GMER 1.0.15.14966 - http://www.gmer.net Rootkit scan 2009-04-01 21:48:56 Windows 5.1.2600 Service Pack 2 ---- System - GMER 1.0.15 ---- Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xF316B44A] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateKey [0xF316B4E1] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xF316B3F8] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xF316B40C] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xF316B4F5] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xF316B521] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateKey [0xF316B594] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateValueKey [0xF316B579] Code 86158B80 ZwFlushInstructionCache Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xF316B48A] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0xF316B5BE] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xF316B4CD] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xF316B3D0] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xF316B3E4] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xF316B45E] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryKey [0xF316B5FA] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0xF316B563] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryValueKey [0xF316B54D] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xF316B50B] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0xF316B5E6] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0xF316B5D2] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0xF316B436] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xF316B422] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetValueKey [0xF316B537] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xF316B4B9] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnloadKey [0xF316B5A8] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xF316B4A0] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xF316B474] Code 8615FC0E IofCallDriver Code 8615DA4E IofCompleteRequest Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess ---- Kernel code sections - GMER 1.0.15 ---- .text ntkrnlpa.exe!IofCallDriver 804EF1A0 5 Bytes JMP 8615FC13 .text ntkrnlpa.exe!IofCompleteRequest 804EF230 5 Bytes JMP 8615DA53 PAGE ntkrnlpa.exe!ZwFlushInstructionCache 805B5642 5 Bytes JMP 86158B84 ---- User code sections - GMER 1.0.15 ---- .text C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe[152] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00CB000A .text C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe[152] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00CC000A .text C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[168] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 008C000A .text C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe[168] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 008D000A .text C:\Program Files\QuickTime\QTTask.exe[228] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00AD000A .text C:\Program Files\QuickTime\QTTask.exe[228] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00AE000A .text C:\Program Files\iTunes\iTunesHelper.exe[240] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00BA000A .text C:\Program Files\iTunes\iTunesHelper.exe[240] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00BB000A .text C:\Program Files\McAfee.com\Agent\mcagent.exe[260] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00D3000A .text C:\Program Files\McAfee.com\Agent\mcagent.exe[260] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00D4000A .text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[284] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A4000A .text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[284] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00A5000A .text C:\Program Files\Messenger\msmsgs.exe[316] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00AD000A .text C:\Program Files\Messenger\msmsgs.exe[316] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00AE000A .text C:\Program Files\Messenger\msmsgs.exe[316] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00FE0FEF .text C:\Program Files\Messenger\msmsgs.exe[316] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00FE0054 .text C:\Program Files\Messenger\msmsgs.exe[316] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00FE0F55 .text C:\Program Files\Messenger\msmsgs.exe[316] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00FE0F66 .text C:\Program Files\Messenger\msmsgs.exe[316] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00FE0F8D .text C:\Program Files\Messenger\msmsgs.exe[316] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00FE0014 .text C:\Program Files\Messenger\msmsgs.exe[316] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00FE0F0C .text C:\Program Files\Messenger\msmsgs.exe[316] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00FE0F33 .text C:\Program Files\Messenger\msmsgs.exe[316] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00FE0EFB .text C:\Program Files\Messenger\msmsgs.exe[316] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00FE008A .text C:\Program Files\Messenger\msmsgs.exe[316] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 00FE0EEA .text C:\Program Files\Messenger\msmsgs.exe[316] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 00FE002F .text C:\Program Files\Messenger\msmsgs.exe[316] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 00FE0FD4 .text C:\Program Files\Messenger\msmsgs.exe[316] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 00FE0F44 .text C:\Program Files\Messenger\msmsgs.exe[316] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 00FE0F9E .text C:\Program Files\Messenger\msmsgs.exe[316] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 00FE0FB9 .text C:\Program Files\Messenger\msmsgs.exe[316] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00FE0079 .text C:\Program Files\Messenger\msmsgs.exe[316] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00FB004B .text C:\Program Files\Messenger\msmsgs.exe[316] msvcrt.dll!system 77C293C7 5 Bytes JMP 00FB003A .text C:\Program Files\Messenger\msmsgs.exe[316] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00FB0FD4 .text C:\Program Files\Messenger\msmsgs.exe[316] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00FB000C .text C:\Program Files\Messenger\msmsgs.exe[316] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00FB0029 .text C:\Program Files\Messenger\msmsgs.exe[316] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00FB0FEF .text C:\Program Files\Messenger\msmsgs.exe[316] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00FC0FC3 .text C:\Program Files\Messenger\msmsgs.exe[316] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 00FC004A .text C:\Program Files\Messenger\msmsgs.exe[316] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00FC000A .text C:\Program Files\Messenger\msmsgs.exe[316] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00FC0FD4 .text C:\Program Files\Messenger\msmsgs.exe[316] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00FC0F8D .text C:\Program Files\Messenger\msmsgs.exe[316] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00FC0F9E .text C:\Program Files\Messenger\msmsgs.exe[316] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00FC0FEF .text C:\Program Files\Messenger\msmsgs.exe[316] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00FC002F .text C:\Program Files\Messenger\msmsgs.exe[316] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00FA0FE5 .text C:\Program Files\Messenger\msmsgs.exe[316] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 00FD0FEF .text C:\Program Files\Messenger\msmsgs.exe[316] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 00FD0FDE .text C:\Program Files\Messenger\msmsgs.exe[316] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 00FD000A .text C:\Program Files\Messenger\msmsgs.exe[316] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 00FD0FB9 .text c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe[372] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A9000A .text c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe[372] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00AA000A .text C:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe[420] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00D5000A .text C:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe[420] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00D6000A .text C:\WINDOWS\system32\rundll32.exe[468] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A7000A .text C:\WINDOWS\system32\rundll32.exe[468] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00A8000A .text C:\Program Files\FinePixViewerS\QuickDCF2.exe[492] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00AE000A .text C:\Program Files\FinePixViewerS\QuickDCF2.exe[492] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00AF000A .text C:\WINDOWS\system32\winlogon.exe[712] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0068000A .text C:\WINDOWS\system32\winlogon.exe[712] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0069000A .text C:\WINDOWS\system32\services.exe[760] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0064000A .text C:\WINDOWS\system32\services.exe[760] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0065000A .text C:\WINDOWS\system32\services.exe[760] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00EE0000 .text C:\WINDOWS\system32\services.exe[760] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00EE009A .text C:\WINDOWS\system32\services.exe[760] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00EE0089 .text C:\WINDOWS\system32\services.exe[760] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00EE006C .text C:\WINDOWS\system32\services.exe[760] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00EE005B .text C:\WINDOWS\system32\services.exe[760] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00EE0036 .text C:\WINDOWS\system32\services.exe[760] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00EE00DC .text C:\WINDOWS\system32\services.exe[760] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00EE00C1 .text C:\WINDOWS\system32\services.exe[760] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00EE0F4D .text C:\WINDOWS\system32\services.exe[760] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00EE0F5E .text C:\WINDOWS\system32\services.exe[760] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 00EE0F3C .text C:\WINDOWS\system32\services.exe[760] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 00EE0FB9 .text C:\WINDOWS\system32\services.exe[760] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 00EE0011 .text C:\WINDOWS\system32\services.exe[760] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 00EE0F8A .text C:\WINDOWS\system32\services.exe[760] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 00EE0FCA .text C:\WINDOWS\system32\services.exe[760] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 00EE0FE5 .text C:\WINDOWS\system32\services.exe[760] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00EE0F79 .text C:\WINDOWS\system32\services.exe[760] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00050F9C .text C:\WINDOWS\system32\services.exe[760] msvcrt.dll!system 77C293C7 5 Bytes JMP 00050027 .text C:\WINDOWS\system32\services.exe[760] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00050FD2 .text C:\WINDOWS\system32\services.exe[760] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00050000 .text C:\WINDOWS\system32\services.exe[760] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00050FC1 .text C:\WINDOWS\system32\services.exe[760] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00050FEF .text C:\WINDOWS\system32\services.exe[760] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00060FD4 .text C:\WINDOWS\system32\services.exe[760] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 00060091 .text C:\WINDOWS\system32\services.exe[760] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00060025 .text C:\WINDOWS\system32\services.exe[760] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 0006000A .text C:\WINDOWS\system32\services.exe[760] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 0006006C .text C:\WINDOWS\system32\services.exe[760] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 0006005B .text C:\WINDOWS\system32\services.exe[760] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00060FEF .text C:\WINDOWS\system32\services.exe[760] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 0006004A .text C:\WINDOWS\system32\services.exe[760] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 00070FEF .text C:\WINDOWS\system32\services.exe[760] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 00070FD4 .text C:\WINDOWS\system32\services.exe[760] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 00070014 .text C:\WINDOWS\system32\services.exe[760] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 00070025 .text C:\WINDOWS\system32\services.exe[760] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00040000 .text C:\WINDOWS\system32\lsass.exe[772] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0072000A .text C:\WINDOWS\system32\lsass.exe[772] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0075000A .text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 01420FEF .text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 01420FBC .text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 014200A7 .text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 0142008A .text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 01420FCD .text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 01420065 .text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 014200F1 .text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 014200D6 .text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 01420F62 .text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 01420F7D .text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 01420116 .text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 01420FDE .text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 01420014 .text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 01420FAB .text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 01420040 .text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 0142002F .text C:\WINDOWS\system32\lsass.exe[772] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 01420F8E .text C:\WINDOWS\system32\lsass.exe[772] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 013F0FCA .text C:\WINDOWS\system32\lsass.exe[772] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 013F0F9E .text C:\WINDOWS\system32\lsass.exe[772] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 013F0FDB .text C:\WINDOWS\system32\lsass.exe[772] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 013F001B .text C:\WINDOWS\system32\lsass.exe[772] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 013F0051 .text C:\WINDOWS\system32\lsass.exe[772] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 013F0040 .text C:\WINDOWS\system32\lsass.exe[772] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 013F0000 .text C:\WINDOWS\system32\lsass.exe[772] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 013F0FB9 .text C:\WINDOWS\system32\lsass.exe[772] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 013E0FA3 .text C:\WINDOWS\system32\lsass.exe[772] msvcrt.dll!system 77C293C7 5 Bytes JMP 013E0FB4 .text C:\WINDOWS\system32\lsass.exe[772] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 013E0FE3 .text C:\WINDOWS\system32\lsass.exe[772] msvcrt.dll!_open 77C2F566 5 Bytes JMP 013E000C .text C:\WINDOWS\system32\lsass.exe[772] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 013E002E .text C:\WINDOWS\system32\lsass.exe[772] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 013E001D .text C:\WINDOWS\system32\lsass.exe[772] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 013D0FE5 .text C:\WINDOWS\system32\lsass.exe[772] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 0140000A .text C:\WINDOWS\system32\lsass.exe[772] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 01400025 .text C:\WINDOWS\system32\lsass.exe[772] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 01400036 .text C:\WINDOWS\system32\lsass.exe[772] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 01400051 .text C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A8000A .text C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00A9000A .text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 02820FEF .text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 0282007A .text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 0282005F .text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 0282004E .text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 02820F91 .text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 02820022 .text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 02820F3E .text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 02820F4F .text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 028200BC .text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 028200A1 .text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 028200CD .text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 0282003D .text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 02820FCA .text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 02820F60 .text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 02820011 .text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 02820000 .text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 02820F23 .text C:\WINDOWS\system32\svchost.exe[956] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 027C0036 .text C:\WINDOWS\system32\svchost.exe[956] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 027C0F94 .text C:\WINDOWS\system32\svchost.exe[956] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 027C001B .text C:\WINDOWS\system32\svchost.exe[956] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 027C0FDB .text C:\WINDOWS\system32\svchost.exe[956] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 027C0FA5 .text C:\WINDOWS\system32\svchost.exe[956] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 027C0051 .text C:\WINDOWS\system32\svchost.exe[956] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 027C0000 .text C:\WINDOWS\system32\svchost.exe[956] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 027C0FCA .text C:\WINDOWS\system32\svchost.exe[956] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 027B0F9C .text C:\WINDOWS\system32\svchost.exe[956] msvcrt.dll!system 77C293C7 5 Bytes JMP 027B0FAD .text C:\WINDOWS\system32\svchost.exe[956] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 027B0FC8 .text C:\WINDOWS\system32\svchost.exe[956] msvcrt.dll!_open 77C2F566 5 Bytes JMP 027B0000 .text C:\WINDOWS\system32\svchost.exe[956] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 027B001D .text C:\WINDOWS\system32\svchost.exe[956] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 027B0FEF .text C:\WINDOWS\system32\svchost.exe[956] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 027D000A .text C:\WINDOWS\system32\svchost.exe[956] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 027D0FEF .text C:\WINDOWS\system32\svchost.exe[956] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 027D002F .text C:\WINDOWS\system32\svchost.exe[956] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 027D004A .text C:\WINDOWS\system32\svchost.exe[956] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 027A0000 .text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 01360FEF .text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 01360F65 .text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 0136005A .text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 01360033 .text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 01360F76 .text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 01360022 .text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 01360086 .text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 01360F3E .text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 01360F2D .text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 013600C6 .text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 01360F12 .text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 01360F9B .text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 01360000 .text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 01360075 .text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 01360FB6 .text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 01360011 .text C:\WINDOWS\system32\svchost.exe[1024] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 013600A1 .text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 01340036 .text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 01340F83 .text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 01340FEF .text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 0134001B .text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 01340F9E .text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 01340FAF .text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 0134000A .text C:\WINDOWS\system32\svchost.exe[1024] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 01340FCA .text C:\WINDOWS\system32\svchost.exe[1024] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 01330036 .text C:\WINDOWS\system32\svchost.exe[1024] msvcrt.dll!system 77C293C7 5 Bytes JMP 0133001B .text C:\WINDOWS\system32\svchost.exe[1024] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 01330FB5 .text C:\WINDOWS\system32\svchost.exe[1024] msvcrt.dll!_open 77C2F566 5 Bytes JMP 01330FEF .text C:\WINDOWS\system32\svchost.exe[1024] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 01330000 .text C:\WINDOWS\system32\svchost.exe[1024] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 01330FD2 .text C:\WINDOWS\system32\svchost.exe[1024] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 01350000 .text C:\WINDOWS\system32\svchost.exe[1024] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 01350FE5 .text C:\WINDOWS\system32\svchost.exe[1024] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 01350FD4 .text C:\WINDOWS\system32\svchost.exe[1024] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 0135001B .text C:\WINDOWS\system32\svchost.exe[1024] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 01320FE5 .text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 035A0000 .text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 035A009A .text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 035A0089 .text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 035A006E .text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 035A0051 .text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 035A0FAF .text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 035A0F63 .text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 035A00AB .text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 035A00BC .text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 035A0F2D .text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 035A0F08 .text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 035A0036 .text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 035A0FDB .text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 035A0F8A .text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 035A0FC0 .text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 035A0011 .text C:\WINDOWS\System32\svchost.exe[1140] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 035A0F3E .text C:\WINDOWS\System32\svchost.exe[1140] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 03580025 .text C:\WINDOWS\System32\svchost.exe[1140] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 03580F8A .text C:\WINDOWS\System32\svchost.exe[1140] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 03580FCA .text C:\WINDOWS\System32\svchost.exe[1140] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 03580000 .text C:\WINDOWS\System32\svchost.exe[1140] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 03580FA5 .text C:\WINDOWS\System32\svchost.exe[1140] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 03580051 .text C:\WINDOWS\System32\svchost.exe[1140] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 03580FE5 .text C:\WINDOWS\System32\svchost.exe[1140] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 03580036 .text C:\WINDOWS\System32\svchost.exe[1140] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 03570038 .text C:\WINDOWS\System32\svchost.exe[1140] msvcrt.dll!system 77C293C7 5 Bytes JMP 03570FAD .text C:\WINDOWS\System32\svchost.exe[1140] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 0357001D .text C:\WINDOWS\System32\svchost.exe[1140] msvcrt.dll!_open 77C2F566 5 Bytes JMP 03570FE3 .text C:\WINDOWS\System32\svchost.exe[1140] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 03570FBE .text C:\WINDOWS\System32\svchost.exe[1140] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 0357000C .text C:\WINDOWS\System32\svchost.exe[1140] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 03590000 .text C:\WINDOWS\System32\svchost.exe[1140] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 03590FEF .text C:\WINDOWS\System32\svchost.exe[1140] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 03590025 .text C:\WINDOWS\System32\svchost.exe[1140] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 0359004A .text C:\WINDOWS\System32\svchost.exe[1140] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 03560000 .text C:\WINDOWS\system32\svchost.exe[1208] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00F90FE5 .text C:\WINDOWS\system32\svchost.exe[1208] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00F9009A .text C:\WINDOWS\system32\svchost.exe[1208] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00F90089 .text C:\WINDOWS\system32\svchost.exe[1208] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00F90FA5 .text C:\WINDOWS\system32\svchost.exe[1208] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00F90062 .text C:\WINDOWS\system32\svchost.exe[1208] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00F90047 .text C:\WINDOWS\system32\svchost.exe[1208] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00F900D2 .text C:\WINDOWS\system32\svchost.exe[1208] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00F900AB .text C:\WINDOWS\system32\svchost.exe[1208] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00F900FE .text C:\WINDOWS\system32\svchost.exe[1208] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00F90F65 .text C:\WINDOWS\system32\svchost.exe[1208] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 00F90F40 .text C:\WINDOWS\system32\svchost.exe[1208] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 00F90FC0 .text C:\WINDOWS\system32\svchost.exe[1208] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 00F90000 .text C:\WINDOWS\system32\svchost.exe[1208] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 00F90F8A .text C:\WINDOWS\system32\svchost.exe[1208] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 00F9002C .text C:\WINDOWS\system32\svchost.exe[1208] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 00F90011 .text C:\WINDOWS\system32\svchost.exe[1208] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00F900ED .text C:\WINDOWS\system32\svchost.exe[1208] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00F70FB9 .text C:\WINDOWS\system32\svchost.exe[1208] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 00F70F83 .text C:\WINDOWS\system32\svchost.exe[1208] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00F7000A .text C:\WINDOWS\system32\svchost.exe[1208] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00F70FDE .text C:\WINDOWS\system32\svchost.exe[1208] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00F70040 .text C:\WINDOWS\system32\svchost.exe[1208] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00F70025 .text C:\WINDOWS\system32\svchost.exe[1208] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00F70FEF .text C:\WINDOWS\system32\svchost.exe[1208] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00F70F9E .text C:\WINDOWS\system32\svchost.exe[1208] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00F60042 .text C:\WINDOWS\system32\svchost.exe[1208] msvcrt.dll!system 77C293C7 5 Bytes JMP 00F60027 .text C:\WINDOWS\system32\svchost.exe[1208] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00F60FC8 .text C:\WINDOWS\system32\svchost.exe[1208] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00F60FEF .text C:\WINDOWS\system32\svchost.exe[1208] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00F60FB7 .text C:\WINDOWS\system32\svchost.exe[1208] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00F6000C .text C:\WINDOWS\system32\svchost.exe[1208] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 00F80FEF .text C:\WINDOWS\system32\svchost.exe[1208] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 00F80FDE .text C:\WINDOWS\system32\svchost.exe[1208] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 00F80014 .text C:\WINDOWS\system32\svchost.exe[1208] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 00F80025 .text C:\WINDOWS\system32\svchost.exe[1208] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00F50000 .text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[1284] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A9000A .text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[1284] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00AA000A .text C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe[1340] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00B5000A .text C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe[1340] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00B6000A .text C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00EB0000 .text C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00EB0078 .text C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00EB0F8D .text C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00EB0F9E .text C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00EB0FAF .text C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00EB0FCA .text C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00EB0F61 .text C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00EB009D .text C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00EB00D5 .text C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00EB00C4 .text C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 00EB00E6 .text C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 00EB0047 .text C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 00EB0011 .text C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 00EB0F72 .text C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 00EB0FDB .text C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 00EB0022 .text C:\WINDOWS\system32\svchost.exe[1356] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00EB0F46 .text C:\WINDOWS\system32\svchost.exe[1356] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00DA0039 .text C:\WINDOWS\system32\svchost.exe[1356] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 00DA0076 .text C:\WINDOWS\system32\svchost.exe[1356] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00DA0FDE .text C:\WINDOWS\system32\svchost.exe[1356] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00DA000A .text C:\WINDOWS\system32\svchost.exe[1356] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00DA0065 .text C:\WINDOWS\system32\svchost.exe[1356] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00DA004A .text C:\WINDOWS\system32\svchost.exe[1356] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00DA0FEF .text C:\WINDOWS\system32\svchost.exe[1356] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00DA0FCD .text C:\WINDOWS\system32\svchost.exe[1356] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00D90F8B .text C:\WINDOWS\system32\svchost.exe[1356] msvcrt.dll!system 77C293C7 5 Bytes JMP 00D90FA6 .text C:\WINDOWS\system32\svchost.exe[1356] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00D90FD2 .text C:\WINDOWS\system32\svchost.exe[1356] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00D90FEF .text C:\WINDOWS\system32\svchost.exe[1356] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00D90FB7 .text C:\WINDOWS\system32\svchost.exe[1356] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00D9000C .text C:\WINDOWS\system32\svchost.exe[1356] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 00DB0000 .text C:\WINDOWS\system32\svchost.exe[1356] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 00DB0FEF .text C:\WINDOWS\system32\svchost.exe[1356] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 00DB002F .text C:\WINDOWS\system32\svchost.exe[1356] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 00DB0FDE .text C:\WINDOWS\system32\svchost.exe[1356] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00D80000 .text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1408] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0071000A .text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1408] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0072000A .text C:\Program Files\Bonjour\mDNSResponder.exe[1476] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0075000A .text C:\Program Files\Bonjour\mDNSResponder.exe[1476] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0076000A .text C:\WINDOWS\eHome\ehSched.exe[1516] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 005F000A .text C:\WINDOWS\eHome\ehSched.exe[1516] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0060000A .text C:\WINDOWS\system32\spoolsv.exe[1564] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A7000A .text C:\WINDOWS\system32\spoolsv.exe[1564] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00A8000A .text C:\WINDOWS\eHome\ehRecvr.exe[1684] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0061000A .text C:\WINDOWS\eHome\ehRecvr.exe[1684] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0062000A .text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1808] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0088000A .text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1808] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0089000A .text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1808] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 0041C130 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.) .text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[1808] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 0041C1B0 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.) .text C:\WINDOWS\Explorer.EXE[1820] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00D0000A .text C:\WINDOWS\Explorer.EXE[1820] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00D1000A .text C:\WINDOWS\Explorer.EXE[1820] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 01BF0000 .text C:\WINDOWS\Explorer.EXE[1820] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 01BF005B .text C:\WINDOWS\Explorer.EXE[1820] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 01BF0F66 .text C:\WINDOWS\Explorer.EXE[1820] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 01BF004A .text C:\WINDOWS\Explorer.EXE[1820] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 01BF0039 .text C:\WINDOWS\Explorer.EXE[1820] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 01BF0FA8 .text C:\WINDOWS\Explorer.EXE[1820] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 01BF0F26 .text C:\WINDOWS\Explorer.EXE[1820] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 01BF0078 .text C:\WINDOWS\Explorer.EXE[1820] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 01BF00AE .text C:\WINDOWS\Explorer.EXE[1820] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 01BF0F15 .text C:\WINDOWS\Explorer.EXE[1820] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 01BF00C9 .text C:\WINDOWS\Explorer.EXE[1820] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 01BF0F97 .text C:\WINDOWS\Explorer.EXE[1820] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 01BF0FE5 .text C:\WINDOWS\Explorer.EXE[1820] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 01BF0F4B .text C:\WINDOWS\Explorer.EXE[1820] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 01BF0FB9 .text C:\WINDOWS\Explorer.EXE[1820] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 01BF0FCA .text C:\WINDOWS\Explorer.EXE[1820] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 01BF0093 .text C:\WINDOWS\Explorer.EXE[1820] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 019A001B .text C:\WINDOWS\Explorer.EXE[1820] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 019A0F72 .text C:\WINDOWS\Explorer.EXE[1820] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 019A0FD4 .text C:\WINDOWS\Explorer.EXE[1820] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 019A000A .text C:\WINDOWS\Explorer.EXE[1820] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 019A0F83 .text C:\WINDOWS\Explorer.EXE[1820] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 019A0F9E .text C:\WINDOWS\Explorer.EXE[1820] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 019A0FE5 .text C:\WINDOWS\Explorer.EXE[1820] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 019A0FAF .text C:\WINDOWS\Explorer.EXE[1820] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 01930F90 .text C:\WINDOWS\Explorer.EXE[1820] msvcrt.dll!system 77C293C7 5 Bytes JMP 01930FAB .text C:\WINDOWS\Explorer.EXE[1820] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 01930FD7 .text C:\WINDOWS\Explorer.EXE[1820] msvcrt.dll!_open 77C2F566 5 Bytes JMP 01930000 .text C:\WINDOWS\Explorer.EXE[1820] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 01930FC6 .text C:\WINDOWS\Explorer.EXE[1820] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 01930011 .text C:\WINDOWS\Explorer.EXE[1820] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 01BD0FEF .text C:\WINDOWS\Explorer.EXE[1820] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 01BD0FDE .text C:\WINDOWS\Explorer.EXE[1820] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 01BD0FCD .text C:\WINDOWS\Explorer.EXE[1820] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 01BD001E .text C:\WINDOWS\Explorer.EXE[1820] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 01910FEF .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00B5000A .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00B6000A .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 03500000 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 03500F68 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 03500F83 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 03500F94 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 03500FA5 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 03500036 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 035000A6 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 03500095 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 035000D2 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 03500F39 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 035000E3 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 03500047 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 03500FE5 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 03500078 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 03500FD4 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 03500025 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 035000B7 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 034E002F .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 034E0F97 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 034E0014 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 034E0FDE .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 034E0FA8 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 034E004A .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 034E0FEF .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 034E0FC3 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] USER32.dll!DialogBoxParamW 7E42555F 5 Bytes JMP 42F0F341 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] USER32.dll!DialogBoxIndirectParamW 7E432032 5 Bytes JMP 430A187F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] USER32.dll!MessageBoxIndirectA 7E43A04A 5 Bytes JMP 430A1800 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] USER32.dll!DialogBoxParamA 7E43B10C 5 Bytes JMP 430A1844 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] USER32.dll!MessageBoxExW 7E4505D8 5 Bytes JMP 430A178C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] USER32.dll!MessageBoxExA 7E4505FC 5 Bytes JMP 430A17C6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] USER32.dll!DialogBoxIndirectParamA 7E456B50 5 Bytes JMP 430A18BA C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] USER32.dll!MessageBoxIndirectW 7E4662AB 5 Bytes JMP 42F316F6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 034D0FA6 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] msvcrt.dll!system 77C293C7 5 Bytes JMP 034D0027 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 034D0016 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] msvcrt.dll!_open 77C2F566 5 Bytes JMP 034D0FEF .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 034D0FB7 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 034D0FDE .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 00FCFA00 \\?\globalroot\systemroot\system32\UACwejxtevd.dll .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 034C0000 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] WS2_32.dll!connect 71AB406A 5 Bytes JMP 00FD0750 \\?\globalroot\systemroot\system32\UACwejxtevd.dll .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] WS2_32.dll!send 71AB428A 5 Bytes JMP 00FD0630 \\?\globalroot\systemroot\system32\UACwejxtevd.dll .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] WS2_32.dll!gethostbyname 71AB4FD4 5 Bytes JMP 00FCFDB0 \\?\globalroot\systemroot\system32\UACwejxtevd.dll .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] WS2_32.dll!recv 71AB615A 5 Bytes JMP 00FCFFE0 \\?\globalroot\systemroot\system32\UACwejxtevd.dll .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] WS2_32.dll!closesocket 71AB9639 5 Bytes JMP 00FD0910 \\?\globalroot\systemroot\system32\UACwejxtevd.dll .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] WININET.dll!HttpAddRequestHeadersA 7805FB35 5 Bytes JMP 00F3000A .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 034F000A .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 034F001B .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 034F0FDB .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 034F0FC0 .text C:\Program Files\Internet Explorer\Iexplore.exe[1836] WININET.dll!HttpAddRequestHeadersW 780CCF65 5 Bytes JMP 00FB000A .text C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[1892] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0071000A .text C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe[1892] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0072000A .text C:\WINDOWS\system32\ctfmon.exe[1948] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0098000A .text C:\WINDOWS\system32\ctfmon.exe[1948] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0099000A .text C:\WINDOWS\System32\alg.exe[2004] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0076000A .text C:\WINDOWS\System32\alg.exe[2004] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0077000A .text C:\Program Files\McAfee\MPF\MPFSrv.exe[2072] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 008D000A .text C:\Program Files\McAfee\MPF\MPFSrv.exe[2072] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 008E000A .text C:\Program Files\Netscape Internet Service\ncupdatesvc.exe[2104] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009B000A .text C:\Program Files\Netscape Internet Service\ncupdatesvc.exe[2104] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 009C000A .text C:\WINDOWS\system32\nvsvc32.exe[2196] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 007C000A .text C:\WINDOWS\system32\nvsvc32.exe[2196] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 007D000A .text C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS[2228] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A6000A .text C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS[2228] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00A7000A .text C:\WINDOWS\system32\svchost.exe[2400] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 010E0FEF .text C:\WINDOWS\system32\svchost.exe[2400] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 010E006F .text C:\WINDOWS\system32\svchost.exe[2400] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 010E0054 .text C:\WINDOWS\system32\svchost.exe[2400] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 010E0F86 .text C:\WINDOWS\system32\svchost.exe[2400] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 010E0FA1 .text C:\WINDOWS\system32\svchost.exe[2400] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 010E0039 .text C:\WINDOWS\system32\svchost.exe[2400] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 010E0F38 .text C:\WINDOWS\system32\svchost.exe[2400] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 010E0F49 .text C:\WINDOWS\system32\svchost.exe[2400] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 010E00AF .text C:\WINDOWS\system32\svchost.exe[2400] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 010E0F16 .text C:\WINDOWS\system32\svchost.exe[2400] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 010E00C0 .text C:\WINDOWS\system32\svchost.exe[2400] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 010E0FB2 .text C:\WINDOWS\system32\svchost.exe[2400] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 010E0FD4 .text C:\WINDOWS\system32\svchost.exe[2400] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 010E0080 .text C:\WINDOWS\system32\svchost.exe[2400] kernel32.dll!CreateNamedPipeW 7C82F0D4 3 Bytes JMP 010E0FC3 .text C:\WINDOWS\system32\svchost.exe[2400] kernel32.dll!CreateNamedPipeW + 4 7C82F0D8 1 Byte [84] .text C:\WINDOWS\system32\svchost.exe[2400] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 010E000A .text C:\WINDOWS\system32\svchost.exe[2400] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 010E0F27 .text C:\WINDOWS\system32\svchost.exe[2400] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00FF0047 .text C:\WINDOWS\system32\svchost.exe[2400] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 00FF0073 .text C:\WINDOWS\system32\svchost.exe[2400] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00FF002C .text C:\WINDOWS\system32\svchost.exe[2400] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00FF001B .text C:\WINDOWS\system32\svchost.exe[2400] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00FF0FC0 .text C:\WINDOWS\system32\svchost.exe[2400] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00FF0062 .text C:\WINDOWS\system32\svchost.exe[2400] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00FF000A .text C:\WINDOWS\system32\svchost.exe[2400] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00FF0FDB .text C:\WINDOWS\system32\svchost.exe[2400] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00FE0FD2 .text C:\WINDOWS\system32\svchost.exe[2400] msvcrt.dll!system 77C293C7 5 Bytes JMP 00FE0FE3 .text C:\WINDOWS\system32\svchost.exe[2400] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00FE002E .text C:\WINDOWS\system32\svchost.exe[2400] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00FE0000 .text C:\WINDOWS\system32\svchost.exe[2400] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00FE0053 .text C:\WINDOWS\system32\svchost.exe[2400] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00FE001D .text C:\WINDOWS\system32\svchost.exe[2400] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 010D0FEF .text C:\WINDOWS\system32\svchost.exe[2400] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 010D0FDE .text C:\WINDOWS\system32\svchost.exe[2400] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 010D0FC3 .text C:\WINDOWS\system32\svchost.exe[2400] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 010D0FA8 .text C:\WINDOWS\system32\svchost.exe[2400] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00FD0000 .text C:\WINDOWS\system32\svchost.exe[2444] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00F00FEF .text C:\WINDOWS\system32\svchost.exe[2444] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00F00F4B .text C:\WINDOWS\system32\svchost.exe[2444] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00F0004A .text C:\WINDOWS\system32\svchost.exe[2444] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00F00F70 .text C:\WINDOWS\system32\svchost.exe[2444] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00F00F8D .text C:\WINDOWS\system32\svchost.exe[2444] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00F00FB9 .text C:\WINDOWS\system32\svchost.exe[2444] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00F00076 .text C:\WINDOWS\system32\svchost.exe[2444] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00F0005B .text C:\WINDOWS\system32\svchost.exe[2444] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00F000A2 .text C:\WINDOWS\system32\svchost.exe[2444] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00F00091 .text C:\WINDOWS\system32\svchost.exe[2444] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 00F000BD .text C:\WINDOWS\system32\svchost.exe[2444] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 00F00FA8 .text C:\WINDOWS\system32\svchost.exe[2444] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 00F0000A .text C:\WINDOWS\system32\svchost.exe[2444] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 00F00F3A .text C:\WINDOWS\system32\svchost.exe[2444] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 00F00025 .text C:\WINDOWS\system32\svchost.exe[2444] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 00F00FD4 .text C:\WINDOWS\system32\svchost.exe[2444] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00F00F13 .text C:\WINDOWS\system32\svchost.exe[2444] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00EE0FCD .text C:\WINDOWS\system32\svchost.exe[2444] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 00EE0065 .text C:\WINDOWS\system32\svchost.exe[2444] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00EE0014 .text C:\WINDOWS\system32\svchost.exe[2444] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00EE0FDE .text C:\WINDOWS\system32\svchost.exe[2444] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00EE004A .text C:\WINDOWS\system32\svchost.exe[2444] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00EE0039 .text C:\WINDOWS\system32\svchost.exe[2444] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00EE0FEF .text C:\WINDOWS\system32\svchost.exe[2444] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00EE0FB2 .text C:\WINDOWS\system32\svchost.exe[2444] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 00ED0FAD .text C:\WINDOWS\system32\svchost.exe[2444] msvcrt.dll!system 77C293C7 5 Bytes JMP 00ED0FC8 .text C:\WINDOWS\system32\svchost.exe[2444] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00ED001D .text C:\WINDOWS\system32\svchost.exe[2444] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00ED000C .text C:\WINDOWS\system32\svchost.exe[2444] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00ED002E .text C:\WINDOWS\system32\svchost.exe[2444] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00ED0FEF .text C:\WINDOWS\system32\svchost.exe[2444] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 00EF0FEF .text C:\WINDOWS\system32\svchost.exe[2444] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 00EF0014 .text C:\WINDOWS\system32\svchost.exe[2444] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 00EF0025 .text C:\WINDOWS\system32\svchost.exe[2444] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 00EF0036 .text C:\WINDOWS\system32\svchost.exe[2444] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00EC0FEF .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2568] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0082000A .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2568] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0085000A .text C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe[2684] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 006C000A .text C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe[2684] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 006D000A .text C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe[2748] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 007D000A .text C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe[2748] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 007E000A .text C:\WINDOWS\ehome\mcrdsvc.exe[2828] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0064000A .text C:\WINDOWS\ehome\mcrdsvc.exe[2828] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0065000A .text C:\WINDOWS\system32\dllhost.exe[3240] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0072000A .text C:\WINDOWS\system32\dllhost.exe[3240] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0073000A .text C:\WINDOWS\system32\dllhost.exe[3240] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 001D0000 .text C:\WINDOWS\system32\dllhost.exe[3240] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001D007D .text C:\WINDOWS\system32\dllhost.exe[3240] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 001D0F88 .text C:\WINDOWS\system32\dllhost.exe[3240] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 001D0F99 .text C:\WINDOWS\system32\dllhost.exe[3240] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 001D0058 .text C:\WINDOWS\system32\dllhost.exe[3240] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 001D0FC0 .text C:\WINDOWS\system32\dllhost.exe[3240] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 001D0F35 .text C:\WINDOWS\system32\dllhost.exe[3240] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 001D0F52 .text C:\WINDOWS\system32\dllhost.exe[3240] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001D0098 .text C:\WINDOWS\system32\dllhost.exe[3240] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 001D0EFF .text C:\WINDOWS\system32\dllhost.exe[3240] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 001D0EE4 .text C:\WINDOWS\system32\dllhost.exe[3240] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 001D003D .text C:\WINDOWS\system32\dllhost.exe[3240] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 001D0FE5 .text C:\WINDOWS\system32\dllhost.exe[3240] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 001D0F63 .text C:\WINDOWS\system32\dllhost.exe[3240] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 001D002C .text C:\WINDOWS\system32\dllhost.exe[3240] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 001D001B .text C:\WINDOWS\system32\dllhost.exe[3240] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 001D0F10 .text C:\WINDOWS\system32\dllhost.exe[3240] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 002B0F9A .text C:\WINDOWS\system32\dllhost.exe[3240] msvcrt.dll!system 77C293C7 5 Bytes JMP 002B001B .text C:\WINDOWS\system32\dllhost.exe[3240] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 002B0000 .text C:\WINDOWS\system32\dllhost.exe[3240] msvcrt.dll!_open 77C2F566 5 Bytes JMP 002B0FEF .text C:\WINDOWS\system32\dllhost.exe[3240] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 002B0FAB .text C:\WINDOWS\system32\dllhost.exe[3240] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 002B0FC6 .text C:\WINDOWS\system32\dllhost.exe[3240] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 002C0025 .text C:\WINDOWS\system32\dllhost.exe[3240] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 002C0F8D .text C:\WINDOWS\system32\dllhost.exe[3240] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 002C000A .text C:\WINDOWS\system32\dllhost.exe[3240] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 002C0FD4 .text C:\WINDOWS\system32\dllhost.exe[3240] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 002C004A .text C:\WINDOWS\system32\dllhost.exe[3240] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 002C0FA8 .text C:\WINDOWS\system32\dllhost.exe[3240] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 002C0FE5 .text C:\WINDOWS\system32\dllhost.exe[3240] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 002C0FB9 .text C:\WINDOWS\system32\dllhost.exe[3240] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 008D0FEF .text C:\WINDOWS\system32\dllhost.exe[3240] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 008D0FD4 .text C:\WINDOWS\system32\dllhost.exe[3240] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 008D0FB9 .text C:\WINDOWS\system32\dllhost.exe[3240] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 008D000A .text C:\WINDOWS\system32\dllhost.exe[3240] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00B3000A .text C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe[3276] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0084000A .text C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe[3276] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0085000A .text C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 007B000A .text C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 007C000A .text C:\WINDOWS\system32\rsvp.exe[3488] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0061000A .text C:\WINDOWS\system32\rsvp.exe[3488] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0062000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[3524] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 006B000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[3524] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 006C000A .text C:\Program Files\iPod\bin\iPodService.exe[3904] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0073000A .text C:\Program Files\iPod\bin\iPodService.exe[3904] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0074000A .text C:\WINDOWS\system32\wuauclt.exe[4100] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009A000A .text C:\WINDOWS\system32\wuauclt.exe[4100] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 009B000A .text C:\WINDOWS\system32\wuauclt.exe[4100] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 001E0FEF .text C:\WINDOWS\system32\wuauclt.exe[4100] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001E0F43 .text C:\WINDOWS\system32\wuauclt.exe[4100] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 001E0042 .text C:\WINDOWS\system32\wuauclt.exe[4100] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 001E0F68 .text C:\WINDOWS\system32\wuauclt.exe[4100] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 001E001B .text C:\WINDOWS\system32\wuauclt.exe[4100] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 001E0F94 .text C:\WINDOWS\system32\wuauclt.exe[4100] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 001E006E .text C:\WINDOWS\system32\wuauclt.exe[4100] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 001E0F26 .text C:\WINDOWS\system32\wuauclt.exe[4100] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001E0EF0 .text C:\WINDOWS\system32\wuauclt.exe[4100] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 001E0F01 .text C:\WINDOWS\system32\wuauclt.exe[4100] kernel32.dll!GetProcAddress 7C80ADA0 1 Byte [E9] .text C:\WINDOWS\system32\wuauclt.exe[4100] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 001E00A4 .text C:\WINDOWS\system32\wuauclt.exe[4100] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 001E0F79 .text C:\WINDOWS\system32\wuauclt.exe[4100] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 001E0000 .text C:\WINDOWS\system32\wuauclt.exe[4100] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 001E0053 .text C:\WINDOWS\system32\wuauclt.exe[4100] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 001E0FB9 .text C:\WINDOWS\system32\wuauclt.exe[4100] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 001E0FCA .text C:\WINDOWS\system32\wuauclt.exe[4100] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 001E007F .text C:\WINDOWS\system32\wuauclt.exe[4100] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 002C0FA8 .text C:\WINDOWS\system32\wuauclt.exe[4100] msvcrt.dll!system 77C293C7 5 Bytes JMP 002C0FB9 .text C:\WINDOWS\system32\wuauclt.exe[4100] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 002C0022 .text C:\WINDOWS\system32\wuauclt.exe[4100] msvcrt.dll!_open 77C2F566 5 Bytes JMP 002C0000 .text C:\WINDOWS\system32\wuauclt.exe[4100] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 002C0033 .text C:\WINDOWS\system32\wuauclt.exe[4100] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 002C0011 .text C:\WINDOWS\system32\wuauclt.exe[4100] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 002D000A .text C:\WINDOWS\system32\wuauclt.exe[4100] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 002D004A .text C:\WINDOWS\system32\wuauclt.exe[4100] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 002D0FB9 .text C:\WINDOWS\system32\wuauclt.exe[4100] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 002D0FDE .text C:\WINDOWS\system32\wuauclt.exe[4100] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 002D0025 .text C:\WINDOWS\system32\wuauclt.exe[4100] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 002D0F8D .text C:\WINDOWS\system32\wuauclt.exe[4100] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 002D0FEF .text C:\WINDOWS\system32\wuauclt.exe[4100] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 002D0F9E .text C:\WINDOWS\system32\wuauclt.exe[4100] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 00B50FEF .text C:\WINDOWS\system32\wuauclt.exe[4100] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 00B5000A .text C:\WINDOWS\system32\wuauclt.exe[4100] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 00B50FCA .text C:\WINDOWS\system32\wuauclt.exe[4100] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 00B50025 .text C:\WINDOWS\system32\wuauclt.exe[4100] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00DB0FEF .text C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5212] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0088000A .text C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe[5212] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0089000A .text C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe[5340] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00DE000A .text C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe[5340] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00DF000A .text C:\Program Files\Internet Explorer\iexplore.exe[5704] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00B8000A .text C:\Program Files\Internet Explorer\iexplore.exe[5704] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00B9000A .text C:\Program Files\Internet Explorer\iexplore.exe[5704] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 0028000A .text C:\Program Files\Internet Explorer\iexplore.exe[5704] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00280098 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00280F99 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00280073 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00280FC0 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00280062 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 002800C4 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00280F72 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 002800FA .text C:\Program Files\Internet Explorer\iexplore.exe[5704] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00280F57 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] kernel32.dll!GetProcAddress 7C80ADA0 5 Bytes JMP 00280F46 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] kernel32.dll!LoadLibraryW 7C80AE4B 5 Bytes JMP 00280FD1 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] kernel32.dll!CreateFileW 7C810760 5 Bytes JMP 0028001B .text C:\Program Files\Internet Explorer\iexplore.exe[5704] kernel32.dll!CreatePipe 7C81E0C7 5 Bytes JMP 002800A9 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] kernel32.dll!CreateNamedPipeW 7C82F0D4 5 Bytes JMP 00280047 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] kernel32.dll!CreateNamedPipeA 7C85FC74 5 Bytes JMP 0028002C .text C:\Program Files\Internet Explorer\iexplore.exe[5704] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 002800DF .text C:\Program Files\Internet Explorer\iexplore.exe[5704] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00360051 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 003600A9 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00360040 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 0036001B .text C:\Program Files\Internet Explorer\iexplore.exe[5704] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 0036008E .text C:\Program Files\Internet Explorer\iexplore.exe[5704] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 0036007D .text C:\Program Files\Internet Explorer\iexplore.exe[5704] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 0036000A .text C:\Program Files\Internet Explorer\iexplore.exe[5704] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 0036006C .text C:\Program Files\Internet Explorer\iexplore.exe[5704] USER32.dll!DialogBoxParamW 7E42555F 5 Bytes JMP 42F0F341 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5704] USER32.dll!DialogBoxIndirectParamW 7E432032 5 Bytes JMP 430A187F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5704] USER32.dll!MessageBoxIndirectA 7E43A04A 5 Bytes JMP 430A1800 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5704] USER32.dll!DialogBoxParamA 7E43B10C 5 Bytes JMP 430A1844 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5704] USER32.dll!MessageBoxExW 7E4505D8 5 Bytes JMP 430A178C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5704] USER32.dll!MessageBoxExA 7E4505FC 5 Bytes JMP 430A17C6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5704] USER32.dll!DialogBoxIndirectParamA 7E456B50 5 Bytes JMP 430A18BA C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5704] USER32.dll!MessageBoxIndirectW 7E4662AB 5 Bytes JMP 42F316F6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[5704] msvcrt.dll!_wsystem 77C2931E 5 Bytes JMP 0037003D .text C:\Program Files\Internet Explorer\iexplore.exe[5704] msvcrt.dll!system 77C293C7 5 Bytes JMP 00370FB2 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] msvcrt.dll!_creat 77C2D40F 5 Bytes JMP 00370FDE .text C:\Program Files\Internet Explorer\iexplore.exe[5704] msvcrt.dll!_open 77C2F566 5 Bytes JMP 00370FEF .text C:\Program Files\Internet Explorer\iexplore.exe[5704] msvcrt.dll!_wcreat 77C2FC9B 5 Bytes JMP 00370FCD .text C:\Program Files\Internet Explorer\iexplore.exe[5704] msvcrt.dll!_wopen 77C30055 5 Bytes JMP 00370018 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 0100FA00 \\?\globalroot\systemroot\system32\UACwejxtevd.dll .text C:\Program Files\Internet Explorer\iexplore.exe[5704] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 003A0FEF .text C:\Program Files\Internet Explorer\iexplore.exe[5704] WS2_32.dll!connect 71AB406A 5 Bytes JMP 01010750 \\?\globalroot\systemroot\system32\UACwejxtevd.dll .text C:\Program Files\Internet Explorer\iexplore.exe[5704] WS2_32.dll!send 71AB428A 5 Bytes JMP 01010630 \\?\globalroot\systemroot\system32\UACwejxtevd.dll .text C:\Program Files\Internet Explorer\iexplore.exe[5704] WS2_32.dll!gethostbyname 71AB4FD4 5 Bytes JMP 0100FDB0 \\?\globalroot\systemroot\system32\UACwejxtevd.dll .text C:\Program Files\Internet Explorer\iexplore.exe[5704] WS2_32.dll!recv 71AB615A 5 Bytes JMP 0100FFE0 \\?\globalroot\systemroot\system32\UACwejxtevd.dll .text C:\Program Files\Internet Explorer\iexplore.exe[5704] WS2_32.dll!closesocket 71AB9639 5 Bytes JMP 01010910 \\?\globalroot\systemroot\system32\UACwejxtevd.dll .text C:\Program Files\Internet Explorer\iexplore.exe[5704] WININET.dll!HttpAddRequestHeadersA 7805FB35 5 Bytes JMP 00F7000A .text C:\Program Files\Internet Explorer\iexplore.exe[5704] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 00D30000 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 00D30FDB .text C:\Program Files\Internet Explorer\iexplore.exe[5704] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 00D30FC0 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 00D30011 .text C:\Program Files\Internet Explorer\iexplore.exe[5704] WININET.dll!HttpAddRequestHeadersW 780CCF65 5 Bytes JMP 00FF000A .text C:\Documents and Settings\Administrator\Desktop\gmer\fixme.exe[6792] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00AE000A .text C:\Documents and Settings\Administrator\Desktop\gmer\fixme.exe[6792] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00AF000A ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [63602B3E] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [63602A5B] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [63602441] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [63602AA2] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [63602B3E] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [63602A5B] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [63602441] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [63602AA2] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [63602A5B] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [63602AA2] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [63602441] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [63602B3E] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [63602AE9] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!AnimateWindow] [63601740] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TrackPopupMenuEx] [636015EF] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!DefWindowProcA] [6360208F] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetSysColor] [63601FC4] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!DefWindowProcW] [63602065] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TrackPopupMenu] [636015C8] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [63602AE9] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [63602B3E] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [63602AA2] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [63602A5B] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [63602441] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!DefWindowProcA] [6360208F] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!DefWindowProcW] [63602065] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!GetSysColor] [63601FC4] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TrackPopupMenu] [636015C8] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe[912] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TrackPopupMenuEx] [636015EF] C:\Program Files\Yahoo!\Shared\YbSkin2.dll (Yahoo! Skinning Object/Yahoo! Inc.) IAT C:\Program Files\Internet Explorer\Iexplore.exe[1836] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TrackPopupMenu] [6500DF80] C:\PROGRA~1\NETSCA~1\NETSCA~1\pbhelper.dll (Popup Block Helper Object DLL/planetscott.ca) IAT C:\Program Files\Internet Explorer\Iexplore.exe[1836] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!MessageBoxIndirectA] [6500B200] C:\PROGRA~1\NETSCA~1\NETSCA~1\pbhelper.dll (Popup Block Helper Object DLL/planetscott.ca) IAT C:\Program Files\Internet Explorer\Iexplore.exe[1836] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!MessageBoxIndirectW] [6500B270] C:\PROGRA~1\NETSCA~1\NETSCA~1\pbhelper.dll (Popup Block Helper Object DLL/planetscott.ca) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] [00352870] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA] [00352B00] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [00352BD0] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [00352B40] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [00352B00] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [00352870] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [00352B00] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [00352B40] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [00352870] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [00352B00] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [00352B40] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [00352870] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [00352870] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [00352B00] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\USER32.dll [GDI32.dll!CreateFontIndirectW] [00352920] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [00352BD0] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [00352B00] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [00352870] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [00352B40] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [00352BD0] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [00352B00] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [00352870] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [00352B40] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [00352870] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [00352B00] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [00352B00] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [00352870] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\ole32.dll [GDI32.dll!CreateFontIndirectW] [00352920] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [00352870] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [00352B00] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [00352B40] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [00352BD0] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [00352B80] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\SHLWAPI.dll [GDI32.dll!CreateFontA] [003528C0] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\SHLWAPI.dll [GDI32.dll!CreateFontW] [003528E0] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\SHLWAPI.dll [GDI32.dll!CreateFontIndirectA] [00352900] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\SHLWAPI.dll [GDI32.dll!CreateFontIndirectW] [00352920] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [00352B80] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [00352BD0] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [00352B40] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [00352B00] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [00352870] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!UpdateWindow] [00352FC0] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe[3464] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!InvalidateRect] [00352E10] C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\TRAPAPIS.dll (TrapAPIs Dynamic Link Library/Intel Corporation) IAT C:\Program Files\Internet Explorer\iexplore.exe[5704] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TrackPopupMenu] [6500DF80] C:\PROGRA~1\NETSCA~1\NETSCA~1\pbhelper.dll (Popup Block Helper Object DLL/planetscott.ca) IAT C:\Program Files\Internet Explorer\iexplore.exe[5704] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!MessageBoxIndirectA] [6500B200] C:\PROGRA~1\NETSCA~1\NETSCA~1\pbhelper.dll (Popup Block Helper Object DLL/planetscott.ca) IAT C:\Program Files\Internet Explorer\iexplore.exe[5704] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!MessageBoxIndirectW] [6500B270] C:\PROGRA~1\NETSCA~1\NETSCA~1\pbhelper.dll (Popup Block Helper Object DLL/planetscott.ca) ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) ---- Modules - GMER 1.0.15 ---- Module \systemroot\system32\drivers\UACdpuxoejs.sys (*** hidden *** ) F3344000-F3357000 (77824 bytes) ---- Processes - GMER 1.0.15 ---- Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [152] 0x00E70000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe [168] 0x00BA0000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\QuickTime\QTTask.exe [228] 0x00EB0000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\iTunes\iTunesHelper.exe [240] 0x00D60000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\McAfee.com\Agent\mcagent.exe [260] 0x00DF0000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [284] 0x00E30000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\Messenger\msmsgs.exe [316] 0x00C90000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe [372] 0x00D70000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\system32\rundll32.exe [468] 0x00C90000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\FinePixViewerS\QuickDCF2.exe [492] 0x00EC0000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\system32\winlogon.exe [712] 0x008B0000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\system32\services.exe [760] 0x00970000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\system32\lsass.exe [772] 0x00A60000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe [912] 0x00E60000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1024] 0x00B00000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [1140] 0x00B00000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1208] 0x00B00000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\Intel\IntelDH\CCU\AlertService.exe [1284] 0x00E70000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe [1340] 0x00F30000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1356] 0x00B00000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [1408] 0x00B00000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\Bonjour\mDNSResponder.exe [1476] 0x00B40000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\eHome\ehSched.exe [1516] 0x00920000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\system32\spoolsv.exe [1564] 0x00D90000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\eHome\ehRecvr.exe [1684] 0x00940000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [1808] 0x00B60000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\Explorer.EXE [1820] 0x00E00000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\Iexplore.exe [1836] 0x00FC0000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [1892] 0x00B00000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\system32\ctfmon.exe [1948] 0x00CA0000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\System32\alg.exe [2004] 0x00A80000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\McAfee\MPF\MPFSrv.exe [2072] 0x00BC0000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\Netscape Internet Service\ncupdatesvc.exe [2104] 0x00DA0000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\system32\nvsvc32.exe [2196] 0x00BB0000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS [2228] 0x00E50000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [2400] 0x00B00000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [2444] 0x00B00000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\system32\wbem\wmiprvse.exe [2568] 0x00B60000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe [2684] 0x00AB0000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe [2748] 0x00BC0000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\ehome\mcrdsvc.exe [2828] 0x00970000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\system32\dllhost.exe [3240] 0x00A50000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe [3276] 0x00C30000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe [3464] 0x00BA0000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\system32\rsvp.exe [3488] 0x00940000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\Canon\CAL\CALMAIN.exe [3524] 0x00AA0000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\iPod\bin\iPodService.exe [3904] 0x00B20000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\WINDOWS\system32\wuauclt.exe [4100] 0x00CD0000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe [5212] 0x00B60000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe [5340] 0x00EA0000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\iexplore.exe [5704] 0x01000000 Library \\?\globalroot\systemroot\system32\UACwejxtevd.dll (*** hidden *** ) @ C:\Documents and Settings\Administrator\Desktop\gmer\fixme.exe [6792] 0x00ED0000 ---- Services - GMER 1.0.15 ---- Service C:\WINDOWS\system32\drivers\UACdpuxoejs.sys (*** hidden *** ) [SYSTEM] UACd.sys <-- ROOTKIT !!! ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@start 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@type 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACdpuxoejs.sys Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@group file system Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACd \\?\globalroot\systemroot\system32\drivers\UACdpuxoejs.sys Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACc \\?\globalroot\systemroot\system32\UACarcunkvq.dll Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacsr \\?\globalroot\systemroot\system32\UAClcliqwuu.dat Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uaclog \\?\globalroot\systemroot\system32\UACvhopeqyl.dll Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacmask \\?\globalroot\systemroot\system32\UACnqlahnwj.dll Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacserf \\?\globalroot\systemroot\system32\UACdoktwnyv.dll Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacbbr \\?\globalroot\systemroot\system32\UACwejxtevd.dll Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACproc \\?\globalroot\systemroot\system32\UACylqppyll.log Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacurls \\?\globalroot\systemroot\system32\UACtpixhvmt.log Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacerrors \\?\globalroot\systemroot\system32\UACkhegtufe.log Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@start 1 Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@type 1 Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACdpuxoejs.sys Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@group file system Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACd \\?\globalroot\systemroot\system32\drivers\UACdpuxoejs.sys Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACc \\?\globalroot\systemroot\system32\UACarcunkvq.dll Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacsr \\?\globalroot\systemroot\system32\UAClcliqwuu.dat Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uaclog \\?\globalroot\systemroot\system32\UACvhopeqyl.dll Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacmask \\?\globalroot\systemroot\system32\UACnqlahnwj.dll Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacserf \\?\globalroot\systemroot\system32\UACdoktwnyv.dll Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacbbr \\?\globalroot\systemroot\system32\UACwejxtevd.dll Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACproc \\?\globalroot\systemroot\system32\UACylqppyll.log Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacurls \\?\globalroot\systemroot\system32\UACtpixhvmt.log Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacerrors \\?\globalroot\systemroot\system32\UACkhegtufe.log ---- EOF - GMER 1.0.15 ----