GMER 1.0.15.15507 - http://www.gmer.net Rootkit scan 2010-11-07 13:16:08 Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\00000064 NVIDIA__ Running: pp6pj6us.exe; Driver: C:\DOCUME~1\Mark\LOCALS~1\Temp\uwtdypod.sys ---- System - GMER 1.0.15 ---- SSDT A75D944E ZwCreateKey SSDT A75D9444 ZwCreateThread SSDT A75D9453 ZwDeleteKey SSDT A75D945D ZwDeleteValueKey SSDT A75D9462 ZwLoadKey SSDT A75D9430 ZwOpenProcess SSDT A75D9435 ZwOpenThread SSDT A75D946C ZwReplaceKey SSDT A75D9467 ZwRestoreKey SSDT A75D9458 ZwSetValueKey ---- Kernel code sections - GMER 1.0.15 ---- .text ntkrnlpa.exe!ZwCallbackReturn + 2CA4 80504540 2 Bytes [44, 94] {INC ESP; XCHG ESP, EAX} .text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB80D7380, 0x344E37, 0xE8000020] .text C:\WINDOWS\system32\drivers\ACEDRV08.sys section is writeable [0xA6119000, 0x328BA, 0xE8000020] .pklstb C:\WINDOWS\system32\drivers\ACEDRV08.sys entry point in ".pklstb" section [0xA615D000] .relo2 C:\WINDOWS\system32\drivers\ACEDRV08.sys unknown last section [0xA6179000, 0x8E, 0x42000040] ---- User code sections - GMER 1.0.15 ---- .text C:\WINDOWS\Explorer.EXE[168] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\Explorer.EXE[168] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\Explorer.EXE[168] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\Explorer.EXE[168] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\Explorer.EXE[168] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\Explorer.EXE[168] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Xobni\XobniService.exe[320] KERNEL32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Xobni\XobniService.exe[320] KERNEL32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Xobni\XobniService.exe[320] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Xobni\XobniService.exe[320] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Xobni\XobniService.exe[320] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Xobni\XobniService.exe[320] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Avira\AntiVir Desktop\avshadow.exe[580] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Avira\AntiVir Desktop\avshadow.exe[580] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Avira\AntiVir Desktop\avshadow.exe[580] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Avira\AntiVir Desktop\avshadow.exe[580] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Avira\AntiVir Desktop\avshadow.exe[580] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Avira\AntiVir Desktop\avshadow.exe[580] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchProtocolHost.exe[804] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchProtocolHost.exe[804] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchProtocolHost.exe[804] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchProtocolHost.exe[804] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchProtocolHost.exe[804] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchProtocolHost.exe[804] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\winlogon.exe[824] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\winlogon.exe[824] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\winlogon.exe[824] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\winlogon.exe[824] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\winlogon.exe[824] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\winlogon.exe[824] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\services.exe[872] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\services.exe[872] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\services.exe[872] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\services.exe[872] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\services.exe[872] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\services.exe[872] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\lsass.exe[884] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\lsass.exe[884] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\lsass.exe[884] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\lsass.exe[884] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1096] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1096] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1096] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1096] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1096] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1096] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1144] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1144] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1144] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1144] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1144] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe[1224] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe[1224] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe[1224] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe[1224] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe[1224] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe[1224] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\System32\svchost.exe[1240] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\System32\AirfoilInject3.dll .text C:\WINDOWS\System32\svchost.exe[1240] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\System32\AirfoilInject3.dll .text C:\WINDOWS\System32\svchost.exe[1240] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\System32\AirfoilInject3.dll .text C:\WINDOWS\System32\svchost.exe[1240] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\System32\AirfoilInject3.dll .text C:\WINDOWS\System32\svchost.exe[1240] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\System32\AirfoilInject3.dll .text C:\WINDOWS\System32\svchost.exe[1240] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\System32\AirfoilInject3.dll .text C:\Documents and Settings\Mark\My Documents\Downloads\pp6pj6us.exe[1316] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Documents and Settings\Mark\My Documents\Downloads\pp6pj6us.exe[1316] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Documents and Settings\Mark\My Documents\Downloads\pp6pj6us.exe[1316] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Documents and Settings\Mark\My Documents\Downloads\pp6pj6us.exe[1316] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Documents and Settings\Mark\My Documents\Downloads\pp6pj6us.exe[1316] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Documents and Settings\Mark\My Documents\Downloads\pp6pj6us.exe[1316] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1364] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1364] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1364] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1364] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1364] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1364] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchProtocolHost.exe[1420] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchProtocolHost.exe[1420] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchProtocolHost.exe[1420] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchProtocolHost.exe[1420] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchProtocolHost.exe[1420] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchProtocolHost.exe[1420] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1436] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1436] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1436] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1436] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE[1540] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE[1540] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE[1540] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE[1540] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE[1540] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE[1540] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\spoolsv.exe[1592] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\spoolsv.exe[1592] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\spoolsv.exe[1592] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\spoolsv.exe[1592] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\spoolsv.exe[1592] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\spoolsv.exe[1592] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\iPod\bin\iPodService.exe[1652] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\iPod\bin\iPodService.exe[1652] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\iPod\bin\iPodService.exe[1652] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\iPod\bin\iPodService.exe[1652] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\iPod\bin\iPodService.exe[1652] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\iPod\bin\iPodService.exe[1652] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1668] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1668] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1668] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1668] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1668] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1668] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1740] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1740] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1740] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1740] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1740] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1740] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchIndexer.exe[1776] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchIndexer.exe[1776] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchIndexer.exe[1776] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation) .text C:\WINDOWS\system32\SearchIndexer.exe[1776] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchIndexer.exe[1776] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchIndexer.exe[1776] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchIndexer.exe[1776] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1824] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1824] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1824] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1824] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1824] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1824] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Bonjour\mDNSResponder.exe[1836] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Bonjour\mDNSResponder.exe[1836] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Bonjour\mDNSResponder.exe[1836] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Bonjour\mDNSResponder.exe[1836] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Bonjour\mDNSResponder.exe[1836] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Bonjour\mDNSResponder.exe[1836] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE[1860] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE[1860] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE[1860] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE[1860] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE[1860] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE[1860] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[1900] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[1900] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[1900] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[1900] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[1900] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Java\jre6\bin\jqs.exe[1900] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1984] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1984] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1984] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1984] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1984] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\svchost.exe[1984] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\iTunes\iTunesHelper.exe[2032] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\iTunes\iTunesHelper.exe[2032] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\iTunes\iTunesHelper.exe[2032] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\iTunes\iTunesHelper.exe[2032] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\iTunes\iTunesHelper.exe[2032] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\iTunes\iTunesHelper.exe[2032] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\System32\alg.exe[2496] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\System32\alg.exe[2496] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\System32\alg.exe[2496] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\System32\alg.exe[2496] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\System32\alg.exe[2496] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\System32\alg.exe[2496] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2528] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2528] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2528] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2528] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2528] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2528] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe[2544] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe[2544] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe[2544] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe[2544] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe[2544] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe[2544] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[2668] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation) .text C:\Program Files\Mozilla Firefox\firefox.exe[2668] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[2668] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[2668] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[2668] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[2668] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[2668] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\ctfmon.exe[2764] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\ctfmon.exe[2764] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\ctfmon.exe[2764] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\ctfmon.exe[2764] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\ctfmon.exe[2764] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\ctfmon.exe[2764] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\AirVideoServer\AirVideoServer.exe[2804] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\AirVideoServer\AirVideoServer.exe[2804] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\AirVideoServer\AirVideoServer.exe[2804] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\AirVideoServer\AirVideoServer.exe[2804] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\AirVideoServer\AirVideoServer.exe[2804] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\Program Files\AirVideoServer\AirVideoServer.exe[2804] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchFilterHost.exe[3580] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 100024D0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchFilterHost.exe[3580] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 10002380 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchFilterHost.exe[3580] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 10005AC0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchFilterHost.exe[3580] USER32.dll!CreateWindowExA 7E42E4A9 5 Bytes JMP 10005AA0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchFilterHost.exe[3580] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 100026C0 C:\WINDOWS\system32\AirfoilInject3.dll .text C:\WINDOWS\system32\SearchFilterHost.exe[3580] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 10002630 C:\WINDOWS\system32\AirfoilInject3.dll ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) ---- EOF - GMER 1.0.15 ----