step 2

Download GMER from Here. Note the file's name and save it to your root folder, such as C:.

• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
• Click on this link to see a list of programs that should be disabled.
• Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
• Allow the driver to load if asked.
• You may be prompted to scan immediately if it detects rootkit activity.
• If you are prompted to scan your system click "No", save the log and post back the results.
• If not prompted, click the "Rootkit/Malware" tab.
• On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
• Select all drives that are connected to your system to be scanned.
• Click the Scan button to begin. (Please be patient as it can take some time to complete)
• When the scan is finished, click Save to save the scan results to your Desktop.
• Save the file as Results.log and copy/paste the contents in your next reply.
• Exit the program and re-enable all active protection when done.

Step 3

Please don't forget to include these items in your reply:

• Malwarebytes log
• GMER log

It would be helpful if you could post each log in separate post

[maliprog]

Hello TXVA John and welcome to my office here at G2G!

My nick is maliprog and I'll be your technical support on this issue. Before we start please read my notes carefully:

NOTE:

• Malware removal is NOT instantaneous, most infections require several courses of action to completely eradicate.
• Absence of symptoms does not always mean the computer is clean
• Kindly follow my instructions in the order posted. Order is crucial in cleaning process.
• Please DO NOT run any scans or fix on your own without my direction.
• Please read all of my response through at least once before attempting to follow the procedures described.
• If there's anything you don't understand or isn't totally clear, please come back to me for clarification.
• Please do not attach any log files to your replies unless I specifically ask you. Instead please copy and paste so as to include the log in your reply.
• You must reply within 3 days or your topic will be closed

Step 1

Please update your Malwarebytes and do Quick Scan. Post log after the scan here for me.

Step 2

Download GMER from Here. Note the file's name and save it to your root folder, such as C:.

• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
• Click on this link to see a list of programs that should be disabled.
• Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
• Allow the driver to load if asked.
• You may be prompted to scan immediately if it detects rootkit activity.
• If you are prompted to scan your system click "No", save the log and post back the results.
• If not prompted, click the "Rootkit/Malware" tab.
• On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
• Select all drives that are connected to your system to be scanned.
• Click the Scan button to begin. (Please be patient as it can take some time to complete)
• When the scan is finished, click Save to save the scan results to your Desktop.
• Save the file as Results.log and copy/paste the contents in your next reply.
• Exit the program and re-enable all active protection when done.

Step 3

Please don't forget to include these items in your reply:

• Malwarebytes log
• GMER log

It would be helpful if you could post each log in separate post

[TXVA John]

Here's the Malwarebytes log.


Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org

Database version: v2012.05.03.08

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
John :: JNH-LAP [administrator]

Protection: Disabled

5/3/2012 7:44:27 PM
mbam-log-2012-05-03 (20-00-34).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 230184
Time elapsed: 9 minute(s), 39 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\RECYCLER\S-1-5-21-1060284298-412668190-682003330-1003\Dc4.exe (PUP.OfferBundler.ST) -> No action taken.

(end)

[TXVA John]

Here's the GMER log. For some reason, my PC is running really slow when I start-up now and for the first 15 minutes or so.


GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-05-04 05:37:56
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 FUJITSU_MHV2080BH rev.0085002A
Running: 0hy0fuot.exe; Driver: C:\DOCUME~1\John\LOCALS~1\Temp\pwddypow.sys


---- System - GMER 1.0.15 ----

Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwCreateKey [0xB9E925D0]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwDeleteKey [0xB9E925E4]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xB9E92610]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xB9E92666]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwOpenKey [0xB9E925BC]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwOpenProcess [0xB9E92594]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwOpenThread [0xB9E925A8]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwRenameKey [0xB9E925FA]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwSetSecurityObject [0xB9E9263C]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwSetValueKey [0xB9E92626]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwTerminateProcess [0xB9E92690]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xB9E9267C]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwYieldExecution [0xB9E92650]
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtMapViewOfSection
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtOpenProcess
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtOpenThread
Code mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtSetSecurityObject

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwYieldExecution 80504B08 7 Bytes JMP B9E92654 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtMapViewOfSection 805B203A 7 Bytes JMP B9E9266A mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwUnmapViewOfSection 805B2E48 5 Bytes JMP B9E92680 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtSetSecurityObject 805C062E 5 Bytes JMP B9E92640 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtOpenProcess 805CB440 5 Bytes JMP B9E92598 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!NtOpenThread 805CB6CC 5 Bytes JMP B9E925AC mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwTerminateProcess 805D29E2 3 Bytes JMP B9E92694 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwTerminateProcess + 4 805D29E6 1 Byte [39]
PAGE ntkrnlpa.exe!ZwSetValueKey 80622662 7 Bytes JMP B9E9262A mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwRenameKey 80623B12 7 Bytes JMP B9E925FE mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwCreateKey 806240F0 5 Bytes JMP B9E925D4 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwDeleteKey 8062458C 7 Bytes JMP B9E925E8 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwDeleteValueKey 8062475C 7 Bytes JMP B9E92614 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwOpenKey 806254CE 5 Bytes JMP B9E925C0 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\System32\svchost.exe[140] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00740FEF
.text C:\WINDOWS\System32\svchost.exe[140] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00740FCD
.text C:\WINDOWS\System32\svchost.exe[140] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00740FDE
.text C:\WINDOWS\System32\svchost.exe[140] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 006F0FE5
.text C:\WINDOWS\System32\svchost.exe[140] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 006F0F6F
.text C:\WINDOWS\System32\svchost.exe[140] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 006F006E
.text C:\WINDOWS\System32\svchost.exe[140] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 006F005D
.text C:\WINDOWS\System32\svchost.exe[140] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 006F0F9E
.text C:\WINDOWS\System32\svchost.exe[140] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 006F002C
.text C:\WINDOWS\System32\svchost.exe[140] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 006F0F41
.text C:\WINDOWS\System32\svchost.exe[140] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 006F0F5E
.text C:\WINDOWS\System32\svchost.exe[140] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 006F00D0
.text C:\WINDOWS\System32\svchost.exe[140] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 006F00B5
.text C:\WINDOWS\System32\svchost.exe[140] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 006F00E1
.text C:\WINDOWS\System32\svchost.exe[140] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 006F0FAF
.text C:\WINDOWS\System32\svchost.exe[140] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 006F0FCA
.text C:\WINDOWS\System32\svchost.exe[140] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 006F007F
.text C:\WINDOWS\System32\svchost.exe[140] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 006F001B
.text C:\WINDOWS\System32\svchost.exe[140] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 006F0000
.text C:\WINDOWS\System32\svchost.exe[140] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 006F00A4
.text C:\WINDOWS\System32\svchost.exe[140] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 006E0FD4
.text C:\WINDOWS\System32\svchost.exe[140] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 006E007D
.text C:\WINDOWS\System32\svchost.exe[140] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 006E0025
.text C:\WINDOWS\System32\svchost.exe[140] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 006E0FE5
.text C:\WINDOWS\System32\svchost.exe[140] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 006E0062
.text C:\WINDOWS\System32\svchost.exe[140] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 006E0000
.text C:\WINDOWS\System32\svchost.exe[140] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 006E0051
.text C:\WINDOWS\System32\svchost.exe[140] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 006E0040
.text C:\WINDOWS\System32\svchost.exe[140] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00750F9F
.text C:\WINDOWS\System32\svchost.exe[140] msvcrt.dll!system 77C293C7 5 Bytes JMP 0075002A
.text C:\WINDOWS\System32\svchost.exe[140] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00750FC1
.text C:\WINDOWS\System32\svchost.exe[140] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00750FEF
.text C:\WINDOWS\System32\svchost.exe[140] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00750FB0
.text C:\WINDOWS\System32\svchost.exe[140] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00750FDE
.text C:\WINDOWS\System32\svchost.exe[140] WS2_32.dll!socket 71AB4211 5 Bytes JMP 006D0FEF
.text C:\WINDOWS\system32\svchost.exe[260] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00BC0FEF
.text C:\WINDOWS\system32\svchost.exe[260] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00BC000A
.text C:\WINDOWS\system32\svchost.exe[260] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00BC0FDE
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BB000A
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BB0078
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BB0F79
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BB0047
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BB002C
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BB0FAF
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BB00B5
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BB00A4
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BB0F37
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BB00D0
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00BB00E1
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00BB0F94
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00BB0FEF
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00BB0093
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00BB0FC0
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00BB001B
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00BB0F48
.text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00C40FCA
.text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00C40F9B
.text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00C4001B
.text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00C40FE5
.text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00C40058
.text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00C40000
.text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00C4003D
.text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00C4002C
.text C:\WINDOWS\system32\svchost.exe[260] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00BE0038
.text C:\WINDOWS\system32\svchost.exe[260] msvcrt.dll!system 77C293C7 5 Bytes JMP 00BE0FB7
.text C:\WINDOWS\system32\svchost.exe[260] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00BE000C
.text C:\WINDOWS\system32\svchost.exe[260] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00BE0FEF
.text C:\WINDOWS\system32\svchost.exe[260] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00BE0027
.text C:\WINDOWS\system32\svchost.exe[260] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00BE0FD2
.text C:\WINDOWS\system32\svchost.exe[260] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BD0000
.text C:\WINDOWS\System32\svchost.exe[300] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 027B0000
.text C:\WINDOWS\System32\svchost.exe[300] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 027B001B
.text C:\WINDOWS\System32\svchost.exe[300] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 027B0FE5
.text C:\WINDOWS\System32\svchost.exe[300] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 027A000A
.text C:\WINDOWS\System32\svchost.exe[300] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 027A0F8A
.text C:\WINDOWS\System32\svchost.exe[300] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 027A0F9B
.text C:\WINDOWS\System32\svchost.exe[300] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 027A0073
.text C:\WINDOWS\System32\svchost.exe[300] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 027A0FB6
.text C:\WINDOWS\System32\svchost.exe[300] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 027A0047
.text C:\WINDOWS\System32\svchost.exe[300] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 027A00A6
.text C:\WINDOWS\System32\svchost.exe[300] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 027A0F5E
.text C:\WINDOWS\System32\svchost.exe[300] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 027A0F2F
.text C:\WINDOWS\System32\svchost.exe[300] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 027A00C8
.text C:\WINDOWS\System32\svchost.exe[300] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 027A0F1E
.text C:\WINDOWS\System32\svchost.exe[300] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 027A0062
.text C:\WINDOWS\System32\svchost.exe[300] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 027A001B
.text C:\WINDOWS\System32\svchost.exe[300] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 027A0F6F
.text C:\WINDOWS\System32\svchost.exe[300] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 027A002C
.text C:\WINDOWS\System32\svchost.exe[300] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 027A0FDB
.text C:\WINDOWS\System32\svchost.exe[300] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 027A00B7
.text C:\WINDOWS\System32\svchost.exe[300] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 027F002C
.text C:\WINDOWS\System32\svchost.exe[300] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 027F0073
.text C:\WINDOWS\System32\svchost.exe[300] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 027F001B
.text C:\WINDOWS\System32\svchost.exe[300] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 027F000A
.text C:\WINDOWS\System32\svchost.exe[300] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 027F0062
.text C:\WINDOWS\System32\svchost.exe[300] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 027F0FEF
.text C:\WINDOWS\System32\svchost.exe[300] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 027F0FC0
.text C:\WINDOWS\System32\svchost.exe[300] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [9F, 8A]
.text C:\WINDOWS\System32\svchost.exe[300] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 027F0047
.text C:\WINDOWS\System32\svchost.exe[300] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 027E0036
.text C:\WINDOWS\System32\svchost.exe[300] msvcrt.dll!system 77C293C7 5 Bytes JMP 027E0025
.text C:\WINDOWS\System32\svchost.exe[300] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 027E0FC6
.text C:\WINDOWS\System32\svchost.exe[300] msvcrt.dll!_open 77C2F566 5 Bytes JMP 027E0000
.text C:\WINDOWS\System32\svchost.exe[300] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 027E0FB5
.text C:\WINDOWS\System32\svchost.exe[300] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 027E0FD7
.text C:\WINDOWS\System32\svchost.exe[300] WS2_32.dll!socket 71AB4211 5 Bytes JMP 027D0FEF
.text C:\WINDOWS\System32\svchost.exe[300] WININET.dll!InternetOpenA 3D95D6A8 5 Bytes JMP 027C0000
.text C:\WINDOWS\System32\svchost.exe[300] WININET.dll!InternetOpenW 3D95DB21 5 Bytes JMP 027C0FEF
.text C:\WINDOWS\System32\svchost.exe[300] WININET.dll!InternetOpenUrlA 3D95F3BC 5 Bytes JMP 027C0FDE
.text C:\WINDOWS\System32\svchost.exe[300] WININET.dll!InternetOpenUrlW 3D9A6DFF 5 Bytes JMP 027C0FC3
.text C:\WINDOWS\system32\svchost.exe[392] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 007E000A
.text C:\WINDOWS\system32\svchost.exe[392] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 007E0036
.text C:\WINDOWS\system32\svchost.exe[392] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 007E001B
.text C:\WINDOWS\system32\svchost.exe[392] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 007D0FE5
.text C:\WINDOWS\system32\svchost.exe[392] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 007D009A
.text C:\WINDOWS\system32\svchost.exe[392] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 007D0FA5
.text C:\WINDOWS\system32\svchost.exe[392] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 007D0089
.text C:\WINDOWS\system32\svchost.exe[392] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 007D0FC0
.text C:\WINDOWS\system32\svchost.exe[392] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 007D003D
.text C:\WINDOWS\system32\svchost.exe[392] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 007D0F63
.text C:\WINDOWS\system32\svchost.exe[392] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 007D00AB
.text C:\WINDOWS\system32\svchost.exe[392] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 007D0F41
.text C:\WINDOWS\system32\svchost.exe[392] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 007D00D0
.text C:\WINDOWS\system32\svchost.exe[392] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 007D00EB
.text C:\WINDOWS\system32\svchost.exe[392] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 007D0062
.text C:\WINDOWS\system32\svchost.exe[392] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 007D0000
.text C:\WINDOWS\system32\svchost.exe[392] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 007D0F80
.text C:\WINDOWS\system32\svchost.exe[392] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 007D002C
.text C:\WINDOWS\system32\svchost.exe[392] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 007D0011
.text C:\WINDOWS\system32\svchost.exe[392] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 007D0F52
.text C:\WINDOWS\system32\svchost.exe[392] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00810014
.text C:\WINDOWS\system32\svchost.exe[392] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00810F72
.text C:\WINDOWS\system32\svchost.exe[392] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00810FCD
.text C:\WINDOWS\system32\svchost.exe[392] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00810FDE
.text C:\WINDOWS\system32\svchost.exe[392] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00810039
.text C:\WINDOWS\system32\svchost.exe[392] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00810FEF
.text C:\WINDOWS\system32\svchost.exe[392] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00810F97
.text C:\WINDOWS\system32\svchost.exe[392] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [A1, 88]
.text C:\WINDOWS\system32\svchost.exe[392] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00810FA8
.text C:\WINDOWS\system32\svchost.exe[392] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00800F9E
.text C:\WINDOWS\system32\svchost.exe[392] msvcrt.dll!system 77C293C7 5 Bytes JMP 00800FAF
.text C:\WINDOWS\system32\svchost.exe[392] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00800029
.text C:\WINDOWS\system32\svchost.exe[392] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00800FEF
.text C:\WINDOWS\system32\svchost.exe[392] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00800FD4
.text C:\WINDOWS\system32\svchost.exe[392] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0080000C
.text C:\WINDOWS\system32\svchost.exe[392] WS2_32.dll!socket 71AB4211 5 Bytes JMP 007F000A
.text C:\WINDOWS\System32\svchost.exe[512] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00700FEF
.text C:\WINDOWS\System32\svchost.exe[512] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00700FC3
.text C:\WINDOWS\System32\svchost.exe[512] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00700FD4
.text C:\WINDOWS\System32\svchost.exe[512] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 006F0000
.text C:\WINDOWS\System32\svchost.exe[512] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 006F0F4B
.text C:\WINDOWS\System32\svchost.exe[512] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 006F0F66
.text C:\WINDOWS\System32\svchost.exe[512] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 006F0F77
.text C:\WINDOWS\System32\svchost.exe[512] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 006F0F94
.text C:\WINDOWS\System32\svchost.exe[512] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 006F0FB6
.text C:\WINDOWS\System32\svchost.exe[512] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 006F0F18
.text C:\WINDOWS\System32\svchost.exe[512] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 006F0F29
.text C:\WINDOWS\System32\svchost.exe[512] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 006F0EFD
.text C:\WINDOWS\System32\svchost.exe[512] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 006F0096
.text C:\WINDOWS\System32\svchost.exe[512] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 006F00B1
.text C:\WINDOWS\System32\svchost.exe[512] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 006F0FA5
.text C:\WINDOWS\System32\svchost.exe[512] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 006F0011
.text C:\WINDOWS\System32\svchost.exe[512] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 006F0F3A
.text C:\WINDOWS\System32\svchost.exe[512] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 006F0FC7
.text C:\WINDOWS\System32\svchost.exe[512] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 006F0022
.text C:\WINDOWS\System32\svchost.exe[512] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 006F007B
.text C:\WINDOWS\System32\svchost.exe[512] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 006E0014
.text C:\WINDOWS\System32\svchost.exe[512] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 006E0036
.text C:\WINDOWS\System32\svchost.exe[512] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 006E0FB9
.text C:\WINDOWS\System32\svchost.exe[512] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 006E0FCA
.text C:\WINDOWS\System32\svchost.exe[512] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 006E0F83
.text C:\WINDOWS\System32\svchost.exe[512] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 006E0FE5
.text C:\WINDOWS\System32\svchost.exe[512] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 006E0F9E
.text C:\WINDOWS\System32\svchost.exe[512] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [8E, 88]
.text C:\WINDOWS\System32\svchost.exe[512] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 006E0025
.text C:\WINDOWS\System32\svchost.exe[512] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 0071003D
.text C:\WINDOWS\System32\svchost.exe[512] msvcrt.dll!system 77C293C7 5 Bytes JMP 0071002C
.text C:\WINDOWS\System32\svchost.exe[512] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00710FC3
.text C:\WINDOWS\System32\svchost.exe[512] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00710FEF
.text C:\WINDOWS\System32\svchost.exe[512] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00710FB2
.text C:\WINDOWS\System32\svchost.exe[512] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00710FDE
.text C:\WINDOWS\System32\svchost.exe[512] WS2_32.dll!socket 71AB4211 5 Bytes JMP 006D0FE5
.text C:\WINDOWS\system32\svchost.exe[588] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 009E0FE5
.text C:\WINDOWS\system32\svchost.exe[588] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 009E0FB9
.text C:\WINDOWS\system32\svchost.exe[588] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 009E0FCA
.text C:\WINDOWS\system32\svchost.exe[588] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 009D0FEF
.text C:\WINDOWS\system32\svchost.exe[588] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 009D007D
.text C:\WINDOWS\system32\svchost.exe[588] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 009D0062
.text C:\WINDOWS\system32\svchost.exe[588] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 009D0051
.text C:\WINDOWS\system32\svchost.exe[588] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 009D0040
.text C:\WINDOWS\system32\svchost.exe[588] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 009D0FB9
.text C:\WINDOWS\system32\svchost.exe[588] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 009D00AE
.text C:\WINDOWS\system32\svchost.exe[588] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 009D0F66
.text C:\WINDOWS\system32\svchost.exe[588] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 009D00E4
.text C:\WINDOWS\system32\svchost.exe[588] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 009D0F41
.text C:\WINDOWS\system32\svchost.exe[588] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 009D00FF
.text C:\WINDOWS\system32\svchost.exe[588] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 009D0FA8
.text C:\WINDOWS\system32\svchost.exe[588] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 009D0FDE
.text C:\WINDOWS\system32\svchost.exe[588] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 009D0F77
.text C:\WINDOWS\system32\svchost.exe[588] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 009D002F
.text C:\WINDOWS\system32\svchost.exe[588] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 009D001E
.text C:\WINDOWS\system32\svchost.exe[588] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 009D00C9
.text C:\WINDOWS\system32\svchost.exe[588] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00A50FC0
.text C:\WINDOWS\system32\svchost.exe[588] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00A5003D
.text C:\WINDOWS\system32\svchost.exe[588] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00A50011
.text C:\WINDOWS\system32\svchost.exe[588] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00A50000
.text C:\WINDOWS\system32\svchost.exe[588] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00A50F8A
.text C:\WINDOWS\system32\svchost.exe[588] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00A50FEF
.text C:\WINDOWS\system32\svchost.exe[588] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00A50FA5
.text C:\WINDOWS\system32\svchost.exe[588] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [C5, 88]
.text C:\WINDOWS\system32\svchost.exe[588] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00A5002C
.text C:\WINDOWS\system32\svchost.exe[588] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00A00FB7
.text C:\WINDOWS\system32\svchost.exe[588] msvcrt.dll!system 77C293C7 5 Bytes JMP 00A00042
.text C:\WINDOWS\system32\svchost.exe[588] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00A00FD2
.text C:\WINDOWS\system32\svchost.exe[588] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00A00FE3
.text C:\WINDOWS\system32\svchost.exe[588] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00A00027
.text C:\WINDOWS\system32\svchost.exe[588] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00A00000
.text C:\WINDOWS\system32\svchost.exe[588] WS2_32.dll!socket 71AB4211 5 Bytes JMP 009F0000
.text C:\WINDOWS\system32\svchost.exe[1368] ntdll.dll!NtCreateFile 7C90D0AE 3 Bytes JMP 00910000
.text C:\WINDOWS\system32\svchost.exe[1368] ntdll.dll!NtCreateFile + 4 7C90D0B2 1 Byte [84]
.text C:\WINDOWS\system32\svchost.exe[1368] ntdll.dll!NtCreateProcess 7C90D14E 3 Bytes JMP 00910022
.text C:\WINDOWS\system32\svchost.exe[1368] ntdll.dll!NtCreateProcess + 4 7C90D152 1 Byte [84]
.text C:\WINDOWS\system32\svchost.exe[1368] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 3 Bytes JMP 00910011
.text C:\WINDOWS\system32\svchost.exe[1368] ntdll.dll!NtProtectVirtualMemory + 4 7C90D6F2 1 Byte [84]
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00900FE5
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00900F63
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00900058
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00900047
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00900036
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00900FAF
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00900F1C
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00900F37
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00900EF0
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00900089
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 009000A4
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00900F94
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00900FCA
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00900F52
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00900011
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00900000
.text C:\WINDOWS\system32\svchost.exe[1368] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00900F0B
.text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00BF001B
.text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00BF0F83
.text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00BF000A
.text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00BF0FDE
.text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00BF0040
.text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00BF0FEF
.text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00BF0F9E
.text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [DF, 88]
.text C:\WINDOWS\system32\svchost.exe[1368] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00BF0FAF
.text C:\WINDOWS\system32\svchost.exe[1368] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00BE0FC1
.text C:\WINDOWS\system32\svchost.exe[1368] msvcrt.dll!system 77C293C7 5 Bytes JMP 00BE0FD2
.text C:\WINDOWS\system32\svchost.exe[1368] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00BE001D
.text C:\WINDOWS\system32\svchost.exe[1368] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00BE0FEF
.text C:\WINDOWS\system32\svchost.exe[1368] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00BE0038
.text C:\WINDOWS\system32\svchost.exe[1368] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00BE000C
.text C:\WINDOWS\system32\svchost.exe[1368] WININET.dll!InternetOpenA 3D95D6A8 5 Bytes JMP 00920FE5
.text C:\WINDOWS\system32\svchost.exe[1368] WININET.dll!InternetOpenW 3D95DB21 5 Bytes JMP 00920000
.text C:\WINDOWS\system32\svchost.exe[1368] WININET.dll!InternetOpenUrlA 3D95F3BC 5 Bytes JMP 0092001B
.text C:\WINDOWS\system32\svchost.exe[1368] WININET.dll!InternetOpenUrlW 3D9A6DFF 5 Bytes JMP 0092002C
.text C:\WINDOWS\system32\svchost.exe[1368] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00930FEF
.text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00BE0FE5
.text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00BE000A
.text C:\WINDOWS\system32\svchost.exe[1536] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00BE0FCA
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BD0000
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BD0F81
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BD0080
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BD0FA6
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BD0FC3
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BD005B
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BD0F3F
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BD0F5A
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BD0F1A
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BD00B3
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00BD0EFF
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00BD0FD4
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00BD001B
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00BD0091
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00BD0FE5
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00BD0036
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00BD00A2
.text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00BC002F
.text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00BC006C
.text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00BC0FDE
.text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00BC0014
.text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00BC0051
.text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00BC0FEF
.text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00BC0040
.text C:\WINDOWS\system32\svchost.exe[1536] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00BC0FC3
.text C:\WINDOWS\system32\svchost.exe[1536] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00BF0FBC
.text C:\WINDOWS\system32\svchost.exe[1536] msvcrt.dll!system 77C293C7 5 Bytes JMP 00BF0FCD
.text C:\WINDOWS\system32\svchost.exe[1536] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00BF002C
.text C:\WINDOWS\system32\svchost.exe[1536] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00BF0000
.text C:\WINDOWS\system32\svchost.exe[1536] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00BF003D
.text C:\WINDOWS\system32\svchost.exe[1536] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00BF0011
.text C:\WINDOWS\system32\svchost.exe[1560] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 019C0000
.text C:\WINDOWS\system32\svchost.exe[1560] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 019C002C
.text C:\WINDOWS\system32\svchost.exe[1560] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 019C001B
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 019B0FEF
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 019B009F
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 019B008E
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 019B007D
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 019B0062
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 019B0036
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 019B00D2
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 019B00C1
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 019B00FE
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 019B00E3
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 019B0119
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 019B0047
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 019B0000
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 019B00B0
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 019B0FC0
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 019B0011
.text C:\WINDOWS\system32\svchost.exe[1560] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 019B0F65
.text C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 019A0FC3
.text C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 019A004A
.text C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 019A0FD4
.text C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 019A0014
.text C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 019A0F8D
.text C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 019A0FEF
.text C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 019A0FA8
.text C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [BA, 89]
.text C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 019A0025
.text C:\WINDOWS\system32\svchost.exe[1560] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 019F0F9C
.text C:\WINDOWS\system32\svchost.exe[1560] msvcrt.dll!system 77C293C7 5 Bytes JMP 019F0FB7
.text C:\WINDOWS\system32\svchost.exe[1560] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 019F0FE3
.text C:\WINDOWS\system32\svchost.exe[1560] msvcrt.dll!_open 77C2F566 5 Bytes JMP 019F0000
.text C:\WINDOWS\system32\svchost.exe[1560] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 019F0FD2
.text C:\WINDOWS\system32\svchost.exe[1560] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 019F001D
.text C:\WINDOWS\system32\svchost.exe[1560] WS2_32.dll!socket 71AB4211 5 Bytes JMP 019E000A
.text C:\WINDOWS\system32\svchost.exe[1560] WININET.dll!InternetOpenA 3D95D6A8 5 Bytes JMP 019D000A
.text C:\WINDOWS\system32\svchost.exe[1560] WININET.dll!InternetOpenW 3D95DB21 5 Bytes JMP 019D0FEF
.text C:\WINDOWS\system32\svchost.exe[1560] WININET.dll!InternetOpenUrlA 3D95F3BC 5 Bytes JMP 019D0FDE
.text C:\WINDOWS\system32\svchost.exe[1560] WININET.dll!InternetOpenUrlW 3D9A6DFF 5 Bytes JMP 019D002F
.text C:\WINDOWS\system32\services.exe[1760] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00060FEF
.text C:\WINDOWS\system32\services.exe[1760] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00060025
.text C:\WINDOWS\system32\services.exe[1760] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0006000A
.text C:\WINDOWS\system32\services.exe[1760] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00050FE5
.text C:\WINDOWS\system32\services.exe[1760] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 0005005B
.text C:\WINDOWS\system32\services.exe[1760] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00050F66
.text C:\WINDOWS\system32\services.exe[1760] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00050F83
.text C:\WINDOWS\system32\services.exe[1760] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00050036
.text C:\WINDOWS\system32\services.exe[1760] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0005001B
.text C:\WINDOWS\system32\services.exe[1760] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00050F49
.text C:\WINDOWS\system32\services.exe[1760] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00050091
.text C:\WINDOWS\system32\services.exe[1760] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00050F09
.text C:\WINDOWS\system32\services.exe[1760] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 000500AC
.text C:\WINDOWS\system32\services.exe[1760] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 000500C7
.text C:\WINDOWS\system32\services.exe[1760] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00050F9E
.text C:\WINDOWS\system32\services.exe[1760] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00050FD4
.text C:\WINDOWS\system32\services.exe[1760] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00050076
.text C:\WINDOWS\system32\services.exe[1760] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 0005000A
.text C:\WINDOWS\system32\services.exe[1760] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00050FB9
.text C:\WINDOWS\system32\services.exe[1760] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00050F2E
.text C:\WINDOWS\system32\services.exe[1760] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 0070002C
.text C:\WINDOWS\system32\services.exe[1760] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00700F8A
.text C:\WINDOWS\system32\services.exe[1760] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00700011
.text C:\WINDOWS\system32\services.exe[1760] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00700000
.text C:\WINDOWS\system32\services.exe[1760] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00700047
.text C:\WINDOWS\system32\services.exe[1760] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00700FEF
.text C:\WINDOWS\system32\services.exe[1760] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00700FA5
.text C:\WINDOWS\system32\services.exe[1760] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [90, 88]
.text C:\WINDOWS\system32\services.exe[1760] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00700FC0
.text C:\WINDOWS\system32\services.exe[1760] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 006F003D
.text C:\WINDOWS\system32\services.exe[1760] msvcrt.dll!system 77C293C7 5 Bytes JMP 006F0FA8
.text C:\WINDOWS\system32\services.exe[1760] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 006F0FDE
.text C:\WINDOWS\system32\services.exe[1760] msvcrt.dll!_open 77C2F566 5 Bytes JMP 006F0000
.text C:\WINDOWS\system32\services.exe[1760] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 006F0FC3
.text C:\WINDOWS\system32\services.exe[1760] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 006F0FEF
.text C:\WINDOWS\system32\services.exe[1760] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00070FEF
.text C:\WINDOWS\system32\lsass.exe[1772] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00C40000
.text C:\WINDOWS\system32\lsass.exe[1772] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00C40FC0
.text C:\WINDOWS\system32\lsass.exe[1772] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00C40FE5
.text C:\WINDOWS\system32\lsass.exe[1772] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C30FEF
.text C:\WINDOWS\system32\lsass.exe[1772] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C30084
.text C:\WINDOWS\system32\lsass.exe[1772] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C30069
.text C:\WINDOWS\system32\lsass.exe[1772] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C30058
.text C:\WINDOWS\system32\lsass.exe[1772] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C3003D
.text C:\WINDOWS\system32\lsass.exe[1772] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C30FA5
.text C:\WINDOWS\system32\lsass.exe[1772] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C30F3C
.text C:\WINDOWS\system32\lsass.exe[1772] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C30F4D
.text C:\WINDOWS\system32\lsass.exe[1772] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C300BA
.text C:\WINDOWS\system32\lsass.exe[1772] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C300A9
.text C:\WINDOWS\system32\lsass.exe[1772] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00C30F10
.text C:\WINDOWS\system32\lsass.exe[1772] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00C3002C
.text C:\WINDOWS\system32\lsass.exe[1772] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00C30FCA
.text C:\WINDOWS\system32\lsass.exe[1772] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00C30F6A
.text C:\WINDOWS\system32\lsass.exe[1772] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00C30011
.text C:\WINDOWS\system32\lsass.exe[1772] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00C30000
.text C:\WINDOWS\system32\lsass.exe[1772] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00C30F21
.text C:\WINDOWS\system32\lsass.exe[1772] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00CF0FAF
.text C:\WINDOWS\system32\lsass.exe[1772] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00CF0F79
.text C:\WINDOWS\system32\lsass.exe[1772] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00CF0000
.text C:\WINDOWS\system32\lsass.exe[1772] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00CF0FCA
.text C:\WINDOWS\system32\lsass.exe[1772] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00CF0F9E
.text C:\WINDOWS\system32\lsass.exe[1772] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00CF0FEF
.text C:\WINDOWS\system32\lsass.exe[1772] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00CF0036
.text C:\WINDOWS\system32\lsass.exe[1772] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00CF001B
.text C:\WINDOWS\system32\lsass.exe[1772] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00C60F9C
.text C:\WINDOWS\system32\lsass.exe[1772] msvcrt.dll!system 77C293C7 5 Bytes JMP 00C60FAD
.text C:\WINDOWS\system32\lsass.exe[1772] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00C6001D
.text C:\WINDOWS\system32\lsass.exe[1772] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00C60000
.text C:\WINDOWS\system32\lsass.exe[1772] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00C60FD2
.text C:\WINDOWS\system32\lsass.exe[1772] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00C60FE3
.text C:\WINDOWS\system32\lsass.exe[1772] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00C5000A
.text C:\WINDOWS\system32\svchost.exe[1956] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 0064000A
.text C:\WINDOWS\system32\svchost.exe[1956] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00640025
.text C:\WINDOWS\system32\svchost.exe[1956] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00640FEF
.text C:\WINDOWS\system32\svchost.exe[1956] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00630000
.text C:\WINDOWS\system32\svchost.exe[1956] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00630F9E
.text C:\WINDOWS\system32\svchost.exe[1956] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00630FAF
.text C:\WINDOWS\system32\svchost.exe[1956] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00630089
.text C:\WINDOWS\system32\svchost.exe[1956] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00630062
.text C:\WINDOWS\system32\svchost.exe[1956] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00630040
.text C:\WINDOWS\system32\svchost.exe[1956] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 006300F0
.text C:\WINDOWS\system32\svchost.exe[1956] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 006300C9
.text C:\WINDOWS\system32\svchost.exe[1956] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 0063011C
.text C:\WINDOWS\system32\svchost.exe[1956] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00630F8D
.text C:\WINDOWS\system32\svchost.exe[1956] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00630F68
.text C:\WINDOWS\system32\svchost.exe[1956] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00630051
.text C:\WINDOWS\system32\svchost.exe[1956] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 0063001B
.text C:\WINDOWS\system32\svchost.exe[1956] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 006300AE
.text C:\WINDOWS\system32\svchost.exe[1956] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00630FCA
.text C:\WINDOWS\system32\svchost.exe[1956] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00630FDB
.text C:\WINDOWS\system32\svchost.exe[1956] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 0063010B
.text C:\WINDOWS\system32\svchost.exe[1956] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00BB0F9E
.text C:\WINDOWS\system32\svchost.exe[1956] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00BB0F72
.text C:\WINDOWS\system32\svchost.exe[1956] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00BB0FAF
.text C:\WINDOWS\system32\svchost.exe[1956] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00BB0FCA
.text C:\WINDOWS\system32\svchost.exe[1956] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00BB002F
.text C:\WINDOWS\system32\svchost.exe[1956] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00BB0FE5
.text C:\WINDOWS\system32\svchost.exe[1956] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 00BB0F83
.text C:\WINDOWS\system32\svchost.exe[1956] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [DB, 88]
.text C:\WINDOWS\system32\svchost.exe[1956] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00BB000A
.text C:\WINDOWS\system32\svchost.exe[1956] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 0066005D
.text C:\WINDOWS\system32\svchost.exe[1956] msvcrt.dll!system 77C293C7 5 Bytes JMP 0066004C
.text C:\WINDOWS\system32\svchost.exe[1956] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00660027
.text C:\WINDOWS\system32\svchost.exe[1956] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00660FEF
.text C:\WINDOWS\system32\svchost.exe[1956] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00660FD2
.text C:\WINDOWS\system32\svchost.exe[1956] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00660000
.text C:\WINDOWS\system32\svchost.exe[1956] WS2_32.dll!socket 71AB4211 5 Bytes JMP 0065000A
.text C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe[1968] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 624199A1 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe[1968] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 62419A63 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\WINDOWS\system32\svchost.exe[2144] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00BA000A
.text C:\WINDOWS\system32\svchost.exe[2144] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00BA0FE5
.text C:\WINDOWS\system32\svchost.exe[2144] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00BA001B
.text C:\WINDOWS\system32\svchost.exe[2144] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 009F0FE5
.text C:\WINDOWS\system32\svchost.exe[2144] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 009F009A
.text C:\WINDOWS\system32\svchost.exe[2144] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 009F0089
.text C:\WINDOWS\system32\svchost.exe[2144] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 009F006C
.text C:\WINDOWS\system32\svchost.exe[2144] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 009F0FAF
.text C:\WINDOWS\system32\svchost.exe[2144] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 009F0040
.text C:\WINDOWS\system32\svchost.exe[2144] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 009F00C1
.text C:\WINDOWS\system32\svchost.exe[2144] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 009F0F79
.text C:\WINDOWS\system32\svchost.exe[2144] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 009F00E6
.text C:\WINDOWS\system32\svchost.exe[2144] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 009F0F4D
.text C:\WINDOWS\system32\svchost.exe[2144] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 009F010B
.text C:\WINDOWS\system32\svchost.exe[2144] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 009F0051
.text C:\WINDOWS\system32\svchost.exe[2144] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 009F0FD4
.text C:\WINDOWS\system32\svchost.exe[2144] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 009F0F8A
.text C:\WINDOWS\system32\svchost.exe[2144] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 009F002F
.text C:\WINDOWS\system32\svchost.exe[2144] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 009F000A
.text C:\WINDOWS\system32\svchost.exe[2144] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 009F0F5E
.text C:\WINDOWS\system32\svchost.exe[2144] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 009E0025
.text C:\WINDOWS\system32\svchost.exe[2144] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 009E0F94
.text C:\WINDOWS\system32\svchost.exe[2144] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 009E0FD4
.text C:\WINDOWS\system32\svchost.exe[2144] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 009E000A
.text C:\WINDOWS\system32\svchost.exe[2144] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 009E0FAF
.text C:\WINDOWS\system32\svchost.exe[2144] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 009E0FEF
.text C:\WINDOWS\system32\svchost.exe[2144] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 009E0051
.text C:\WINDOWS\system32\svchost.exe[2144] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 009E0040
.text C:\WINDOWS\system32\svchost.exe[2144] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 009D0F9C
.text C:\WINDOWS\system32\svchost.exe[2144] msvcrt.dll!system 77C293C7 5 Bytes JMP 009D0FAD
.text C:\WINDOWS\system32\svchost.exe[2144] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 009D001D
.text C:\WINDOWS\system32\svchost.exe[2144] msvcrt.dll!_open 77C2F566 5 Bytes JMP 009D0000
.text C:\WINDOWS\system32\svchost.exe[2144] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 009D0FC8
.text C:\WINDOWS\system32\svchost.exe[2144] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 009D0FE3
.text C:\WINDOWS\system32\svchost.exe[2144] WS2_32.dll!socket 71AB4211 5 Bytes JMP 009C0000
.text C:\WINDOWS\Explorer.EXE[2312] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 046F0FEF
.text C:\WINDOWS\Explorer.EXE[2312] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 046F002F
.text C:\WINDOWS\Explorer.EXE[2312] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 046F0014
.text C:\WINDOWS\Explorer.EXE[2312] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 046E0000
.text C:\WINDOWS\Explorer.EXE[2312] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 046E0058
.text C:\WINDOWS\Explorer.EXE[2312] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 046E0047
.text C:\WINDOWS\Explorer.EXE[2312] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 046E0F79
.text C:\WINDOWS\Explorer.EXE[2312] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 046E0036
.text C:\WINDOWS\Explorer.EXE[2312] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 046E0FB9
.text C:\WINDOWS\Explorer.EXE[2312] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 046E00AB
.text C:\WINDOWS\Explorer.EXE[2312] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 046E009A
.text C:\WINDOWS\Explorer.EXE[2312] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 046E00CD
.text C:\WINDOWS\Explorer.EXE[2312] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 046E0F3E
.text C:\WINDOWS\Explorer.EXE[2312] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 046E0F19
.text C:\WINDOWS\Explorer.EXE[2312] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 046E0F94
.text C:\WINDOWS\Explorer.EXE[2312] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 046E0FE5
.text C:\WINDOWS\Explorer.EXE[2312] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 046E0073
.text C:\WINDOWS\Explorer.EXE[2312] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 046E0FCA
.text C:\WINDOWS\Explorer.EXE[2312] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 046E0025
.text C:\WINDOWS\Explorer.EXE[2312] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 046E00BC
.text C:\WINDOWS\Explorer.EXE[2312] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 041B0025
.text C:\WINDOWS\Explorer.EXE[2312] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 041B0F8D
.text C:\WINDOWS\Explorer.EXE[2312] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 041B0FDE
.text C:\WINDOWS\Explorer.EXE[2312] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 041B0014
.text C:\WINDOWS\Explorer.EXE[2312] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 041B0040
.text C:\WINDOWS\Explorer.EXE[2312] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 041B0FEF
.text C:\WINDOWS\Explorer.EXE[2312] ADVAPI32.dll!RegCreateKeyW 77DFBA55 2 Bytes JMP 041B0FA8
.text C:\WINDOWS\Explorer.EXE[2312] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA58 2 Bytes [3B, 8C]
.text C:\WINDOWS\Explorer.EXE[2312] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 041B0FB9
.text C:\WINDOWS\Explorer.EXE[2312] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 041A0031
.text C:\WINDOWS\Explorer.EXE[2312] msvcrt.dll!system 77C293C7 5 Bytes JMP 041A0016
.text C:\WINDOWS\Explorer.EXE[2312] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 041A0FC1
.text C:\WINDOWS\Explorer.EXE[2312] msvcrt.dll!_open 77C2F566 5 Bytes JMP 041A0FEF
.text C:\WINDOWS\Explorer.EXE[2312] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 041A0FB0
.text C:\WINDOWS\Explorer.EXE[2312] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 041A0FDE
.text C:\WINDOWS\Explorer.EXE[2312] WININET.dll!InternetOpenA 3D95D6A8 5 Bytes JMP 04180FEF
.text C:\WINDOWS\Explorer.EXE[2312] WININET.dll!InternetOpenW 3D95DB21 5 Bytes JMP 0418000A
.text C:\WINDOWS\Explorer.EXE[2312] WININET.dll!InternetOpenUrlA 3D95F3BC 5 Bytes JMP 04180FD4
.text C:\WINDOWS\Explorer.EXE[2312] WININET.dll!InternetOpenUrlW 3D9A6DFF 5 Bytes JMP 04180025
.text C:\WINDOWS\Explorer.EXE[2312] WS2_32.dll!socket 71AB4211 5 Bytes JMP 04190000
.text C:\WINDOWS\system32\svchost.exe[2344] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00BD000A
.text C:\WINDOWS\system32\svchost.exe[2344] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00BD001B
.text C:\WINDOWS\system32\svchost.exe[2344] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00BD0FEF
.text C:\WINDOWS\system32\svchost.exe[2344] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BC0FEF
.text C:\WINDOWS\system32\svchost.exe[2344] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BC0094
.text C:\WINDOWS\system32\svchost.exe[2344] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BC0083
.text C:\WINDOWS\system32\svchost.exe[2344] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BC0F9F
.text C:\WINDOWS\system32\svchost.exe[2344] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BC0FBC
.text C:\WINDOWS\system32\svchost.exe[2344] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BC0FCD
.text C:\WINDOWS\system32\svchost.exe[2344] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BC00D6
.text C:\WINDOWS\system32\svchost.exe[2344] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BC00BB
.text C:\WINDOWS\system32\svchost.exe[2344] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BC0F58
.text C:\WINDOWS\system32\svchost.exe[2344] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BC00F1
.text C:\WINDOWS\system32\svchost.exe[2344] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 00BC010C
.text C:\WINDOWS\system32\svchost.exe[2344] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 00BC0054
.text C:\WINDOWS\system32\svchost.exe[2344] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 00BC0FDE
.text C:\WINDOWS\system32\svchost.exe[2344] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 00BC0F84
.text C:\WINDOWS\system32\svchost.exe[2344] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 00BC002F
.text C:\WINDOWS\system32\svchost.exe[2344] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 00BC0014
.text C:\WINDOWS\system32\svchost.exe[2344] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 00BC0F73
.text C:\WINDOWS\system32\svchost.exe[2344] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00BB0FDB
.text C:\WINDOWS\system32\svchost.exe[2344] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00BB007D
.text C:\WINDOWS\system32\svchost.exe[2344] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00BB0022
.text C:\WINDOWS\system32\svchost.exe[2344] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00BB0011
.text C:\WINDOWS\system32\svchost.exe[2344] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00BB0FC0
.text C:\WINDOWS\system32\svchost.exe[2344] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00BB0000
.text C:\WINDOWS\system32\svchost.exe[2344] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00BB0058
.text C:\WINDOWS\system32\svchost.exe[2344] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00BB0047
.text C:\WINDOWS\system32\svchost.exe[2344] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00BA0F9C
.text C:\WINDOWS\system32\svchost.exe[2344] msvcrt.dll!system 77C293C7 5 Bytes JMP 00BA0FAD
.text C:\WINDOWS\system32\svchost.exe[2344] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00BA000C
.text C:\WINDOWS\system32\svchost.exe[2344] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00BA0FE3
.text C:\WINDOWS\system32\svchost.exe[2344] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00BA001D
.text C:\WINDOWS\system32\svchost.exe[2344] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00BA0FD2
.text C:\WINDOWS\system32\dllhost.exe[3048] ntdll.dll!NtCreateFile 7C90D0AE 5 Bytes JMP 00A80FEF
.text C:\WINDOWS\system32\dllhost.exe[3048] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00A80FD4
.text C:\WINDOWS\system32\dllhost.exe[3048] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00A8000A
.text C:\WINDOWS\system32\dllhost.exe[3048] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 009B0FEF
.text C:\WINDOWS\system32\dllhost.exe[3048] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 009B0F68
.text C:\WINDOWS\system32\dllhost.exe[3048] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 009B0F83
.text C:\WINDOWS\system32\dllhost.exe[3048] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 009B0F94
.text C:\WINDOWS\system32\dllhost.exe[3048] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 009B0051
.text C:\WINDOWS\system32\dllhost.exe[3048] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 009B0FC0
.text C:\WINDOWS\system32\dllhost.exe[3048] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 009B0F30
.text C:\WINDOWS\system32\dllhost.exe[3048] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 009B0F41
.text C:\WINDOWS\system32\dllhost.exe[3048] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 009B0EFA
.text C:\WINDOWS\system32\dllhost.exe[3048] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 009B0093
.text C:\WINDOWS\system32\dllhost.exe[3048] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 009B00AE
.text C:\WINDOWS\system32\dllhost.exe[3048] kernel32.dll!LoadLibraryW 7C80AEEB 5 Bytes JMP 009B0FAF
.text C:\WINDOWS\system32\dllhost.exe[3048] kernel32.dll!CreateFileW 7C810800 5 Bytes JMP 009B0000
.text C:\WINDOWS\system32\dllhost.exe[3048] kernel32.dll!CreatePipe 7C81D83F 5 Bytes JMP 009B0078
.text C:\WINDOWS\system32\dllhost.exe[3048] kernel32.dll!CreateNamedPipeW 7C82F0DD 5 Bytes JMP 009B0036
.text C:\WINDOWS\system32\dllhost.exe[3048] kernel32.dll!CreateNamedPipeA 7C860CDC 5 Bytes JMP 009B001B
.text C:\WINDOWS\system32\dllhost.exe[3048] kernel32.dll!WinExec 7C86250D 5 Bytes JMP 009B0F1F
.text C:\WINDOWS\system32\dllhost.exe[3048] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 0099003B
.text C:\WINDOWS\system32\dllhost.exe[3048] msvcrt.dll!system 77C293C7 5 Bytes JMP 00990FA6
.text C:\WINDOWS\system32\dllhost.exe[3048] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00990FD2
.text C:\WINDOWS\system32\dllhost.exe[3048] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00990000
.text C:\WINDOWS\system32\dllhost.exe[3048] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00990FC1
.text C:\WINDOWS\system32\dllhost.exe[3048] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00990FE3
.text C:\WINDOWS\system32\dllhost.exe[3048] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 009A004A
.text C:\WINDOWS\system32\dllhost.exe[3048] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 009A0087
.text C:\WINDOWS\system32\dllhost.exe[3048] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 009A0025
.text C:\WINDOWS\system32\dllhost.exe[3048] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 009A0FEF
.text C:\WINDOWS\system32\dllhost.exe[3048] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 009A0076
.text C:\WINDOWS\system32\dllhost.exe[3048] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 009A000A
.text C:\WINDOWS\system32\dllhost.exe[3048] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 009A005B
.text C:\WINDOWS\system32\dllhost.exe[3048] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 009A0FDE
.text C:\WINDOWS\system32\dllhost.exe[3048] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00980FE5
.text C:\program files\real\realplayer\update\realsched.exe[3452] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\mfevtps.exe[420] @ C:\WINDOWS\system32\CRYPT32.dll [ADVAPI32.dll!RegQueryValueExW] [0040A4D0] C:\WINDOWS\system32\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.)
IAT C:\WINDOWS\system32\mfevtps.exe[420] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [0040A530] C:\WINDOWS\system32\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
AttachedDevice \FileSystem\Ntfs \Ntfs MOBK.sys (Mozy Change Monitor Filter Driver/Mozy, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

Device \FileSystem\Fastfat \Fat 9DD60D20

AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat MOBK.sys (Mozy Change Monitor Filter Driver/Mozy, Inc.)

---- EOF - GMER 1.0.15 ----

[maliprog]

Malwarebytes found something but we didn't remove it.

Step 1

Please do another Malwarebytes scan but this time remove all findings. Post log for me.

Step 2

Download and Install Combofix

Download ComboFix from one of the following locations:

Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop *

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
• Accept the disclaimer and allow to update if it asks
  
  
  
  
• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

Step 3

Please don't forget to include these items in your reply:

• Malwarebytes log
• Combofix log

It would be helpful if you could post each log in separate post

[TXVA John]

The PC still seems to take longer to load. I'm not sure if it's the age of the machine (2005 with original specs still) or something else.

Here's the Malwarebytes Log.


Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org

Database version: v2012.05.05.07

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
John :: JNH-LAP [administrator]

Protection: Disabled

5/5/2012 12:23:14 PM
mbam-log-2012-05-05 (12-23-14).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 230196
Time elapsed: 31 minute(s), 40 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

[TXVA John]

And here's the ComboFix Log.


ComboFix 12-05-05.06 - John 05/05/2012 13:12:28.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1467 [GMT -4:00]
Running from: c:\documents and settings\John\Desktop\ComboFix.exe
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Firewall *Disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\drivers\1028_DELL_XPS_MP061 .MRK
c:\windows\system32\drivers\DELL_XPS_MP061 .MRK
.
.
((((((((((((((((((((((((( Files Created from 2012-04-05 to 2012-05-05 )))))))))))))))))))))))))))))))
.
.
2012-05-02 23:40 . 2012-05-02 23:40 -------- d-----w- c:\program files\WinPcap
2012-05-02 23:28 . 2012-05-02 23:28 205072 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2012-04-30 20:02 . 2012-04-30 20:02 -------- d-----w- c:\program files\Mozilla Maintenance Service
2012-04-30 20:02 . 2012-04-30 20:02 157352 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-04-30 20:02 . 2012-04-30 20:02 129976 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-04-29 20:57 . 2012-03-20 17:06 29272 ----a-w- c:\program files\Mozilla Firefox\ScriptFF.dll
2012-04-11 05:08 . 2008-04-14 00:12 26624 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-05 00:08 . 2012-04-03 16:23 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-05 00:08 . 2011-05-22 16:21 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-04 19:56 . 2011-04-04 00:09 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-03-20 17:11 . 2011-04-03 20:18 151880 ----a-w- c:\windows\system32\mfevtps.exe
2012-03-01 11:01 . 2006-03-04 03:33 916992 ----a-w- c:\windows\system32\wininet.dll
2012-03-01 11:01 . 2004-08-10 11:00 43520 ------w- c:\windows\system32\licmgr10.dll
2012-03-01 11:01 . 2004-08-10 11:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-02-29 14:10 . 2004-08-10 11:00 177664 ----a-w- c:\windows\system32\wintrust.dll
2012-02-29 14:10 . 2004-08-10 11:00 148480 ----a-w- c:\windows\system32\imagehlp.dll
2012-02-29 12:17 . 2004-08-10 11:00 385024 ------w- c:\windows\system32\html.iec
2012-02-26 00:51 . 2012-02-26 00:51 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-02-26 00:51 . 2011-04-03 20:33 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-02-22 17:29 . 2011-04-03 20:27 9608 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
2012-02-22 17:29 . 2011-04-03 20:27 89792 ----a-w- c:\windows\system32\drivers\mfetdi2k.sys
2012-02-22 17:29 . 2011-04-03 20:27 87656 ----a-w- c:\windows\system32\drivers\mferkdet.sys
2012-02-22 17:29 . 2011-04-03 20:27 83856 ----a-w- c:\windows\system32\drivers\mfendisk.sys
2012-02-22 17:29 . 2011-04-03 20:27 59456 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2012-02-22 17:29 . 2011-04-03 20:27 57600 ----a-w- c:\windows\system32\drivers\cfwids.sys
2012-02-22 17:29 . 2011-04-03 20:27 340920 ----a-w- c:\windows\system32\drivers\mfefirek.sys
2012-02-22 17:29 . 2011-04-03 20:27 180848 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2012-02-22 17:29 . 2010-10-14 02:28 464304 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2012-02-22 17:29 . 2010-10-14 02:28 121544 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
2012-02-07 15:02 . 2012-02-07 15:02 1070352 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2012-04-30 20:02 . 2011-12-19 01:29 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK]
@="{3c3f3c1a-9153-7c05-f938-622e7003894d}"
[HKEY_CLASSES_ROOT\CLSID\{3c3f3c1a-9153-7c05-f938-622e7003894d}]
2010-04-14 00:11 2872120 ----a-w- c:\program files\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK2]
@="{e6ea1d7d-144e-b977-98c4-84c53c1a69d0}"
[HKEY_CLASSES_ROOT\CLSID\{e6ea1d7d-144e-b977-98c4-84c53c1a69d0}]
2010-04-14 00:11 2872120 ----a-w- c:\program files\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK3]
@="{b4caf489-1eec-c617-49ad-8d7088598c06}"
[HKEY_CLASSES_ROOT\CLSID\{b4caf489-1eec-c617-49ad-8d7088598c06}]
2010-04-14 00:11 2872120 ----a-w- c:\program files\McAfee Online Backup\MOBKshell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Vid"="c:\program files\Logitech\Vid HD\Vid.exe" [2011-01-13 6129496]
"MusicManager"="c:\documents and settings\John\Local Settings\Application Data\Programs\Google\MusicManager\MusicManager.exe" [2012-03-20 13324288]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-02 1392640]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2012-03-22 1318816]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 282624]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2011-11-11 205336]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2011-11-26 296056]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WUAppSetup"="c:\program files\Common Files\logishrd\WUApp32.exe" [2012-01-18 465944]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
Sonic CinePlayer Quick Launch.lnk - c:\program files\Common Files\Sonic Shared\CineTray.exe [2006-7-25 114688]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK32.EXE [2011-12-23 611144]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\John\\J C Stillings\\Desktop\\Downloads\\DnD\\DDI_CB.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\FinalMediaPlayer\\FMPCheckForUpdates.exe"=
"c:\\Program Files\\Common Files\\Mcafee\\McSvcHost\\McSvHost.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxs08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqfxt08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\{7E0E61CC-1C99-429D-BEA7-C4DD5B898D2A}\\setup\\hpznui01.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Logitech\\Vid HD\\Vid.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"56520:TCP"= 56520:TCP:Pando Media Booster
"56520:UDP"= 56520:UDP:Pando Media Booster
.
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [4/3/2011 4:27 PM 89792]
R1 MOBKFilter;MOBKFilter;c:\windows\system32\drivers\MOBK.sys [4/3/2011 4:28 PM 54776]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [4/3/2011 8:09 PM 654408]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [4/3/2011 4:27 PM 214904]
R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [4/3/2011 4:27 PM 214904]
R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [4/3/2011 4:27 PM 214904]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\Mcafee\SystemCore\mfefire.exe [4/3/2011 4:27 PM 161632]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [4/3/2011 4:18 PM 151880]
R2 MOBKbackup;McAfee Online Backup;c:\program files\McAfee Online Backup\MOBKbackup.exe [4/13/2010 8:11 PM 229688]
R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [10/20/2009 2:19 PM 50704]
R2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe [4/1/2011 1:11 AM 450848]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [4/3/2011 4:27 PM 57600]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [4/3/2011 8:09 PM 22344]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [4/3/2011 4:27 PM 340920]
R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [4/3/2011 4:27 PM 83856]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6/12/2011 7:30 PM 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/3/2012 12:23 PM 257696]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [6/12/2011 7:30 PM 136176]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [4/3/2011 4:27 PM 83856]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [4/3/2011 4:27 PM 87656]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [4/30/2012 4:02 PM 129976]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mfeavfk01
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 00:08]
.
2012-05-04 c:\windows\Tasks\Final Media Player Update Checker.job
- c:\program files\FinalMediaPlayer\FMPCheckForUpdates.exe [2011-06-19 20:50]
.
2012-05-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-06-12 23:30]
.
2012-05-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-06-12 23:30]
.
2012-05-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1060284298-412668190-682003330-1003Core.job
- c:\documents and settings\John\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-04-03 20:41]
.
2012-05-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1060284298-412668190-682003330-1003UA.job
- c:\documents and settings\John\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-04-03 20:41]
.
2012-05-04 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1060284298-412668190-682003330-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-11-08 21:14]
.
2012-04-07 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1060284298-412668190-682003330-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-11-08 21:14]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1 71.252.0.12
FF - ProfilePath - c:\documents and settings\John\Application Data\Mozilla\Firefox\Profiles\md5nf5jq.default\
FF - prefs.js: browser.startup.homepage - www.google.com
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-05 13:24
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1732)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\wldap32.dll
c:\windows\System32\BCMLogon.dll
.
Completion time: 2012-05-05 13:28:18
ComboFix-quarantined-files.txt 2012-05-05 17:28
.
Pre-Run: 9,346,818,048 bytes free
Post-Run: 10,350,563,328 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
.
- - End Of File - - F110CFE4C76CDB1C26D1FF5D6251EA65

[TXVA John]

Also, while ComboFix was running, I kept getting a message that file "NIRKMD" could not be found. The message seemed to appear at the end of every phase or something, because when I clicked on "OK", the next part of the scan would start.

[maliprog]

Hi TXVA John,

How is your system now? Problems?

Download Virus Removal Tool from Here to your desktop

Run the programme you have just downloaded to your desktop (it will be randomly named )

First we will run a virus scan

Click the cog in the upper right



Select down to and including your main drive, once done select the Automatic scan tab and press Start Scan


Allow Virus Removal Tool to delete all infections found
Once it has finished select report tab (last tab)
Select Detected threads report from the left and press Save button
Save it to your desktop and attach to your next post

[TXVA John]

There was nothing in the Detected Threats log to post. System is still slower than usual starting up, and the screen that tells you to choose between normal mode, Recovery Mode, and one other to start with shows up. One of the modes says it's not available because it's been disabled.

[maliprog]

You have Recovery console and that is why you have additional screen at beginning. That is normal and I have it too. Let's try to speed your system a little. Let me know how is it after all these steps.

Step 1

NOTE: This fix is custom made for this system only and for current system state! Don't try to run it on another system!

Please close all running programs and Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  
  :Commands
  [purity]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Post the fix log it produces in your next reply or you can find it in C:\_OTL\MovedFiles

Step 2

Startuplite is a tool to help you stop some programs not needed when you start your computer from loading. They will begin automatically only when needed.

Run the tool and it will disable all unnecessary sturtup entries.
Click on Continue button to save changes.

Step 3

Download and run Puran Disc Defragmenter
Click on Boot Time Defrag button and choose Restart-Defrag-Restart

[TXVA John]

Here's the OTL results log. I am running the defrag now.


All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Dean
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: John
->Temp folder emptied: 20233147 bytes
->Temporary Internet Files folder emptied: 38065123 bytes
->Java cache emptied: 81273 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 12087565 bytes
->Apple Safari cache emptied: 0 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 886 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 46063 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 67.00 mb


OTL by OldTimer - Version 3.2.42.2 log created on 05082012_115756

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

[TXVA John]

I ran the defrag, and it took care of the defrag part just fine. It appeared to get hung up on the "write space" part of the program because it sat at 46% for over 2.5 hours. I went ahead and exited the program at that point. Should I run the defrag again overnight?

Also, on the black screen that gives the option to start in Recovery Mode, the one option says, "do not choose (debugger is enabled)". Is it supposed to say that?

[maliprog]

Hi TXVA John,

Also, on the black screen that gives the option to start in Recovery Mode, the one option says, "do not choose (debugger is enabled)". Is it supposed to say that?

This is just a boot option just like Recovery Mode. Don't worry about it.

I don't see any malware on your system. I'll remove my tools and call it clean.

Step 1

Please start OTL one more time and click CleanUp button. OTL will restart your system at the end. Remove all other application we used to clean your PC.

General recommendations

Here are some recommendations you should follow to minimize infection risk in the future:

1. Enable Windows Update

• Click Start, click Run, type sysdm.cpl, and then press ENTER.
• Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended) Automatically download recommended updates for my computer and install them option.
• Click OK button

2. Delete Temp files

Download TFC to your desktop

• Open the file and close any other windows.
• It will close all programs itself when run, make sure to let it run uninterrupted.
• Click the Start button to begin the process. The program should not take long to finish its job
• Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

3. Make Backups of Important Files

Please read this article Home Computer Data Backup.


4. Regularly update your software

To eliminate design flaws and security vulnerabilities, all software needs to be updated to the latest version or the vendor’s patch installed.

You should download Update Checker from here. The program will automaticly check for newer version of software installed on your system.

[TXVA John]

Thanks mailprog. System is working just fine now.