GMER 1.0.15.15570 - http://www.gmer.net
Rootkit scan 2011-04-09 10:17:08
Windows 5.1.2600 Service Pack 3 
Running: gmer.exe; Driver: C:\DOCUME~1\David\LOCALS~1\Temp\pxtdapow.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwAddBootEntry [0xA90D29CA]
SSDT            891FF050                                                                                                                                                  ZwAlertResumeThread
SSDT            89200050                                                                                                                                                  ZwAlertThread
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                                                                     ZwAllocateVirtualMemory [0xA9127A68]
SSDT            8981A050                                                                                                                                                  ZwAssignProcessToJobObject
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwClose [0xA90F2AF5]
SSDT            89D08810                                                                                                                                                  ZwConnectPort
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwCreateEvent [0xA90D4EAC]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwCreateEventPair [0xA90D4F04]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwCreateIoCompletion [0xA90D501A]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwCreateKey [0xA90F24A9]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwCreateMutant [0xA90D4E02]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwCreateSection [0xA90D4F54]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwCreateSemaphore [0xA90D4E56]
SSDT            89063510                                                                                                                                                  ZwCreateSymbolicLinkObject
SSDT            89170EF0                                                                                                                                                  ZwCreateThread
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwCreateTimer [0xA90D4FC8]
SSDT            89811050                                                                                                                                                  ZwDebugActiveProcess
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwDeleteBootEntry [0xA90D29EE]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwDeleteKey [0xA90F31BB]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwDeleteValueKey [0xA90F3471]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwDuplicateObject [0xA90D529E]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwEnumerateKey [0xA90F3026]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwEnumerateValueKey [0xA90F2E91]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                                                                     ZwFreeVirtualMemory [0xA9127B18]
SSDT            891FD050                                                                                                                                                  ZwImpersonateAnonymousToken
SSDT            891FE050                                                                                                                                                  ZwImpersonateThread
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwLoadDriver [0xA90D27B8]
SSDT            89063008                                                                                                                                                  ZwMapViewOfSection
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwModifyBootEntry [0xA90D2A12]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwNotifyChangeKey [0xA90D5412]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwNotifyChangeMultipleKeys [0xA90D34AA]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwOpenEvent [0xA90D4EDC]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwOpenEventPair [0xA90D4F2C]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwOpenIoCompletion [0xA90D5044]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwOpenKey [0xA90F2805]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwOpenMutant [0xA90D4E2E]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwOpenProcess [0xA90D50D6]
SSDT            897FC650                                                                                                                                                  ZwOpenProcessToken
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwOpenSection [0xA90D4F94]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwOpenSemaphore [0xA90D4E84]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwOpenThread [0xA90D51BA]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwOpenTimer [0xA90D4FF2]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                                                                     ZwProtectVirtualMemory [0xA9127BB0]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwQueryKey [0xA90F2D0C]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwQueryObject [0xA90D3370]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwQueryValueKey [0xA90F2B5E]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                                                                     ZwRenameKey [0xA912FE26]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwRestoreKey [0xA90F1B1C]
SSDT            89808890                                                                                                                                                  ZwResumeThread
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwSetBootEntryOrder [0xA90D2A36]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwSetBootOptions [0xA90D2A5A]
SSDT            89703050                                                                                                                                                  ZwSetContextThread
SSDT            89063EB0                                                                                                                                                  ZwSetInformationProcess
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwSetSystemInformation [0xA90D2812]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwSetSystemPowerState [0xA90D294E]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwSetValueKey [0xA90F32C2]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwShutdownSystem [0xA90D292A]
SSDT            89814050                                                                                                                                                  ZwSuspendProcess
SSDT            8919E050                                                                                                                                                  ZwSuspendThread
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwSystemDebugControl [0xA90D2972]
SSDT            897DB650                                                                                                                                                  ZwTerminateProcess
SSDT            8981B050                                                                                                                                                  ZwTerminateThread
SSDT            89815650                                                                                                                                                  ZwUnmapViewOfSection
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                                                                     ZwVdmControl [0xA90D2A7E]
SSDT            8905E350                                                                                                                                                  ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!ZwCallbackReturn + 2CAC                                                                                                                      80504548 20 Bytes  [54, 4F, 0D, A9, 56, 4E, 0D, ...]
.text           ntkrnlpa.exe!ZwCallbackReturn + 2F30                                                                                                                      805047CC 12 Bytes  [36, 2A, 0D, A9, 5A, 2A, 0D, ...] {SUB CL, SS:[0xd2a5aa9]; TEST EAX, 0x89703050}
.text           ntkrnlpa.exe!ZwCallbackReturn + 2FD8                                                                                                                      80504874 12 Bytes  [50, 40, 81, 89, 50, E0, 19, ...] {PUSH EAX; INC EAX; OR DWORD [ECX-0x76e61fb0], 0xa90d2972}
PAGE            ntkrnlpa.exe!ZwReplyWaitReceivePortEx + 5EC                                                                                                               805A64A8 4 Bytes  CALL A90D3E25 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
?               SYMEFA.SYS                                                                                                                                                The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text           C:\WINDOWS\system32\spoolsv.exe[272] ntdll.dll!LdrLoadDll                                                                                                 7C91632D 5 Bytes  JMP 00090030 
.text           C:\WINDOWS\system32\spoolsv.exe[272] ntdll.dll!LdrUnloadDll                                                                                               7C9171CD 5 Bytes  JMP 0009006C 
.text           C:\WINDOWS\system32\spoolsv.exe[272] ADVAPI32.dll!SetServiceObjectSecurity                                                                                77E36D81 5 Bytes  JMP 002B01D4 
.text           C:\WINDOWS\system32\spoolsv.exe[272] ADVAPI32.dll!ChangeServiceConfigA                                                                                    77E36E69 5 Bytes  JMP 002B00E4 
.text           C:\WINDOWS\system32\spoolsv.exe[272] ADVAPI32.dll!ChangeServiceConfigW                                                                                    77E37001 5 Bytes  JMP 002B0120 
.text           C:\WINDOWS\system32\spoolsv.exe[272] ADVAPI32.dll!ChangeServiceConfig2A                                                                                   77E37101 5 Bytes  JMP 002B015C 
.text           C:\WINDOWS\system32\spoolsv.exe[272] ADVAPI32.dll!ChangeServiceConfig2W                                                                                   77E37189 5 Bytes  JMP 002B0198 
.text           C:\WINDOWS\system32\spoolsv.exe[272] ADVAPI32.dll!CreateServiceA                                                                                          77E37211 5 Bytes  JMP 002B0030 
.text           C:\WINDOWS\system32\spoolsv.exe[272] ADVAPI32.dll!CreateServiceW                                                                                          77E373A9 5 Bytes  JMP 002B006C 
.text           C:\WINDOWS\system32\spoolsv.exe[272] ADVAPI32.dll!DeleteService                                                                                           77E374B1 5 Bytes  JMP 002B00A8 
.text           C:\WINDOWS\system32\spoolsv.exe[272] USER32.dll!SetWindowsHookExW                                                                                         7E42820F 5 Bytes  JMP 002C00E4 
.text           C:\WINDOWS\system32\spoolsv.exe[272] USER32.dll!UnhookWindowsHookEx                                                                                       7E42D5F3 5 Bytes  JMP 002C0120 
.text           C:\WINDOWS\system32\spoolsv.exe[272] USER32.dll!SetWindowsHookExA                                                                                         7E431211 5 Bytes  JMP 002C00A8 
.text           C:\WINDOWS\system32\spoolsv.exe[272] USER32.dll!SetWinEventHook                                                                                           7E4317F7 5 Bytes  JMP 002C0030 
.text           C:\WINDOWS\system32\spoolsv.exe[272] USER32.dll!UnhookWinEvent                                                                                            7E4318AC 5 Bytes  JMP 002C006C 
.text           C:\WINDOWS\system32\rundll32.exe[328] ntdll.dll!LdrLoadDll                                                                                                7C91632D 5 Bytes  JMP 00090030 
.text           C:\WINDOWS\system32\rundll32.exe[328] ntdll.dll!LdrUnloadDll                                                                                              7C9171CD 5 Bytes  JMP 0009006C 
.text           C:\WINDOWS\system32\rundll32.exe[328] USER32.dll!SetWindowsHookExW                                                                                        7E42820F 5 Bytes  JMP 002B00E4 
.text           C:\WINDOWS\system32\rundll32.exe[328] USER32.dll!UnhookWindowsHookEx                                                                                      7E42D5F3 5 Bytes  JMP 002B0120 
.text           C:\WINDOWS\system32\rundll32.exe[328] USER32.dll!SetWindowsHookExA                                                                                        7E431211 5 Bytes  JMP 002B00A8 
.text           C:\WINDOWS\system32\rundll32.exe[328] USER32.dll!SetWinEventHook                                                                                          7E4317F7 5 Bytes  JMP 002B0030 
.text           C:\WINDOWS\system32\rundll32.exe[328] USER32.dll!UnhookWinEvent                                                                                           7E4318AC 5 Bytes  JMP 002B006C 
.text           C:\WINDOWS\system32\rundll32.exe[328] ADVAPI32.dll!SetServiceObjectSecurity                                                                               77E36D81 5 Bytes  JMP 002C01D4 
.text           C:\WINDOWS\system32\rundll32.exe[328] ADVAPI32.dll!ChangeServiceConfigA                                                                                   77E36E69 5 Bytes  JMP 002C00E4 
.text           C:\WINDOWS\system32\rundll32.exe[328] ADVAPI32.dll!ChangeServiceConfigW                                                                                   77E37001 5 Bytes  JMP 002C0120 
.text           C:\WINDOWS\system32\rundll32.exe[328] ADVAPI32.dll!ChangeServiceConfig2A                                                                                  77E37101 5 Bytes  JMP 002C015C 
.text           C:\WINDOWS\system32\rundll32.exe[328] ADVAPI32.dll!ChangeServiceConfig2W                                                                                  77E37189 5 Bytes  JMP 002C0198 
.text           C:\WINDOWS\system32\rundll32.exe[328] ADVAPI32.dll!CreateServiceA                                                                                         77E37211 5 Bytes  JMP 002C0030 
.text           C:\WINDOWS\system32\rundll32.exe[328] ADVAPI32.dll!CreateServiceW                                                                                         77E373A9 5 Bytes  JMP 002C006C 
.text           C:\WINDOWS\system32\rundll32.exe[328] ADVAPI32.dll!DeleteService                                                                                          77E374B1 5 Bytes  JMP 002C00A8 
.text           C:\WINDOWS\system32\svchost.exe[332] ntdll.dll!LdrLoadDll                                                                                                 7C91632D 5 Bytes  JMP 00090030 
.text           C:\WINDOWS\system32\svchost.exe[332] ntdll.dll!LdrUnloadDll                                                                                               7C9171CD 5 Bytes  JMP 0009006C 
.text           C:\WINDOWS\system32\svchost.exe[332] ADVAPI32.dll!SetServiceObjectSecurity                                                                                77E36D81 5 Bytes  JMP 002B01D4 
.text           C:\WINDOWS\system32\svchost.exe[332] ADVAPI32.dll!ChangeServiceConfigA                                                                                    77E36E69 5 Bytes  JMP 002B00E4 
.text           C:\WINDOWS\system32\svchost.exe[332] ADVAPI32.dll!ChangeServiceConfigW                                                                                    77E37001 5 Bytes  JMP 002B0120 
.text           C:\WINDOWS\system32\svchost.exe[332] ADVAPI32.dll!ChangeServiceConfig2A                                                                                   77E37101 5 Bytes  JMP 002B015C 
.text           C:\WINDOWS\system32\svchost.exe[332] ADVAPI32.dll!ChangeServiceConfig2W                                                                                   77E37189 5 Bytes  JMP 002B0198 
.text           C:\WINDOWS\system32\svchost.exe[332] ADVAPI32.dll!CreateServiceA                                                                                          77E37211 5 Bytes  JMP 002B0030 
.text           C:\WINDOWS\system32\svchost.exe[332] ADVAPI32.dll!CreateServiceW                                                                                          77E373A9 5 Bytes  JMP 002B006C 
.text           C:\WINDOWS\system32\svchost.exe[332] ADVAPI32.dll!DeleteService                                                                                           77E374B1 5 Bytes  JMP 002B00A8 
.text           C:\WINDOWS\system32\svchost.exe[332] USER32.dll!SetWindowsHookExW                                                                                         7E42820F 5 Bytes  JMP 002C00E4 
.text           C:\WINDOWS\system32\svchost.exe[332] USER32.dll!UnhookWindowsHookEx                                                                                       7E42D5F3 5 Bytes  JMP 002C0120 
.text           C:\WINDOWS\system32\svchost.exe[332] USER32.dll!SetWindowsHookExA                                                                                         7E431211 5 Bytes  JMP 002C00A8 
.text           C:\WINDOWS\system32\svchost.exe[332] USER32.dll!SetWinEventHook                                                                                           7E4317F7 5 Bytes  JMP 002C0030 
.text           C:\WINDOWS\system32\svchost.exe[332] USER32.dll!UnhookWinEvent                                                                                            7E4318AC 5 Bytes  JMP 002C006C 
.text           C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe[428] ntdll.dll!LdrLoadDll                                                                         7C91632D 5 Bytes  JMP 00150030 
.text           C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe[428] ntdll.dll!LdrUnloadDll                                                                       7C9171CD 5 Bytes  JMP 0015006C 
.text           C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe[428] USER32.dll!SetWindowsHookExW                                                                 7E42820F 5 Bytes  JMP 003800E4 
.text           C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe[428] USER32.dll!UnhookWindowsHookEx                                                               7E42D5F3 5 Bytes  JMP 00380120 
.text           C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe[428] USER32.dll!SetWindowsHookExA                                                                 7E431211 5 Bytes  JMP 003800A8 
.text           C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe[428] USER32.dll!SetWinEventHook                                                                   7E4317F7 5 Bytes  JMP 00380030 
.text           C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe[428] USER32.dll!UnhookWinEvent                                                                    7E4318AC 5 Bytes  JMP 0038006C 
.text           C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe[428] ADVAPI32.dll!SetServiceObjectSecurity                                                        77E36D81 5 Bytes  JMP 003901D4 
.text           C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe[428] ADVAPI32.dll!ChangeServiceConfigA                                                            77E36E69 5 Bytes  JMP 003900E4 
.text           C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe[428] ADVAPI32.dll!ChangeServiceConfigW                                                            77E37001 5 Bytes  JMP 00390120 
.text           C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe[428] ADVAPI32.dll!ChangeServiceConfig2A                                                           77E37101 5 Bytes  JMP 0039015C 
.text           C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe[428] ADVAPI32.dll!ChangeServiceConfig2W                                                           77E37189 5 Bytes  JMP 00390198 
.text           C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe[428] ADVAPI32.dll!CreateServiceA                                                                  77E37211 5 Bytes  JMP 00390030 
.text           C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe[428] ADVAPI32.dll!CreateServiceW                                                                  77E373A9 5 Bytes  JMP 0039006C 
.text           C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe[428] ADVAPI32.dll!DeleteService                                                                   77E374B1 5 Bytes  JMP 003900A8 
.text           C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[712] ntdll.dll!LdrLoadDll                                                                                  7C91632D 5 Bytes  JMP 00160030 
.text           C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[712] ntdll.dll!LdrUnloadDll                                                                                7C9171CD 5 Bytes  JMP 0016006C 
.text           C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[712] ADVAPI32.dll!SetServiceObjectSecurity                                                                 77E36D81 3 Bytes  JMP 003C01D4 
.text           C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[712] ADVAPI32.dll!SetServiceObjectSecurity + 4                                                             77E36D85 1 Byte  [88]
.text           C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[712] ADVAPI32.dll!ChangeServiceConfigA                                                                     77E36E69 5 Bytes  JMP 003C00E4 
.text           C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[712] ADVAPI32.dll!ChangeServiceConfigW                                                                     77E37001 5 Bytes  JMP 003C0120 
.text           C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[712] ADVAPI32.dll!ChangeServiceConfig2A                                                                    77E37101 5 Bytes  JMP 003C015C 
.text           C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[712] ADVAPI32.dll!ChangeServiceConfig2W                                                                    77E37189 5 Bytes  JMP 003C0198 
.text           C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[712] ADVAPI32.dll!CreateServiceA                                                                           77E37211 5 Bytes  JMP 003C0030 
.text           C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[712] ADVAPI32.dll!CreateServiceW                                                                           77E373A9 5 Bytes  JMP 003C006C 
.text           C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[712] ADVAPI32.dll!DeleteService                                                                            77E374B1 5 Bytes  JMP 003C00A8 
.text           C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[712] USER32.dll!SetWindowsHookExW                                                                          7E42820F 5 Bytes  JMP 003D00E4 
.text           C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[712] USER32.dll!UnhookWindowsHookEx                                                                        7E42D5F3 5 Bytes  JMP 003D0120 
.text           C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[712] USER32.dll!SetWindowsHookExA                                                                          7E431211 5 Bytes  JMP 003D00A8 
.text           C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[712] USER32.dll!SetWinEventHook                                                                            7E4317F7 5 Bytes  JMP 003D0030 
.text           C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[712] USER32.dll!UnhookWinEvent                                                                             7E4318AC 5 Bytes  JMP 003D006C 
.text           C:\WINDOWS\system32\svchost.exe[916] ntdll.dll!LdrLoadDll                                                                                                 7C91632D 5 Bytes  JMP 00090030 
.text           C:\WINDOWS\system32\svchost.exe[916] ntdll.dll!LdrUnloadDll                                                                                               7C9171CD 5 Bytes  JMP 0009006C 
.text           C:\WINDOWS\system32\svchost.exe[916] ADVAPI32.dll!SetServiceObjectSecurity                                                                                77E36D81 5 Bytes  JMP 002B01D4 
.text           C:\WINDOWS\system32\svchost.exe[916] ADVAPI32.dll!ChangeServiceConfigA                                                                                    77E36E69 5 Bytes  JMP 002B00E4 
.text           C:\WINDOWS\system32\svchost.exe[916] ADVAPI32.dll!ChangeServiceConfigW                                                                                    77E37001 5 Bytes  JMP 002B0120 
.text           C:\WINDOWS\system32\svchost.exe[916] ADVAPI32.dll!ChangeServiceConfig2A                                                                                   77E37101 5 Bytes  JMP 002B015C 
.text           C:\WINDOWS\system32\svchost.exe[916] ADVAPI32.dll!ChangeServiceConfig2W                                                                                   77E37189 5 Bytes  JMP 002B0198 
.text           C:\WINDOWS\system32\svchost.exe[916] ADVAPI32.dll!CreateServiceA                                                                                          77E37211 5 Bytes  JMP 002B0030 
.text           C:\WINDOWS\system32\svchost.exe[916] ADVAPI32.dll!CreateServiceW                                                                                          77E373A9 5 Bytes  JMP 002B006C 
.text           C:\WINDOWS\system32\svchost.exe[916] ADVAPI32.dll!DeleteService                                                                                           77E374B1 5 Bytes  JMP 002B00A8 
.text           C:\WINDOWS\system32\svchost.exe[916] USER32.dll!SetWindowsHookExW                                                                                         7E42820F 5 Bytes  JMP 002C00E4 
.text           C:\WINDOWS\system32\svchost.exe[916] USER32.dll!UnhookWindowsHookEx                                                                                       7E42D5F3 5 Bytes  JMP 002C0120 
.text           C:\WINDOWS\system32\svchost.exe[916] USER32.dll!SetWindowsHookExA                                                                                         7E431211 5 Bytes  JMP 002C00A8 
.text           C:\WINDOWS\system32\svchost.exe[916] USER32.dll!SetWinEventHook                                                                                           7E4317F7 5 Bytes  JMP 002C0030 
.text           C:\WINDOWS\system32\svchost.exe[916] USER32.dll!UnhookWinEvent                                                                                            7E4318AC 5 Bytes  JMP 002C006C 
.text           C:\WINDOWS\system32\winlogon.exe[960] ntdll.dll!LdrLoadDll                                                                                                7C91632D 5 Bytes  JMP 00070030 
.text           C:\WINDOWS\system32\winlogon.exe[960] ntdll.dll!LdrUnloadDll                                                                                              7C9171CD 5 Bytes  JMP 0007006C 
.text           C:\WINDOWS\system32\winlogon.exe[960] ADVAPI32.dll!SetServiceObjectSecurity                                                                               77E36D81 5 Bytes  JMP 002B01D4 
.text           C:\WINDOWS\system32\winlogon.exe[960] ADVAPI32.dll!ChangeServiceConfigA                                                                                   77E36E69 5 Bytes  JMP 002B00E4 
.text           C:\WINDOWS\system32\winlogon.exe[960] ADVAPI32.dll!ChangeServiceConfigW                                                                                   77E37001 5 Bytes  JMP 002B0120 
.text           C:\WINDOWS\system32\winlogon.exe[960] ADVAPI32.dll!ChangeServiceConfig2A                                                                                  77E37101 5 Bytes  JMP 002B015C 
.text           C:\WINDOWS\system32\winlogon.exe[960] ADVAPI32.dll!ChangeServiceConfig2W                                                                                  77E37189 5 Bytes  JMP 002B0198 
.text           C:\WINDOWS\system32\winlogon.exe[960] ADVAPI32.dll!CreateServiceA                                                                                         77E37211 5 Bytes  JMP 002B0030 
.text           C:\WINDOWS\system32\winlogon.exe[960] ADVAPI32.dll!CreateServiceW                                                                                         77E373A9 5 Bytes  JMP 002B006C 
.text           C:\WINDOWS\system32\winlogon.exe[960] ADVAPI32.dll!DeleteService                                                                                          77E374B1 5 Bytes  JMP 002B00A8 
.text           C:\WINDOWS\system32\winlogon.exe[960] USER32.dll!SetWindowsHookExW                                                                                        7E42820F 5 Bytes  JMP 002C00E4 
.text           C:\WINDOWS\system32\winlogon.exe[960] USER32.dll!UnhookWindowsHookEx                                                                                      7E42D5F3 5 Bytes  JMP 002C0120 
.text           C:\WINDOWS\system32\winlogon.exe[960] USER32.dll!SetWindowsHookExA                                                                                        7E431211 5 Bytes  JMP 002C00A8 
.text           C:\WINDOWS\system32\winlogon.exe[960] USER32.dll!SetWinEventHook                                                                                          7E4317F7 5 Bytes  JMP 002C0030 
.text           C:\WINDOWS\system32\winlogon.exe[960] USER32.dll!UnhookWinEvent                                                                                           7E4318AC 5 Bytes  JMP 002C006C 
.text           C:\WINDOWS\system32\services.exe[1004] ntdll.dll!LdrLoadDll                                                                                               7C91632D 5 Bytes  JMP 00090030 
.text           C:\WINDOWS\system32\services.exe[1004] ntdll.dll!LdrUnloadDll                                                                                             7C9171CD 5 Bytes  JMP 0009006C 
.text           C:\WINDOWS\system32\services.exe[1004] ADVAPI32.dll!SetServiceObjectSecurity                                                                              77E36D81 5 Bytes  JMP 002B01D4 
.text           C:\WINDOWS\system32\services.exe[1004] ADVAPI32.dll!ChangeServiceConfigA                                                                                  77E36E69 5 Bytes  JMP 002B00E4 
.text           C:\WINDOWS\system32\services.exe[1004] ADVAPI32.dll!ChangeServiceConfigW                                                                                  77E37001 5 Bytes  JMP 002B0120 
.text           C:\WINDOWS\system32\services.exe[1004] ADVAPI32.dll!ChangeServiceConfig2A                                                                                 77E37101 5 Bytes  JMP 002B015C 
.text           C:\WINDOWS\system32\services.exe[1004] ADVAPI32.dll!ChangeServiceConfig2W                                                                                 77E37189 5 Bytes  JMP 002B0198 
.text           C:\WINDOWS\system32\services.exe[1004] ADVAPI32.dll!CreateServiceA                                                                                        77E37211 5 Bytes  JMP 002B0030 
.text           C:\WINDOWS\system32\services.exe[1004] ADVAPI32.dll!CreateServiceW                                                                                        77E373A9 5 Bytes  JMP 002B006C 
.text           C:\WINDOWS\system32\services.exe[1004] ADVAPI32.dll!DeleteService                                                                                         77E374B1 5 Bytes  JMP 002B00A8 
.text           C:\WINDOWS\system32\services.exe[1004] USER32.dll!SetWindowsHookExW                                                                                       7E42820F 5 Bytes  JMP 002C00E4 
.text           C:\WINDOWS\system32\services.exe[1004] USER32.dll!UnhookWindowsHookEx                                                                                     7E42D5F3 5 Bytes  JMP 002C0120 
.text           C:\WINDOWS\system32\services.exe[1004] USER32.dll!SetWindowsHookExA                                                                                       7E431211 5 Bytes  JMP 002C00A8 
.text           C:\WINDOWS\system32\services.exe[1004] USER32.dll!SetWinEventHook                                                                                         7E4317F7 5 Bytes  JMP 002C0030 
.text           C:\WINDOWS\system32\services.exe[1004] USER32.dll!UnhookWinEvent                                                                                          7E4318AC 5 Bytes  JMP 002C006C 
.text           C:\WINDOWS\system32\lsass.exe[1016] ntdll.dll!LdrLoadDll                                                                                                  7C91632D 5 Bytes  JMP 00090030 
.text           C:\WINDOWS\system32\lsass.exe[1016] ntdll.dll!LdrUnloadDll                                                                                                7C9171CD 5 Bytes  JMP 0009006C 
.text           C:\WINDOWS\system32\lsass.exe[1016] ADVAPI32.dll!SetServiceObjectSecurity                                                                                 77E36D81 5 Bytes  JMP 002B01D4 
.text           C:\WINDOWS\system32\lsass.exe[1016] ADVAPI32.dll!ChangeServiceConfigA                                                                                     77E36E69 5 Bytes  JMP 002B00E4 
.text           C:\WINDOWS\system32\lsass.exe[1016] ADVAPI32.dll!ChangeServiceConfigW                                                                                     77E37001 5 Bytes  JMP 002B0120 
.text           C:\WINDOWS\system32\lsass.exe[1016] ADVAPI32.dll!ChangeServiceConfig2A                                                                                    77E37101 5 Bytes  JMP 002B015C 
.text           C:\WINDOWS\system32\lsass.exe[1016] ADVAPI32.dll!ChangeServiceConfig2W                                                                                    77E37189 5 Bytes  JMP 002B0198 
.text           C:\WINDOWS\system32\lsass.exe[1016] ADVAPI32.dll!CreateServiceA                                                                                           77E37211 5 Bytes  JMP 002B0030 
.text           C:\WINDOWS\system32\lsass.exe[1016] ADVAPI32.dll!CreateServiceW                                                                                           77E373A9 5 Bytes  JMP 002B006C 
.text           C:\WINDOWS\system32\lsass.exe[1016] ADVAPI32.dll!DeleteService                                                                                            77E374B1 5 Bytes  JMP 002B00A8 
.text           C:\WINDOWS\system32\lsass.exe[1016] USER32.dll!SetWindowsHookExW                                                                                          7E42820F 5 Bytes  JMP 002C00E4 
.text           C:\WINDOWS\system32\lsass.exe[1016] USER32.dll!UnhookWindowsHookEx                                                                                        7E42D5F3 5 Bytes  JMP 002C0120 
.text           C:\WINDOWS\system32\lsass.exe[1016] USER32.dll!SetWindowsHookExA                                                                                          7E431211 5 Bytes  JMP 002C00A8 
.text           C:\WINDOWS\system32\lsass.exe[1016] USER32.dll!SetWinEventHook                                                                                            7E4317F7 5 Bytes  JMP 002C0030 
.text           C:\WINDOWS\system32\lsass.exe[1016] USER32.dll!UnhookWinEvent                                                                                             7E4318AC 5 Bytes  JMP 002C006C 
.text           C:\WINDOWS\system32\Ati2evxx.exe[1188] ntdll.dll!LdrLoadDll                                                                                               7C91632D 5 Bytes  JMP 00140030 
.text           C:\WINDOWS\system32\Ati2evxx.exe[1188] ntdll.dll!LdrUnloadDll                                                                                             7C9171CD 5 Bytes  JMP 0014006C 
.text           C:\WINDOWS\system32\Ati2evxx.exe[1188] USER32.dll!SetWindowsHookExW                                                                                       7E42820F 5 Bytes  JMP 003800E4 
.text           C:\WINDOWS\system32\Ati2evxx.exe[1188] USER32.dll!UnhookWindowsHookEx                                                                                     7E42D5F3 5 Bytes  JMP 00380120 
.text           C:\WINDOWS\system32\Ati2evxx.exe[1188] USER32.dll!SetWindowsHookExA                                                                                       7E431211 5 Bytes  JMP 003800A8 
.text           C:\WINDOWS\system32\Ati2evxx.exe[1188] USER32.dll!SetWinEventHook                                                                                         7E4317F7 5 Bytes  JMP 00380030 
.text           C:\WINDOWS\system32\Ati2evxx.exe[1188] USER32.dll!UnhookWinEvent                                                                                          7E4318AC 5 Bytes  JMP 0038006C 
.text           C:\WINDOWS\system32\Ati2evxx.exe[1188] ADVAPI32.dll!SetServiceObjectSecurity                                                                              77E36D81 5 Bytes  JMP 003901D4 
.text           C:\WINDOWS\system32\Ati2evxx.exe[1188] ADVAPI32.dll!ChangeServiceConfigA                                                                                  77E36E69 5 Bytes  JMP 003900E4 
.text           C:\WINDOWS\system32\Ati2evxx.exe[1188] ADVAPI32.dll!ChangeServiceConfigW                                                                                  77E37001 5 Bytes  JMP 00390120 
.text           C:\WINDOWS\system32\Ati2evxx.exe[1188] ADVAPI32.dll!ChangeServiceConfig2A                                                                                 77E37101 5 Bytes  JMP 0039015C 
.text           C:\WINDOWS\system32\Ati2evxx.exe[1188] ADVAPI32.dll!ChangeServiceConfig2W                                                                                 77E37189 5 Bytes  JMP 00390198 
.text           C:\WINDOWS\system32\Ati2evxx.exe[1188] ADVAPI32.dll!CreateServiceA                                                                                        77E37211 5 Bytes  JMP 00390030 
.text           C:\WINDOWS\system32\Ati2evxx.exe[1188] ADVAPI32.dll!CreateServiceW                                                                                        77E373A9 5 Bytes  JMP 0039006C 
.text           C:\WINDOWS\system32\Ati2evxx.exe[1188] ADVAPI32.dll!DeleteService                                                                                         77E374B1 5 Bytes  JMP 003900A8 
.text           C:\WINDOWS\SOUNDMAN.EXE[1200] ntdll.dll!LdrLoadDll                                                                                                        7C91632D 5 Bytes  JMP 00150030 
.text           C:\WINDOWS\SOUNDMAN.EXE[1200] ntdll.dll!LdrUnloadDll                                                                                                      7C9171CD 5 Bytes  JMP 0015006C 
.text           C:\WINDOWS\SOUNDMAN.EXE[1200] USER32.dll!SetWindowsHookExW                                                                                                7E42820F 5 Bytes  JMP 003800E4 
.text           C:\WINDOWS\SOUNDMAN.EXE[1200] USER32.dll!UnhookWindowsHookEx                                                                                              7E42D5F3 5 Bytes  JMP 00380120 
.text           C:\WINDOWS\SOUNDMAN.EXE[1200] USER32.dll!SetWindowsHookExA                                                                                                7E431211 5 Bytes  JMP 003800A8 
.text           C:\WINDOWS\SOUNDMAN.EXE[1200] USER32.dll!SetWinEventHook                                                                                                  7E4317F7 5 Bytes  JMP 00380030 
.text           C:\WINDOWS\SOUNDMAN.EXE[1200] USER32.dll!UnhookWinEvent                                                                                                   7E4318AC 5 Bytes  JMP 0038006C 
.text           C:\WINDOWS\SOUNDMAN.EXE[1200] ADVAPI32.dll!SetServiceObjectSecurity                                                                                       77E36D81 5 Bytes  JMP 003901D4 
.text           C:\WINDOWS\SOUNDMAN.EXE[1200] ADVAPI32.dll!ChangeServiceConfigA                                                                                           77E36E69 5 Bytes  JMP 003900E4 
.text           C:\WINDOWS\SOUNDMAN.EXE[1200] ADVAPI32.dll!ChangeServiceConfigW                                                                                           77E37001 5 Bytes  JMP 00390120 
.text           C:\WINDOWS\SOUNDMAN.EXE[1200] ADVAPI32.dll!ChangeServiceConfig2A                                                                                          77E37101 5 Bytes  JMP 0039015C 
.text           C:\WINDOWS\SOUNDMAN.EXE[1200] ADVAPI32.dll!ChangeServiceConfig2W                                                                                          77E37189 5 Bytes  JMP 00390198 
.text           C:\WINDOWS\SOUNDMAN.EXE[1200] ADVAPI32.dll!CreateServiceA                                                                                                 77E37211 5 Bytes  JMP 00390030 
.text           C:\WINDOWS\SOUNDMAN.EXE[1200] ADVAPI32.dll!CreateServiceW                                                                                                 77E373A9 5 Bytes  JMP 0039006C 
.text           C:\WINDOWS\SOUNDMAN.EXE[1200] ADVAPI32.dll!DeleteService                                                                                                  77E374B1 5 Bytes  JMP 003900A8 
.text           C:\WINDOWS\system32\svchost.exe[1212] ntdll.dll!LdrLoadDll                                                                                                7C91632D 5 Bytes  JMP 00090030 
.text           C:\WINDOWS\system32\svchost.exe[1212] ntdll.dll!LdrUnloadDll                                                                                              7C9171CD 5 Bytes  JMP 0009006C 
.text           C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!SetServiceObjectSecurity                                                                               77E36D81 5 Bytes  JMP 002B01D4 
.text           C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!ChangeServiceConfigA                                                                                   77E36E69 5 Bytes  JMP 002B00E4 
.text           C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!ChangeServiceConfigW                                                                                   77E37001 5 Bytes  JMP 002B0120 
.text           C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!ChangeServiceConfig2A                                                                                  77E37101 5 Bytes  JMP 002B015C 
.text           C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!ChangeServiceConfig2W                                                                                  77E37189 5 Bytes  JMP 002B0198 
.text           C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!CreateServiceA                                                                                         77E37211 5 Bytes  JMP 002B0030 
.text           C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!CreateServiceW                                                                                         77E373A9 5 Bytes  JMP 002B006C 
.text           C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!DeleteService                                                                                          77E374B1 5 Bytes  JMP 002B00A8 
.text           C:\WINDOWS\system32\svchost.exe[1212] USER32.dll!SetWindowsHookExW                                                                                        7E42820F 5 Bytes  JMP 002C00E4 
.text           C:\WINDOWS\system32\svchost.exe[1212] USER32.dll!UnhookWindowsHookEx                                                                                      7E42D5F3 5 Bytes  JMP 002C0120 
.text           C:\WINDOWS\system32\svchost.exe[1212] USER32.dll!SetWindowsHookExA                                                                                        7E431211 5 Bytes  JMP 002C00A8 
.text           C:\WINDOWS\system32\svchost.exe[1212] USER32.dll!SetWinEventHook                                                                                          7E4317F7 5 Bytes  JMP 002C0030 
.text           C:\WINDOWS\system32\svchost.exe[1212] USER32.dll!UnhookWinEvent                                                                                           7E4318AC 5 Bytes  JMP 002C006C 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1232] ntdll.dll!LdrLoadDll                                                     7C91632D 5 Bytes  JMP 00150030 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1232] ntdll.dll!LdrUnloadDll                                                   7C9171CD 5 Bytes  JMP 0015006C 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1232] ADVAPI32.dll!SetServiceObjectSecurity                                    77E36D81 5 Bytes  JMP 003901D4 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1232] ADVAPI32.dll!ChangeServiceConfigA                                        77E36E69 5 Bytes  JMP 003900E4 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1232] ADVAPI32.dll!ChangeServiceConfigW                                        77E37001 5 Bytes  JMP 00390120 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1232] ADVAPI32.dll!ChangeServiceConfig2A                                       77E37101 5 Bytes  JMP 0039015C 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1232] ADVAPI32.dll!ChangeServiceConfig2W                                       77E37189 5 Bytes  JMP 00390198 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1232] ADVAPI32.dll!CreateServiceA                                              77E37211 5 Bytes  JMP 00390030 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1232] ADVAPI32.dll!CreateServiceW                                              77E373A9 5 Bytes  JMP 0039006C 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1232] ADVAPI32.dll!DeleteService                                               77E374B1 5 Bytes  JMP 003900A8 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1232] USER32.dll!SetWindowsHookExW                                             7E42820F 5 Bytes  JMP 003A00E4 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1232] USER32.dll!UnhookWindowsHookEx                                           7E42D5F3 5 Bytes  JMP 003A0120 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1232] USER32.dll!SetWindowsHookExA                                             7E431211 5 Bytes  JMP 003A00A8 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1232] USER32.dll!SetWinEventHook                                               7E4317F7 5 Bytes  JMP 003A0030 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1232] USER32.dll!UnhookWinEvent                                                7E4318AC 5 Bytes  JMP 003A006C 
.text           C:\WINDOWS\ATKKBService.exe[1248] ntdll.dll!LdrLoadDll                                                                                                    7C91632D 5 Bytes  JMP 00140030 
.text           C:\WINDOWS\ATKKBService.exe[1248] ntdll.dll!LdrUnloadDll                                                                                                  7C9171CD 5 Bytes  JMP 0014006C 
.text           C:\WINDOWS\ATKKBService.exe[1248] ADVAPI32.dll!SetServiceObjectSecurity                                                                                   77E36D81 5 Bytes  JMP 003801D4 
.text           C:\WINDOWS\ATKKBService.exe[1248] ADVAPI32.dll!ChangeServiceConfigA                                                                                       77E36E69 5 Bytes  JMP 003800E4 
.text           C:\WINDOWS\ATKKBService.exe[1248] ADVAPI32.dll!ChangeServiceConfigW                                                                                       77E37001 5 Bytes  JMP 00380120 
.text           C:\WINDOWS\ATKKBService.exe[1248] ADVAPI32.dll!ChangeServiceConfig2A                                                                                      77E37101 5 Bytes  JMP 0038015C 
.text           C:\WINDOWS\ATKKBService.exe[1248] ADVAPI32.dll!ChangeServiceConfig2W                                                                                      77E37189 5 Bytes  JMP 00380198 
.text           C:\WINDOWS\ATKKBService.exe[1248] ADVAPI32.dll!CreateServiceA                                                                                             77E37211 5 Bytes  JMP 00380030 
.text           C:\WINDOWS\ATKKBService.exe[1248] ADVAPI32.dll!CreateServiceW                                                                                             77E373A9 5 Bytes  JMP 0038006C 
.text           C:\WINDOWS\ATKKBService.exe[1248] ADVAPI32.dll!DeleteService                                                                                              77E374B1 5 Bytes  JMP 003800A8 
.text           C:\WINDOWS\ATKKBService.exe[1248] USER32.dll!SetWindowsHookExW                                                                                            7E42820F 5 Bytes  JMP 003900E4 
.text           C:\WINDOWS\ATKKBService.exe[1248] USER32.dll!UnhookWindowsHookEx                                                                                          7E42D5F3 5 Bytes  JMP 00390120 
.text           C:\WINDOWS\ATKKBService.exe[1248] USER32.dll!SetWindowsHookExA                                                                                            7E431211 5 Bytes  JMP 003900A8 
.text           C:\WINDOWS\ATKKBService.exe[1248] USER32.dll!SetWinEventHook                                                                                              7E4317F7 5 Bytes  JMP 00390030 
.text           C:\WINDOWS\ATKKBService.exe[1248] USER32.dll!UnhookWinEvent                                                                                               7E4318AC 5 Bytes  JMP 0039006C 
.text           C:\WINDOWS\system32\svchost.exe[1320] ntdll.dll!LdrLoadDll                                                                                                7C91632D 5 Bytes  JMP 00090030 
.text           C:\WINDOWS\system32\svchost.exe[1320] ntdll.dll!LdrUnloadDll                                                                                              7C9171CD 5 Bytes  JMP 0009006C 
.text           C:\WINDOWS\system32\svchost.exe[1320] ADVAPI32.dll!SetServiceObjectSecurity                                                                               77E36D81 5 Bytes  JMP 002B01D4 
.text           C:\WINDOWS\system32\svchost.exe[1320] ADVAPI32.dll!ChangeServiceConfigA                                                                                   77E36E69 5 Bytes  JMP 002B00E4 
.text           C:\WINDOWS\system32\svchost.exe[1320] ADVAPI32.dll!ChangeServiceConfigW                                                                                   77E37001 5 Bytes  JMP 002B0120 
.text           C:\WINDOWS\system32\svchost.exe[1320] ADVAPI32.dll!ChangeServiceConfig2A                                                                                  77E37101 5 Bytes  JMP 002B015C 
.text           C:\WINDOWS\system32\svchost.exe[1320] ADVAPI32.dll!ChangeServiceConfig2W                                                                                  77E37189 5 Bytes  JMP 002B0198 
.text           C:\WINDOWS\system32\svchost.exe[1320] ADVAPI32.dll!CreateServiceA                                                                                         77E37211 5 Bytes  JMP 002B0030 
.text           C:\WINDOWS\system32\svchost.exe[1320] ADVAPI32.dll!CreateServiceW                                                                                         77E373A9 5 Bytes  JMP 002B006C 
.text           C:\WINDOWS\system32\svchost.exe[1320] ADVAPI32.dll!DeleteService                                                                                          77E374B1 5 Bytes  JMP 002B00A8 
.text           C:\WINDOWS\system32\svchost.exe[1320] USER32.dll!SetWindowsHookExW                                                                                        7E42820F 5 Bytes  JMP 002C00E4 
.text           C:\WINDOWS\system32\svchost.exe[1320] USER32.dll!UnhookWindowsHookEx                                                                                      7E42D5F3 5 Bytes  JMP 002C0120 
.text           C:\WINDOWS\system32\svchost.exe[1320] USER32.dll!SetWindowsHookExA                                                                                        7E431211 5 Bytes  JMP 002C00A8 
.text           C:\WINDOWS\system32\svchost.exe[1320] USER32.dll!SetWinEventHook                                                                                          7E4317F7 5 Bytes  JMP 002C0030 
.text           C:\WINDOWS\system32\svchost.exe[1320] USER32.dll!UnhookWinEvent                                                                                           7E4318AC 5 Bytes  JMP 002C006C 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[1364] ntdll.dll!LdrLoadDll                                                           7C91632D 5 Bytes  JMP 00160030 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[1364] ntdll.dll!LdrUnloadDll                                                         7C9171CD 5 Bytes  JMP 0016006C 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[1364] ADVAPI32.dll!SetServiceObjectSecurity                                          77E36D81 5 Bytes  JMP 003901D4 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[1364] ADVAPI32.dll!ChangeServiceConfigA                                              77E36E69 5 Bytes  JMP 003900E4 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[1364] ADVAPI32.dll!ChangeServiceConfigW                                              77E37001 5 Bytes  JMP 00390120 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[1364] ADVAPI32.dll!ChangeServiceConfig2A                                             77E37101 5 Bytes  JMP 0039015C 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[1364] ADVAPI32.dll!ChangeServiceConfig2W                                             77E37189 5 Bytes  JMP 00390198 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[1364] ADVAPI32.dll!CreateServiceA                                                    77E37211 5 Bytes  JMP 00390030 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[1364] ADVAPI32.dll!CreateServiceW                                                    77E373A9 5 Bytes  JMP 0039006C 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[1364] ADVAPI32.dll!DeleteService                                                     77E374B1 5 Bytes  JMP 003900A8 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[1364] USER32.dll!SetWindowsHookExW                                                   7E42820F 5 Bytes  JMP 003A00E4 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[1364] USER32.dll!UnhookWindowsHookEx                                                 7E42D5F3 5 Bytes  JMP 003A0120 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[1364] USER32.dll!SetWindowsHookExA                                                   7E431211 5 Bytes  JMP 003A00A8 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[1364] USER32.dll!SetWinEventHook                                                     7E4317F7 5 Bytes  JMP 003A0030 
.text           C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe[1364] USER32.dll!UnhookWinEvent                                                      7E4318AC 5 Bytes  JMP 003A006C 
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1436] ntdll.dll!LdrLoadDll                                                                                         7C91632D 5 Bytes  JMP 00150030 
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1436] ntdll.dll!LdrUnloadDll                                                                                       7C9171CD 5 Bytes  JMP 0015006C 
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1436] ADVAPI32.dll!SetServiceObjectSecurity                                                                        77E36D81 5 Bytes  JMP 003901D4 
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1436] ADVAPI32.dll!ChangeServiceConfigA                                                                            77E36E69 5 Bytes  JMP 003900E4 
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1436] ADVAPI32.dll!ChangeServiceConfigW                                                                            77E37001 5 Bytes  JMP 00390120 
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1436] ADVAPI32.dll!ChangeServiceConfig2A                                                                           77E37101 5 Bytes  JMP 0039015C 
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1436] ADVAPI32.dll!ChangeServiceConfig2W                                                                           77E37189 5 Bytes  JMP 00390198 
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1436] ADVAPI32.dll!CreateServiceA                                                                                  77E37211 5 Bytes  JMP 00390030 
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1436] ADVAPI32.dll!CreateServiceW                                                                                  77E373A9 5 Bytes  JMP 0039006C 
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1436] ADVAPI32.dll!DeleteService                                                                                   77E374B1 5 Bytes  JMP 003900A8 
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1436] USER32.dll!SetWindowsHookExW                                                                                 7E42820F 5 Bytes  JMP 003A00E4 
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1436] USER32.dll!UnhookWindowsHookEx                                                                               7E42D5F3 5 Bytes  JMP 003A0120 
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1436] USER32.dll!SetWindowsHookExA                                                                                 7E431211 5 Bytes  JMP 003A00A8 
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1436] USER32.dll!SetWinEventHook                                                                                   7E4317F7 5 Bytes  JMP 003A0030 
.text           C:\Program Files\Java\jre6\bin\jqs.exe[1436] USER32.dll!UnhookWinEvent                                                                                    7E4318AC 5 Bytes  JMP 003A006C 
.text           C:\WINDOWS\System32\svchost.exe[1444] ntdll.dll!LdrLoadDll                                                                                                7C91632D 5 Bytes  JMP 00090030 
.text           C:\WINDOWS\System32\svchost.exe[1444] ntdll.dll!LdrUnloadDll                                                                                              7C9171CD 5 Bytes  JMP 0009006C 
.text           C:\WINDOWS\System32\svchost.exe[1444] ADVAPI32.dll!SetServiceObjectSecurity                                                                               77E36D81 5 Bytes  JMP 002B01D4 
.text           C:\WINDOWS\System32\svchost.exe[1444] ADVAPI32.dll!ChangeServiceConfigA                                                                                   77E36E69 5 Bytes  JMP 002B00E4 
.text           C:\WINDOWS\System32\svchost.exe[1444] ADVAPI32.dll!ChangeServiceConfigW                                                                                   77E37001 5 Bytes  JMP 002B0120 
.text           C:\WINDOWS\System32\svchost.exe[1444] ADVAPI32.dll!ChangeServiceConfig2A                                                                                  77E37101 5 Bytes  JMP 002B015C 
.text           C:\WINDOWS\System32\svchost.exe[1444] ADVAPI32.dll!ChangeServiceConfig2W                                                                                  77E37189 5 Bytes  JMP 002B0198 
.text           C:\WINDOWS\System32\svchost.exe[1444] ADVAPI32.dll!CreateServiceA                                                                                         77E37211 5 Bytes  JMP 002B0030 
.text           C:\WINDOWS\System32\svchost.exe[1444] ADVAPI32.dll!CreateServiceW                                                                                         77E373A9 5 Bytes  JMP 002B006C 
.text           C:\WINDOWS\System32\svchost.exe[1444] ADVAPI32.dll!DeleteService                                                                                          77E374B1 5 Bytes  JMP 002B00A8 
.text           C:\WINDOWS\System32\svchost.exe[1444] USER32.dll!SetWindowsHookExW                                                                                        7E42820F 5 Bytes  JMP 002C00E4 
.text           C:\WINDOWS\System32\svchost.exe[1444] USER32.dll!UnhookWindowsHookEx                                                                                      7E42D5F3 5 Bytes  JMP 002C0120 
.text           C:\WINDOWS\System32\svchost.exe[1444] USER32.dll!SetWindowsHookExA                                                                                        7E431211 5 Bytes  JMP 002C00A8 
.text           C:\WINDOWS\System32\svchost.exe[1444] USER32.dll!SetWinEventHook                                                                                          7E4317F7 5 Bytes  JMP 002C0030 
.text           C:\WINDOWS\System32\svchost.exe[1444] USER32.dll!UnhookWinEvent                                                                                           7E4318AC 5 Bytes  JMP 002C006C 
.text           C:\Program Files\Ahead\InCD\InCDsrv.exe[1468] ntdll.dll!LdrLoadDll                                                                                        7C91632D 5 Bytes  JMP 00080030 
.text           C:\Program Files\Ahead\InCD\InCDsrv.exe[1468] ntdll.dll!LdrUnloadDll                                                                                      7C9171CD 5 Bytes  JMP 0008006C 
.text           C:\Program Files\Ahead\InCD\InCDsrv.exe[1468] USER32.dll!SetWindowsHookExW                                                                                7E42820F 5 Bytes  JMP 002C00E4 
.text           C:\Program Files\Ahead\InCD\InCDsrv.exe[1468] USER32.dll!UnhookWindowsHookEx                                                                              7E42D5F3 5 Bytes  JMP 002C0120 
.text           C:\Program Files\Ahead\InCD\InCDsrv.exe[1468] USER32.dll!SetWindowsHookExA                                                                                7E431211 5 Bytes  JMP 002C00A8 
.text           C:\Program Files\Ahead\InCD\InCDsrv.exe[1468] USER32.dll!SetWinEventHook                                                                                  7E4317F7 5 Bytes  JMP 002C0030 
.text           C:\Program Files\Ahead\InCD\InCDsrv.exe[1468] USER32.dll!UnhookWinEvent                                                                                   7E4318AC 5 Bytes  JMP 002C006C 
.text           C:\Program Files\Ahead\InCD\InCDsrv.exe[1468] ADVAPI32.dll!SetServiceObjectSecurity                                                                       77E36D81 5 Bytes  JMP 002D01D4 
.text           C:\Program Files\Ahead\InCD\InCDsrv.exe[1468] ADVAPI32.dll!ChangeServiceConfigA                                                                           77E36E69 5 Bytes  JMP 002D00E4 
.text           C:\Program Files\Ahead\InCD\InCDsrv.exe[1468] ADVAPI32.dll!ChangeServiceConfigW                                                                           77E37001 5 Bytes  JMP 002D0120 
.text           C:\Program Files\Ahead\InCD\InCDsrv.exe[1468] ADVAPI32.dll!ChangeServiceConfig2A                                                                          77E37101 5 Bytes  JMP 002D015C 
.text           C:\Program Files\Ahead\InCD\InCDsrv.exe[1468] ADVAPI32.dll!ChangeServiceConfig2W                                                                          77E37189 5 Bytes  JMP 002D0198 
.text           C:\Program Files\Ahead\InCD\InCDsrv.exe[1468] ADVAPI32.dll!CreateServiceA                                                                                 77E37211 5 Bytes  JMP 002D0030 
.text           C:\Program Files\Ahead\InCD\InCDsrv.exe[1468] ADVAPI32.dll!CreateServiceW                                                                                 77E373A9 5 Bytes  JMP 002D006C 
.text           C:\Program Files\Ahead\InCD\InCDsrv.exe[1468] ADVAPI32.dll!DeleteService                                                                                  77E374B1 5 Bytes  JMP 002D00A8 
.text           C:\WINDOWS\system32\svchost.exe[1560] ntdll.dll!LdrLoadDll                                                                                                7C91632D 5 Bytes  JMP 00090030 
.text           C:\WINDOWS\system32\svchost.exe[1560] ntdll.dll!LdrUnloadDll                                                                                              7C9171CD 5 Bytes  JMP 0009006C 
.text           C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!SetServiceObjectSecurity                                                                               77E36D81 5 Bytes  JMP 002B01D4 
.text           C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!ChangeServiceConfigA                                                                                   77E36E69 5 Bytes  JMP 002B00E4 
.text           C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!ChangeServiceConfigW                                                                                   77E37001 5 Bytes  JMP 002B0120 
.text           C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!ChangeServiceConfig2A                                                                                  77E37101 5 Bytes  JMP 002B015C 
.text           C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!ChangeServiceConfig2W                                                                                  77E37189 5 Bytes  JMP 002B0198 
.text           C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!CreateServiceA                                                                                         77E37211 5 Bytes  JMP 002B0030 
.text           C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!CreateServiceW                                                                                         77E373A9 5 Bytes  JMP 002B006C 
.text           C:\WINDOWS\system32\svchost.exe[1560] ADVAPI32.dll!DeleteService                                                                                          77E374B1 5 Bytes  JMP 002B00A8 
.text           C:\WINDOWS\system32\svchost.exe[1560] USER32.dll!SetWindowsHookExW                                                                                        7E42820F 5 Bytes  JMP 002C00E4 
.text           C:\WINDOWS\system32\svchost.exe[1560] USER32.dll!UnhookWindowsHookEx                                                                                      7E42D5F3 5 Bytes  JMP 002C0120 
.text           C:\WINDOWS\system32\svchost.exe[1560] USER32.dll!SetWindowsHookExA                                                                                        7E431211 5 Bytes  JMP 002C00A8 
.text           C:\WINDOWS\system32\svchost.exe[1560] USER32.dll!SetWinEventHook                                                                                          7E4317F7 5 Bytes  JMP 002C0030 
.text           C:\WINDOWS\system32\svchost.exe[1560] USER32.dll!UnhookWinEvent                                                                                           7E4318AC 5 Bytes  JMP 002C006C 
.text           C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe[1632] ntdll.dll!LdrLoadDll                                                                         7C91632D 5 Bytes  JMP 00150030 
.text           C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe[1632] ntdll.dll!LdrUnloadDll                                                                       7C9171CD 5 Bytes  JMP 0015006C 
.text           C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe[1632] ADVAPI32.dll!SetServiceObjectSecurity                                                        77E36D81 5 Bytes  JMP 003901D4 
.text           C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe[1632] ADVAPI32.dll!ChangeServiceConfigA                                                            77E36E69 5 Bytes  JMP 003900E4 
.text           C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe[1632] ADVAPI32.dll!ChangeServiceConfigW                                                            77E37001 5 Bytes  JMP 00390120 
.text           C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe[1632] ADVAPI32.dll!ChangeServiceConfig2A                                                           77E37101 5 Bytes  JMP 0039015C 
.text           C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe[1632] ADVAPI32.dll!ChangeServiceConfig2W                                                           77E37189 5 Bytes  JMP 00390198 
.text           C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe[1632] ADVAPI32.dll!CreateServiceA                                                                  77E37211 5 Bytes  JMP 00390030 
.text           C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe[1632] ADVAPI32.dll!CreateServiceW                                                                  77E373A9 5 Bytes  JMP 0039006C 
.text           C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe[1632] ADVAPI32.dll!DeleteService                                                                   77E374B1 5 Bytes  JMP 003900A8 
.text           C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe[1632] USER32.dll!SetWindowsHookExW                                                                 7E42820F 5 Bytes  JMP 003A00E4 
.text           C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe[1632] USER32.dll!UnhookWindowsHookEx                                                               7E42D5F3 5 Bytes  JMP 003A0120 
.text           C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe[1632] USER32.dll!SetWindowsHookExA                                                                 7E431211 5 Bytes  JMP 003A00A8 
.text           C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe[1632] USER32.dll!SetWinEventHook                                                                   7E4317F7 5 Bytes  JMP 003A0030 
.text           C:\Program Files\MySQL\MySQL Server 5.5\bin\mysqld.exe[1632] USER32.dll!UnhookWinEvent                                                                    7E4318AC 5 Bytes  JMP 003A006C 
.text           C:\WINDOWS\system32\svchost.exe[1688] ntdll.dll!LdrLoadDll                                                                                                7C91632D 5 Bytes  JMP 00090030 
.text           C:\WINDOWS\system32\svchost.exe[1688] ntdll.dll!LdrUnloadDll                                                                                              7C9171CD 5 Bytes  JMP 0009006C 
.text           C:\WINDOWS\system32\svchost.exe[1688] ADVAPI32.dll!SetServiceObjectSecurity                                                                               77E36D81 5 Bytes  JMP 002B01D4 
.text           C:\WINDOWS\system32\svchost.exe[1688] ADVAPI32.dll!ChangeServiceConfigA                                                                                   77E36E69 5 Bytes  JMP 002B00E4 
.text           C:\WINDOWS\system32\svchost.exe[1688] ADVAPI32.dll!ChangeServiceConfigW                                                                                   77E37001 5 Bytes  JMP 002B0120 
.text           C:\WINDOWS\system32\svchost.exe[1688] ADVAPI32.dll!ChangeServiceConfig2A                                                                                  77E37101 5 Bytes  JMP 002B015C 
.text           C:\WINDOWS\system32\svchost.exe[1688] ADVAPI32.dll!ChangeServiceConfig2W                                                                                  77E37189 5 Bytes  JMP 002B0198 
.text           C:\WINDOWS\system32\svchost.exe[1688] ADVAPI32.dll!CreateServiceA                                                                                         77E37211 5 Bytes  JMP 002B0030 
.text           C:\WINDOWS\system32\svchost.exe[1688] ADVAPI32.dll!CreateServiceW                                                                                         77E373A9 5 Bytes  JMP 002B006C 
.text           C:\WINDOWS\system32\svchost.exe[1688] ADVAPI32.dll!DeleteService                                                                                          77E374B1 5 Bytes  JMP 002B00A8 
.text           C:\WINDOWS\system32\svchost.exe[1688] USER32.dll!SetWindowsHookExW                                                                                        7E42820F 5 Bytes  JMP 002C00E4 
.text           C:\WINDOWS\system32\svchost.exe[1688] USER32.dll!UnhookWindowsHookEx                                                                                      7E42D5F3 5 Bytes  JMP 002C0120 
.text           C:\WINDOWS\system32\svchost.exe[1688] USER32.dll!SetWindowsHookExA                                                                                        7E431211 5 Bytes  JMP 002C00A8 
.text           C:\WINDOWS\system32\svchost.exe[1688] USER32.dll!SetWinEventHook                                                                                          7E4317F7 5 Bytes  JMP 002C0030 
.text           C:\WINDOWS\system32\svchost.exe[1688] USER32.dll!UnhookWinEvent                                                                                           7E4318AC 5 Bytes  JMP 002C006C 
.text           C:\Program Files\Java\jre6\bin\jusched.exe[1724] ntdll.dll!LdrLoadDll                                                                                     7C91632D 5 Bytes  JMP 00160030 
.text           C:\Program Files\Java\jre6\bin\jusched.exe[1724] ntdll.dll!LdrUnloadDll                                                                                   7C9171CD 5 Bytes  JMP 0016006C 
.text           C:\Program Files\Java\jre6\bin\jusched.exe[1724] ADVAPI32.dll!SetServiceObjectSecurity                                                                    77E36D81 5 Bytes  JMP 003A01D4 
.text           C:\Program Files\Java\jre6\bin\jusched.exe[1724] ADVAPI32.dll!ChangeServiceConfigA                                                                        77E36E69 5 Bytes  JMP 003A00E4 
.text           C:\Program Files\Java\jre6\bin\jusched.exe[1724] ADVAPI32.dll!ChangeServiceConfigW                                                                        77E37001 5 Bytes  JMP 003A0120 
.text           C:\Program Files\Java\jre6\bin\jusched.exe[1724] ADVAPI32.dll!ChangeServiceConfig2A                                                                       77E37101 5 Bytes  JMP 003A015C 
.text           C:\Program Files\Java\jre6\bin\jusched.exe[1724] ADVAPI32.dll!ChangeServiceConfig2W                                                                       77E37189 5 Bytes  JMP 003A0198 
.text           C:\Program Files\Java\jre6\bin\jusched.exe[1724] ADVAPI32.dll!CreateServiceA                                                                              77E37211 5 Bytes  JMP 003A0030 
.text           C:\Program Files\Java\jre6\bin\jusched.exe[1724] ADVAPI32.dll!CreateServiceW                                                                              77E373A9 5 Bytes  JMP 003A006C 
.text           C:\Program Files\Java\jre6\bin\jusched.exe[1724] ADVAPI32.dll!DeleteService                                                                               77E374B1 5 Bytes  JMP 003A00A8 
.text           C:\Program Files\Java\jre6\bin\jusched.exe[1724] USER32.dll!SetWindowsHookExW                                                                             7E42820F 5 Bytes  JMP 003B00E4 
.text           C:\Program Files\Java\jre6\bin\jusched.exe[1724] USER32.dll!UnhookWindowsHookEx                                                                           7E42D5F3 5 Bytes  JMP 003B0120 
.text           C:\Program Files\Java\jre6\bin\jusched.exe[1724] USER32.dll!SetWindowsHookExA                                                                             7E431211 5 Bytes  JMP 003B00A8 
.text           C:\Program Files\Java\jre6\bin\jusched.exe[1724] USER32.dll!SetWinEventHook                                                                               7E4317F7 5 Bytes  JMP 003B0030 
.text           C:\Program Files\Java\jre6\bin\jusched.exe[1724] USER32.dll!UnhookWinEvent                                                                                7E4318AC 5 Bytes  JMP 003B006C 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[1728] ntdll.dll!LdrLoadDll                                                                7C91632D 5 Bytes  JMP 00090030 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[1728] ntdll.dll!LdrUnloadDll                                                              7C9171CD 5 Bytes  JMP 0009006C 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[1728] USER32.dll!SetWindowsHookExW                                                        7E42820F 5 Bytes  JMP 002D00E4 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[1728] USER32.dll!UnhookWindowsHookEx                                                      7E42D5F3 5 Bytes  JMP 002D0120 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[1728] USER32.dll!SetWindowsHookExA                                                        7E431211 5 Bytes  JMP 002D00A8 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[1728] USER32.dll!SetWinEventHook                                                          7E4317F7 5 Bytes  JMP 002D0030 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[1728] USER32.dll!UnhookWinEvent                                                           7E4318AC 5 Bytes  JMP 002D006C 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[1728] ADVAPI32.dll!SetServiceObjectSecurity                                               77E36D81 5 Bytes  JMP 002E01D4 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[1728] ADVAPI32.dll!ChangeServiceConfigA                                                   77E36E69 5 Bytes  JMP 002E00E4 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[1728] ADVAPI32.dll!ChangeServiceConfigW                                                   77E37001 5 Bytes  JMP 002E0120 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[1728] ADVAPI32.dll!ChangeServiceConfig2A                                                  77E37101 5 Bytes  JMP 002E015C 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[1728] ADVAPI32.dll!ChangeServiceConfig2W                                                  77E37189 5 Bytes  JMP 002E0198 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[1728] ADVAPI32.dll!CreateServiceA                                                         77E37211 5 Bytes  JMP 002E0030 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[1728] ADVAPI32.dll!CreateServiceW                                                         77E373A9 5 Bytes  JMP 002E006C 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[1728] ADVAPI32.dll!DeleteService                                                          77E374B1 5 Bytes  JMP 002E00A8 
.text           C:\WINDOWS\system32\svchost.exe[1792] ntdll.dll!LdrLoadDll                                                                                                7C91632D 5 Bytes  JMP 00090030 
.text           C:\WINDOWS\system32\svchost.exe[1792] ntdll.dll!LdrUnloadDll                                                                                              7C9171CD 5 Bytes  JMP 0009006C 
.text           C:\WINDOWS\system32\svchost.exe[1792] ADVAPI32.dll!SetServiceObjectSecurity                                                                               77E36D81 5 Bytes  JMP 002B01D4 
.text           C:\WINDOWS\system32\svchost.exe[1792] ADVAPI32.dll!ChangeServiceConfigA                                                                                   77E36E69 5 Bytes  JMP 002B00E4 
.text           C:\WINDOWS\system32\svchost.exe[1792] ADVAPI32.dll!ChangeServiceConfigW                                                                                   77E37001 5 Bytes  JMP 002B0120 
.text           C:\WINDOWS\system32\svchost.exe[1792] ADVAPI32.dll!ChangeServiceConfig2A                                                                                  77E37101 5 Bytes  JMP 002B015C 
.text           C:\WINDOWS\system32\svchost.exe[1792] ADVAPI32.dll!ChangeServiceConfig2W                                                                                  77E37189 5 Bytes  JMP 002B0198 
.text           C:\WINDOWS\system32\svchost.exe[1792] ADVAPI32.dll!CreateServiceA                                                                                         77E37211 5 Bytes  JMP 002B0030 
.text           C:\WINDOWS\system32\svchost.exe[1792] ADVAPI32.dll!CreateServiceW                                                                                         77E373A9 5 Bytes  JMP 002B006C 
.text           C:\WINDOWS\system32\svchost.exe[1792] ADVAPI32.dll!DeleteService                                                                                          77E374B1 5 Bytes  JMP 002B00A8 
.text           C:\WINDOWS\system32\svchost.exe[1792] USER32.dll!SetWindowsHookExW                                                                                        7E42820F 5 Bytes  JMP 002C00E4 
.text           C:\WINDOWS\system32\svchost.exe[1792] USER32.dll!UnhookWindowsHookEx                                                                                      7E42D5F3 5 Bytes  JMP 002C0120 
.text           C:\WINDOWS\system32\svchost.exe[1792] USER32.dll!SetWindowsHookExA                                                                                        7E431211 5 Bytes  JMP 002C00A8 
.text           C:\WINDOWS\system32\svchost.exe[1792] USER32.dll!SetWinEventHook                                                                                          7E4317F7 5 Bytes  JMP 002C0030 
.text           C:\WINDOWS\system32\svchost.exe[1792] USER32.dll!UnhookWinEvent                                                                                           7E4318AC 5 Bytes  JMP 002C006C 
.text           C:\Program Files\AVAST Software\Avast\AvastSvc.exe[1948] kernel32.dll!SetUnhandledExceptionFilter                                                         7C84495D 4 Bytes  [C2, 04, 00, 90] {RET 0x4; NOP }
.text           C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe[2076] ntdll.dll!LdrLoadDll                                                                  7C91632D 5 Bytes  JMP 00150030 
.text           C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe[2076] ntdll.dll!LdrUnloadDll                                                                7C9171CD 5 Bytes  JMP 0015006C 
.text           C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe[2076] USER32.dll!SetWindowsHookExW                                                          7E42820F 5 Bytes  JMP 003800E4 
.text           C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe[2076] USER32.dll!UnhookWindowsHookEx                                                        7E42D5F3 5 Bytes  JMP 00380120 
.text           C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe[2076] USER32.dll!SetWindowsHookExA                                                          7E431211 5 Bytes  JMP 003800A8 
.text           C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe[2076] USER32.dll!SetWinEventHook                                                            7E4317F7 5 Bytes  JMP 00380030 
.text           C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe[2076] USER32.dll!UnhookWinEvent                                                             7E4318AC 5 Bytes  JMP 0038006C 
.text           C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe[2076] ADVAPI32.dll!SetServiceObjectSecurity                                                 77E36D81 5 Bytes  JMP 003901D4 
.text           C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe[2076] ADVAPI32.dll!ChangeServiceConfigA                                                     77E36E69 5 Bytes  JMP 003900E4 
.text           C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe[2076] ADVAPI32.dll!ChangeServiceConfigW                                                     77E37001 5 Bytes  JMP 00390120 
.text           C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe[2076] ADVAPI32.dll!ChangeServiceConfig2A                                                    77E37101 5 Bytes  JMP 0039015C 
.text           C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe[2076] ADVAPI32.dll!ChangeServiceConfig2W                                                    77E37189 5 Bytes  JMP 00390198 
.text           C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe[2076] ADVAPI32.dll!CreateServiceA                                                           77E37211 5 Bytes  JMP 00390030 
.text           C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe[2076] ADVAPI32.dll!CreateServiceW                                                           77E373A9 5 Bytes  JMP 0039006C 
.text           C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe[2076] ADVAPI32.dll!DeleteService                                                            77E374B1 5 Bytes  JMP 003900A8 
.text           C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe[2160] ntdll.dll!LdrLoadDll                                                    7C91632D 5 Bytes  JMP 00150030 
.text           C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe[2160] ntdll.dll!LdrUnloadDll                                                  7C9171CD 5 Bytes  JMP 0015006C 
.text           C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe[2160] USER32.dll!SetWindowsHookExW                                            7E42820F 5 Bytes  JMP 003800E4 
.text           C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe[2160] USER32.dll!UnhookWindowsHookEx                                          7E42D5F3 5 Bytes  JMP 00380120 
.text           C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe[2160] USER32.dll!SetWindowsHookExA                                            7E431211 5 Bytes  JMP 003800A8 
.text           C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe[2160] USER32.dll!SetWinEventHook                                              7E4317F7 5 Bytes  JMP 00380030 
.text           C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe[2160] USER32.dll!UnhookWinEvent                                               7E4318AC 5 Bytes  JMP 0038006C 
.text           C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe[2160] ADVAPI32.dll!SetServiceObjectSecurity                                   77E36D81 5 Bytes  JMP 003901D4 
.text           C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe[2160] ADVAPI32.dll!ChangeServiceConfigA                                       77E36E69 5 Bytes  JMP 003900E4 
.text           C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe[2160] ADVAPI32.dll!ChangeServiceConfigW                                       77E37001 5 Bytes  JMP 00390120 
.text           C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe[2160] ADVAPI32.dll!ChangeServiceConfig2A                                      77E37101 5 Bytes  JMP 0039015C 
.text           C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe[2160] ADVAPI32.dll!ChangeServiceConfig2W                                      77E37189 5 Bytes  JMP 00390198 
.text           C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe[2160] ADVAPI32.dll!CreateServiceA                                             77E37211 5 Bytes  JMP 00390030 
.text           C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe[2160] ADVAPI32.dll!CreateServiceW                                             77E373A9 5 Bytes  JMP 0039006C 
.text           C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe[2160] ADVAPI32.dll!DeleteService                                              77E374B1 5 Bytes  JMP 003900A8 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtCreateFile + 6                                                                    7C90D0B4 4 Bytes  [28, 00, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtCreateFile + B                                                                    7C90D0B9 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtMapViewOfSection + 6                                                              7C90D524 1 Byte  [28]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtMapViewOfSection + 6                                                              7C90D524 4 Bytes  [28, 03, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtMapViewOfSection + B                                                              7C90D529 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenFile + 6                                                                      7C90D5A4 4 Bytes  [68, 00, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenFile + B                                                                      7C90D5A9 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcess + 6                                                                   7C90D604 4 Bytes  [A8, 01, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcess + B                                                                   7C90D609 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcessToken + 6                                                              7C90D614 4 Bytes  CALL 7B90ED1A 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcessToken + B                                                              7C90D619 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcessTokenEx + 6                                                            7C90D624 4 Bytes  [A8, 02, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcessTokenEx + B                                                            7C90D629 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThread + 6                                                                    7C90D664 4 Bytes  [68, 01, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThread + B                                                                    7C90D669 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThreadToken + 6                                                               7C90D674 4 Bytes  [68, 02, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThreadToken + B                                                               7C90D679 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThreadTokenEx + 6                                                             7C90D684 4 Bytes  CALL 7B90ED8B 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThreadTokenEx + B                                                             7C90D689 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtQueryAttributesFile + 6                                                           7C90D714 4 Bytes  [A8, 00, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtQueryAttributesFile + B                                                           7C90D719 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtQueryFullAttributesFile + 6                                                       7C90D7B4 4 Bytes  CALL 7B90EEB9 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtQueryFullAttributesFile + B                                                       7C90D7B9 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtSetInformationFile + 6                                                            7C90DC64 4 Bytes  [28, 01, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtSetInformationFile + B                                                            7C90DC69 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtSetInformationThread + 6                                                          7C90DCB4 4 Bytes  [28, 02, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtSetInformationThread + B                                                          7C90DCB9 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtUnmapViewOfSection + 6                                                            7C90DF14 1 Byte  [68]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtUnmapViewOfSection + 6                                                            7C90DF14 4 Bytes  [68, 03, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtUnmapViewOfSection + B                                                            7C90DF19 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!LdrLoadDll                                                                          7C91632D 5 Bytes  JMP 00180030 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!LdrUnloadDll                                                                        7C9171CD 5 Bytes  JMP 0018006C 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] USER32.dll!SetWindowsHookExW                                                                  7E42820F 5 Bytes  JMP 005000E4 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] USER32.dll!UnhookWindowsHookEx                                                                7E42D5F3 5 Bytes  JMP 00500120 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] USER32.dll!SetWindowsHookExA                                                                  7E431211 5 Bytes  JMP 005000A8 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] USER32.dll!SetWinEventHook                                                                    7E4317F7 5 Bytes  JMP 00500030 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] USER32.dll!UnhookWinEvent                                                                     7E4318AC 5 Bytes  JMP 0050006C 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ADVAPI32.dll!SetServiceObjectSecurity                                                         77E36D81 5 Bytes  JMP 005101D4 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ADVAPI32.dll!ChangeServiceConfigA                                                             77E36E69 5 Bytes  JMP 005100E4 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ADVAPI32.dll!ChangeServiceConfigW                                                             77E37001 5 Bytes  JMP 00510120 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ADVAPI32.dll!ChangeServiceConfig2A                                                            77E37101 5 Bytes  JMP 0051015C 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ADVAPI32.dll!ChangeServiceConfig2W                                                            77E37189 5 Bytes  JMP 00510198 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ADVAPI32.dll!CreateServiceA                                                                   77E37211 5 Bytes  JMP 00510030 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ADVAPI32.dll!CreateServiceW                                                                   77E373A9 5 Bytes  JMP 0051006C 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2320] ADVAPI32.dll!DeleteService                                                                    77E374B1 5 Bytes  JMP 005100A8 
.text           C:\Program Files\Ahead\InCD\InCD.exe[2324] ntdll.dll!LdrLoadDll                                                                                           7C91632D 5 Bytes  JMP 000A0030 
.text           C:\Program Files\Ahead\InCD\InCD.exe[2324] ntdll.dll!LdrUnloadDll                                                                                         7C9171CD 5 Bytes  JMP 000A006C 
.text           C:\Program Files\Ahead\InCD\InCD.exe[2324] ADVAPI32.dll!SetServiceObjectSecurity                                                                          77E36D81 5 Bytes  JMP 002D01D4 
.text           C:\Program Files\Ahead\InCD\InCD.exe[2324] ADVAPI32.dll!ChangeServiceConfigA                                                                              77E36E69 5 Bytes  JMP 002D00E4 
.text           C:\Program Files\Ahead\InCD\InCD.exe[2324] ADVAPI32.dll!ChangeServiceConfigW                                                                              77E37001 5 Bytes  JMP 002D0120 
.text           C:\Program Files\Ahead\InCD\InCD.exe[2324] ADVAPI32.dll!ChangeServiceConfig2A                                                                             77E37101 5 Bytes  JMP 002D015C 
.text           C:\Program Files\Ahead\InCD\InCD.exe[2324] ADVAPI32.dll!ChangeServiceConfig2W                                                                             77E37189 5 Bytes  JMP 002D0198 
.text           C:\Program Files\Ahead\InCD\InCD.exe[2324] ADVAPI32.dll!CreateServiceA                                                                                    77E37211 5 Bytes  JMP 002D0030 
.text           C:\Program Files\Ahead\InCD\InCD.exe[2324] ADVAPI32.dll!CreateServiceW                                                                                    77E373A9 5 Bytes  JMP 002D006C 
.text           C:\Program Files\Ahead\InCD\InCD.exe[2324] ADVAPI32.dll!DeleteService                                                                                     77E374B1 5 Bytes  JMP 002D00A8 
.text           C:\Program Files\Ahead\InCD\InCD.exe[2324] USER32.dll!SetWindowsHookExW                                                                                   7E42820F 5 Bytes  JMP 002E00E4 
.text           C:\Program Files\Ahead\InCD\InCD.exe[2324] USER32.dll!UnhookWindowsHookEx                                                                                 7E42D5F3 5 Bytes  JMP 002E0120 
.text           C:\Program Files\Ahead\InCD\InCD.exe[2324] USER32.dll!SetWindowsHookExA                                                                                   7E431211 5 Bytes  JMP 002E00A8 
.text           C:\Program Files\Ahead\InCD\InCD.exe[2324] USER32.dll!SetWinEventHook                                                                                     7E4317F7 5 Bytes  JMP 002E0030 
.text           C:\Program Files\Ahead\InCD\InCD.exe[2324] USER32.dll!UnhookWinEvent                                                                                      7E4318AC 5 Bytes  JMP 002E006C 
.text           C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe[2464] ntdll.dll!LdrLoadDll                                                                      7C91632D 5 Bytes  JMP 00160030 
.text           C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe[2464] ntdll.dll!LdrUnloadDll                                                                    7C9171CD 5 Bytes  JMP 0016006C 
.text           C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe[2464] ADVAPI32.dll!SetServiceObjectSecurity                                                     77E36D81 5 Bytes  JMP 003901D4 
.text           C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe[2464] ADVAPI32.dll!ChangeServiceConfigA                                                         77E36E69 5 Bytes  JMP 003900E4 
.text           C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe[2464] ADVAPI32.dll!ChangeServiceConfigW                                                         77E37001 5 Bytes  JMP 00390120 
.text           C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe[2464] ADVAPI32.dll!ChangeServiceConfig2A                                                        77E37101 5 Bytes  JMP 0039015C 
.text           C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe[2464] ADVAPI32.dll!ChangeServiceConfig2W                                                        77E37189 5 Bytes  JMP 00390198 
.text           C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe[2464] ADVAPI32.dll!CreateServiceA                                                               77E37211 5 Bytes  JMP 00390030 
.text           C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe[2464] ADVAPI32.dll!CreateServiceW                                                               77E373A9 5 Bytes  JMP 0039006C 
.text           C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe[2464] ADVAPI32.dll!DeleteService                                                                77E374B1 5 Bytes  JMP 003900A8 
.text           C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe[2464] USER32.dll!SetWindowsHookExW                                                              7E42820F 5 Bytes  JMP 003A00E4 
.text           C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe[2464] USER32.dll!UnhookWindowsHookEx                                                            7E42D5F3 5 Bytes  JMP 003A0120 
.text           C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe[2464] USER32.dll!SetWindowsHookExA                                                              7E431211 5 Bytes  JMP 003A00A8 
.text           C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe[2464] USER32.dll!SetWinEventHook                                                                7E4317F7 5 Bytes  JMP 003A0030 
.text           C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe[2464] USER32.dll!UnhookWinEvent                                                                 7E4318AC 5 Bytes  JMP 003A006C 
.text           C:\Program Files\HP\hpcoretech\hpcmpmgr.exe[2532] ntdll.dll!LdrLoadDll                                                                                    7C91632D 5 Bytes  JMP 00150030 
.text           C:\Program Files\HP\hpcoretech\hpcmpmgr.exe[2532] ntdll.dll!LdrUnloadDll                                                                                  7C9171CD 5 Bytes  JMP 0015006C 
.text           C:\Program Files\HP\hpcoretech\hpcmpmgr.exe[2532] USER32.dll!SetWindowsHookExW                                                                            7E42820F 5 Bytes  JMP 003800E4 
.text           C:\Program Files\HP\hpcoretech\hpcmpmgr.exe[2532] USER32.dll!UnhookWindowsHookEx                                                                          7E42D5F3 5 Bytes  JMP 00380120 
.text           C:\Program Files\HP\hpcoretech\hpcmpmgr.exe[2532] USER32.dll!SetWindowsHookExA                                                                            7E431211 5 Bytes  JMP 003800A8 
.text           C:\Program Files\HP\hpcoretech\hpcmpmgr.exe[2532] USER32.dll!SetWinEventHook                                                                              7E4317F7 5 Bytes  JMP 00380030 
.text           C:\Program Files\HP\hpcoretech\hpcmpmgr.exe[2532] USER32.dll!UnhookWinEvent                                                                               7E4318AC 5 Bytes  JMP 0038006C 
.text           C:\Program Files\HP\hpcoretech\hpcmpmgr.exe[2532] ADVAPI32.dll!SetServiceObjectSecurity                                                                   77E36D81 5 Bytes  JMP 003901D4 
.text           C:\Program Files\HP\hpcoretech\hpcmpmgr.exe[2532] ADVAPI32.dll!ChangeServiceConfigA                                                                       77E36E69 5 Bytes  JMP 003900E4 
.text           C:\Program Files\HP\hpcoretech\hpcmpmgr.exe[2532] ADVAPI32.dll!ChangeServiceConfigW                                                                       77E37001 5 Bytes  JMP 00390120 
.text           C:\Program Files\HP\hpcoretech\hpcmpmgr.exe[2532] ADVAPI32.dll!ChangeServiceConfig2A                                                                      77E37101 5 Bytes  JMP 0039015C 
.text           C:\Program Files\HP\hpcoretech\hpcmpmgr.exe[2532] ADVAPI32.dll!ChangeServiceConfig2W                                                                      77E37189 5 Bytes  JMP 00390198 
.text           C:\Program Files\HP\hpcoretech\hpcmpmgr.exe[2532] ADVAPI32.dll!CreateServiceA                                                                             77E37211 5 Bytes  JMP 00390030 
.text           C:\Program Files\HP\hpcoretech\hpcmpmgr.exe[2532] ADVAPI32.dll!CreateServiceW                                                                             77E373A9 5 Bytes  JMP 0039006C 
.text           C:\Program Files\HP\hpcoretech\hpcmpmgr.exe[2532] ADVAPI32.dll!DeleteService                                                                              77E374B1 5 Bytes  JMP 003900A8 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtCreateFile + 6                                                                    7C90D0B4 4 Bytes  [28, 00, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtCreateFile + B                                                                    7C90D0B9 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtMapViewOfSection + 6                                                              7C90D524 1 Byte  [28]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtMapViewOfSection + 6                                                              7C90D524 4 Bytes  [28, 03, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtMapViewOfSection + B                                                              7C90D529 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtOpenFile + 6                                                                      7C90D5A4 4 Bytes  [68, 00, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtOpenFile + B                                                                      7C90D5A9 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtOpenProcess + 6                                                                   7C90D604 4 Bytes  [A8, 01, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtOpenProcess + B                                                                   7C90D609 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtOpenProcessToken + 6                                                              7C90D614 4 Bytes  CALL 7B90ED1A 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtOpenProcessToken + B                                                              7C90D619 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtOpenProcessTokenEx + 6                                                            7C90D624 4 Bytes  [A8, 02, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtOpenProcessTokenEx + B                                                            7C90D629 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtOpenThread + 6                                                                    7C90D664 4 Bytes  [68, 01, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtOpenThread + B                                                                    7C90D669 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtOpenThreadToken + 6                                                               7C90D674 4 Bytes  [68, 02, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtOpenThreadToken + B                                                               7C90D679 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtOpenThreadTokenEx + 6                                                             7C90D684 4 Bytes  CALL 7B90ED8B 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtOpenThreadTokenEx + B                                                             7C90D689 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtQueryAttributesFile + 6                                                           7C90D714 4 Bytes  [A8, 00, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtQueryAttributesFile + B                                                           7C90D719 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtQueryFullAttributesFile + 6                                                       7C90D7B4 4 Bytes  CALL 7B90EEB9 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtQueryFullAttributesFile + B                                                       7C90D7B9 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtSetInformationFile + 6                                                            7C90DC64 4 Bytes  [28, 01, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtSetInformationFile + B                                                            7C90DC69 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtSetInformationThread + 6                                                          7C90DCB4 4 Bytes  [28, 02, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtSetInformationThread + B                                                          7C90DCB9 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtUnmapViewOfSection + 6                                                            7C90DF14 1 Byte  [68]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtUnmapViewOfSection + 6                                                            7C90DF14 4 Bytes  [68, 03, 17, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!NtUnmapViewOfSection + B                                                            7C90DF19 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!LdrLoadDll                                                                          7C91632D 5 Bytes  JMP 00180030 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ntdll.dll!LdrUnloadDll                                                                        7C9171CD 5 Bytes  JMP 0018006C 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] USER32.dll!SetWindowsHookExW                                                                  7E42820F 5 Bytes  JMP 005000E4 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] USER32.dll!UnhookWindowsHookEx                                                                7E42D5F3 5 Bytes  JMP 00500120 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] USER32.dll!SetWindowsHookExA                                                                  7E431211 5 Bytes  JMP 005000A8 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] USER32.dll!SetWinEventHook                                                                    7E4317F7 5 Bytes  JMP 00500030 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] USER32.dll!UnhookWinEvent                                                                     7E4318AC 5 Bytes  JMP 0050006C 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ADVAPI32.dll!SetServiceObjectSecurity                                                         77E36D81 5 Bytes  JMP 005101D4 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ADVAPI32.dll!ChangeServiceConfigA                                                             77E36E69 5 Bytes  JMP 005100E4 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ADVAPI32.dll!ChangeServiceConfigW                                                             77E37001 5 Bytes  JMP 00510120 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ADVAPI32.dll!ChangeServiceConfig2A                                                            77E37101 5 Bytes  JMP 0051015C 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ADVAPI32.dll!ChangeServiceConfig2W                                                            77E37189 5 Bytes  JMP 00510198 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ADVAPI32.dll!CreateServiceA                                                                   77E37211 5 Bytes  JMP 00510030 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ADVAPI32.dll!CreateServiceW                                                                   77E373A9 5 Bytes  JMP 0051006C 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2548] ADVAPI32.dll!DeleteService                                                                    77E374B1 5 Bytes  JMP 005100A8 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2592] ntdll.dll!LdrLoadDll                                                      7C91632D 5 Bytes  JMP 00160030 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2592] ntdll.dll!LdrUnloadDll                                                    7C9171CD 5 Bytes  JMP 0016006C 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2592] ADVAPI32.dll!SetServiceObjectSecurity                                     77E36D81 5 Bytes  JMP 003A01D4 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2592] ADVAPI32.dll!ChangeServiceConfigA                                         77E36E69 5 Bytes  JMP 003A00E4 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2592] ADVAPI32.dll!ChangeServiceConfigW                                         77E37001 5 Bytes  JMP 003A0120 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2592] ADVAPI32.dll!ChangeServiceConfig2A                                        77E37101 5 Bytes  JMP 003A015C 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2592] ADVAPI32.dll!ChangeServiceConfig2W                                        77E37189 5 Bytes  JMP 003A0198 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2592] ADVAPI32.dll!CreateServiceA                                               77E37211 5 Bytes  JMP 003A0030 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2592] ADVAPI32.dll!CreateServiceW                                               77E373A9 5 Bytes  JMP 003A006C 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2592] ADVAPI32.dll!DeleteService                                                77E374B1 5 Bytes  JMP 003A00A8 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2592] USER32.dll!SetWindowsHookExW                                              7E42820F 5 Bytes  JMP 003B00E4 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2592] USER32.dll!UnhookWindowsHookEx                                            7E42D5F3 5 Bytes  JMP 003B0120 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2592] USER32.dll!SetWindowsHookExA                                              7E431211 5 Bytes  JMP 003B00A8 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2592] USER32.dll!SetWinEventHook                                                7E4317F7 5 Bytes  JMP 003B0030 
.text           C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2592] USER32.dll!UnhookWinEvent                                                 7E4318AC 5 Bytes  JMP 003B006C 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!LdrLoadDll                                                                          7C91632D 5 Bytes  JMP 00160030 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!LdrUnloadDll                                                                        7C9171CD 5 Bytes  JMP 0016006C 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2764] USER32.dll!SetWindowsHookExW                                                                  7E42820F 5 Bytes  JMP 003900E4 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2764] USER32.dll!UnhookWindowsHookEx                                                                7E42D5F3 5 Bytes  JMP 00390120 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2764] USER32.dll!SetWindowsHookExA                                                                  7E431211 5 Bytes  JMP 003900A8 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2764] USER32.dll!SetWinEventHook                                                                    7E4317F7 5 Bytes  JMP 00390030 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2764] USER32.dll!UnhookWinEvent                                                                     7E4318AC 5 Bytes  JMP 0039006C 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2764] ADVAPI32.dll!SetServiceObjectSecurity                                                         77E36D81 5 Bytes  JMP 003A01D4 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2764] ADVAPI32.dll!ChangeServiceConfigA                                                             77E36E69 5 Bytes  JMP 003A00E4 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2764] ADVAPI32.dll!ChangeServiceConfigW                                                             77E37001 5 Bytes  JMP 003A0120 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2764] ADVAPI32.dll!ChangeServiceConfig2A                                                            77E37101 5 Bytes  JMP 003A015C 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2764] ADVAPI32.dll!ChangeServiceConfig2W                                                            77E37189 5 Bytes  JMP 003A0198 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2764] ADVAPI32.dll!CreateServiceA                                                                   77E37211 5 Bytes  JMP 003A0030 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2764] ADVAPI32.dll!CreateServiceW                                                                   77E373A9 5 Bytes  JMP 003A006C 
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2764] ADVAPI32.dll!DeleteService                                                                    77E374B1 5 Bytes  JMP 003A00A8 
.text           C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe[2792] ntdll.dll!LdrLoadDll                                                              7C91632D 5 Bytes  JMP 00160030 
.text           C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe[2792] ntdll.dll!LdrUnloadDll                                                            7C9171CD 5 Bytes  JMP 0016006C 
.text           C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe[2792] USER32.dll!SetWindowsHookExW                                                      7E42820F 5 Bytes  JMP 003900E4 
.text           C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe[2792] USER32.dll!UnhookWindowsHookEx                                                    7E42D5F3 5 Bytes  JMP 00390120 
.text           C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe[2792] USER32.dll!SetWindowsHookExA                                                      7E431211 5 Bytes  JMP 003900A8 
.text           C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe[2792] USER32.dll!SetWinEventHook                                                        7E4317F7 5 Bytes  JMP 00390030 
.text           C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe[2792] USER32.dll!UnhookWinEvent                                                         7E4318AC 5 Bytes  JMP 0039006C 
.text           C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe[2792] ADVAPI32.dll!SetServiceObjectSecurity                                             77E36D81 5 Bytes  JMP 003A01D4 
.text           C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe[2792] ADVAPI32.dll!ChangeServiceConfigA                                                 77E36E69 5 Bytes  JMP 003A00E4 
.text           C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe[2792] ADVAPI32.dll!ChangeServiceConfigW                                                 77E37001 5 Bytes  JMP 003A0120 
.text           C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe[2792] ADVAPI32.dll!ChangeServiceConfig2A                                                77E37101 5 Bytes  JMP 003A015C 
.text           C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe[2792] ADVAPI32.dll!ChangeServiceConfig2W                                                77E37189 5 Bytes  JMP 003A0198 
.text           C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe[2792] ADVAPI32.dll!CreateServiceA                                                       77E37211 5 Bytes  JMP 003A0030 
.text           C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe[2792] ADVAPI32.dll!CreateServiceW                                                       77E373A9 5 Bytes  JMP 003A006C 
.text           C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe[2792] ADVAPI32.dll!DeleteService                                                        77E374B1 5 Bytes  JMP 003A00A8 
.text           C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!LdrLoadDll                                                        7C91632D 5 Bytes  JMP 00160030 
.text           C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ntdll.dll!LdrUnloadDll                                                      7C9171CD 5 Bytes  JMP 0016006C 
.text           C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ADVAPI32.dll!SetServiceObjectSecurity                                       77E36D81 5 Bytes  JMP 003901D4 
.text           C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ADVAPI32.dll!ChangeServiceConfigA                                           77E36E69 5 Bytes  JMP 003900E4 
.text           C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ADVAPI32.dll!ChangeServiceConfigW                                           77E37001 5 Bytes  JMP 00390120 
.text           C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ADVAPI32.dll!ChangeServiceConfig2A                                          77E37101 5 Bytes  JMP 0039015C 
.text           C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ADVAPI32.dll!ChangeServiceConfig2W                                          77E37189 5 Bytes  JMP 00390198 
.text           C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ADVAPI32.dll!CreateServiceA                                                 77E37211 5 Bytes  JMP 00390030 
.text           C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ADVAPI32.dll!CreateServiceW                                                 77E373A9 5 Bytes  JMP 0039006C 
.text           C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] ADVAPI32.dll!DeleteService                                                  77E374B1 5 Bytes  JMP 003900A8 
.text           C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] USER32.dll!SetWindowsHookExW                                                7E42820F 5 Bytes  JMP 00EB00E4 
.text           C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] USER32.dll!UnhookWindowsHookEx                                              7E42D5F3 5 Bytes  JMP 00EB0120 
.text           C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] USER32.dll!SetWindowsHookExA                                                7E431211 5 Bytes  JMP 00EB00A8 
.text           C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] USER32.dll!SetWinEventHook                                                  7E4317F7 5 Bytes  JMP 00EB0030 
.text           C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2852] USER32.dll!UnhookWinEvent                                                   7E4318AC 5 Bytes  JMP 00EB006C 
.text           C:\Program Files\Messenger\msmsgs.exe[2884] ntdll.dll!LdrLoadDll                                                                                          7C91632D 5 Bytes  JMP 000A0030 
.text           C:\Program Files\Messenger\msmsgs.exe[2884] ntdll.dll!LdrUnloadDll                                                                                        7C9171CD 5 Bytes  JMP 000A006C 
.text           C:\Program Files\Messenger\msmsgs.exe[2884] ADVAPI32.dll!SetServiceObjectSecurity                                                                         77E36D81 5 Bytes  JMP 002D01D4 
.text           C:\Program Files\Messenger\msmsgs.exe[2884] ADVAPI32.dll!ChangeServiceConfigA                                                                             77E36E69 5 Bytes  JMP 002D00E4 
.text           C:\Program Files\Messenger\msmsgs.exe[2884] ADVAPI32.dll!ChangeServiceConfigW                                                                             77E37001 5 Bytes  JMP 002D0120 
.text           C:\Program Files\Messenger\msmsgs.exe[2884] ADVAPI32.dll!ChangeServiceConfig2A                                                                            77E37101 5 Bytes  JMP 002D015C 
.text           C:\Program Files\Messenger\msmsgs.exe[2884] ADVAPI32.dll!ChangeServiceConfig2W                                                                            77E37189 5 Bytes  JMP 002D0198 
.text           C:\Program Files\Messenger\msmsgs.exe[2884] ADVAPI32.dll!CreateServiceA                                                                                   77E37211 5 Bytes  JMP 002D0030 
.text           C:\Program Files\Messenger\msmsgs.exe[2884] ADVAPI32.dll!CreateServiceW                                                                                   77E373A9 5 Bytes  JMP 002D006C 
.text           C:\Program Files\Messenger\msmsgs.exe[2884] ADVAPI32.dll!DeleteService                                                                                    77E374B1 5 Bytes  JMP 002D00A8 
.text           C:\Program Files\Messenger\msmsgs.exe[2884] USER32.dll!SetWindowsHookExW                                                                                  7E42820F 5 Bytes  JMP 002E00E4 
.text           C:\Program Files\Messenger\msmsgs.exe[2884] USER32.dll!UnhookWindowsHookEx                                                                                7E42D5F3 5 Bytes  JMP 002E0120 
.text           C:\Program Files\Messenger\msmsgs.exe[2884] USER32.dll!SetWindowsHookExA                                                                                  7E431211 5 Bytes  JMP 002E00A8 
.text           C:\Program Files\Messenger\msmsgs.exe[2884] USER32.dll!SetWinEventHook                                                                                    7E4317F7 5 Bytes  JMP 002E0030 
.text           C:\Program Files\Messenger\msmsgs.exe[2884] USER32.dll!UnhookWinEvent                                                                                     7E4318AC 5 Bytes  JMP 002E006C 
.text           C:\WINDOWS\System32\alg.exe[3084] ntdll.dll!LdrLoadDll                                                                                                    7C91632D 5 Bytes  JMP 00090030 
.text           C:\WINDOWS\System32\alg.exe[3084] ntdll.dll!LdrUnloadDll                                                                                                  7C9171CD 5 Bytes  JMP 0009006C 
.text           C:\WINDOWS\System32\alg.exe[3084] USER32.dll!SetWindowsHookExW                                                                                            7E42820F 5 Bytes  JMP 002B00E4 
.text           C:\WINDOWS\System32\alg.exe[3084] USER32.dll!UnhookWindowsHookEx                                                                                          7E42D5F3 5 Bytes  JMP 002B0120 
.text           C:\WINDOWS\System32\alg.exe[3084] USER32.dll!SetWindowsHookExA                                                                                            7E431211 5 Bytes  JMP 002B00A8 
.text           C:\WINDOWS\System32\alg.exe[3084] USER32.dll!SetWinEventHook                                                                                              7E4317F7 5 Bytes  JMP 002B0030 
.text           C:\WINDOWS\System32\alg.exe[3084] USER32.dll!UnhookWinEvent                                                                                               7E4318AC 5 Bytes  JMP 002B006C 
.text           C:\WINDOWS\System32\alg.exe[3084] ADVAPI32.dll!SetServiceObjectSecurity                                                                                   77E36D81 5 Bytes  JMP 002C01D4 
.text           C:\WINDOWS\System32\alg.exe[3084] ADVAPI32.dll!ChangeServiceConfigA                                                                                       77E36E69 5 Bytes  JMP 002C00E4 
.text           C:\WINDOWS\System32\alg.exe[3084] ADVAPI32.dll!ChangeServiceConfigW                                                                                       77E37001 5 Bytes  JMP 002C0120 
.text           C:\WINDOWS\System32\alg.exe[3084] ADVAPI32.dll!ChangeServiceConfig2A                                                                                      77E37101 5 Bytes  JMP 002C015C 
.text           C:\WINDOWS\System32\alg.exe[3084] ADVAPI32.dll!ChangeServiceConfig2W                                                                                      77E37189 5 Bytes  JMP 002C0198 
.text           C:\WINDOWS\System32\alg.exe[3084] ADVAPI32.dll!CreateServiceA                                                                                             77E37211 5 Bytes  JMP 002C0030 
.text           C:\WINDOWS\System32\alg.exe[3084] ADVAPI32.dll!CreateServiceW                                                                                             77E373A9 5 Bytes  JMP 002C006C 
.text           C:\WINDOWS\System32\alg.exe[3084] ADVAPI32.dll!DeleteService                                                                                              77E374B1 5 Bytes  JMP 002C00A8 
.text           C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3252] ntdll.dll!LdrLoadDll                                                              7C91632D 5 Bytes  JMP 00160030 
.text           C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3252] ntdll.dll!LdrUnloadDll                                                            7C9171CD 5 Bytes  JMP 0016006C 
.text           C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3252] ADVAPI32.dll!SetServiceObjectSecurity                                             77E36D81 5 Bytes  JMP 003901D4 
.text           C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3252] ADVAPI32.dll!ChangeServiceConfigA                                                 77E36E69 5 Bytes  JMP 003900E4 
.text           C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3252] ADVAPI32.dll!ChangeServiceConfigW                                                 77E37001 5 Bytes  JMP 00390120 
.text           C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3252] ADVAPI32.dll!ChangeServiceConfig2A                                                77E37101 5 Bytes  JMP 0039015C 
.text           C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3252] ADVAPI32.dll!ChangeServiceConfig2W                                                77E37189 5 Bytes  JMP 00390198 
.text           C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3252] ADVAPI32.dll!CreateServiceA                                                       77E37211 5 Bytes  JMP 00390030 
.text           C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3252] ADVAPI32.dll!CreateServiceW                                                       77E373A9 5 Bytes  JMP 0039006C 
.text           C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3252] ADVAPI32.dll!DeleteService                                                        77E374B1 5 Bytes  JMP 003900A8 
.text           C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3252] USER32.dll!SetWindowsHookExW                                                      7E42820F 5 Bytes  JMP 003A00E4 
.text           C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3252] USER32.dll!UnhookWindowsHookEx                                                    7E42D5F3 5 Bytes  JMP 003A0120 
.text           C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3252] USER32.dll!SetWindowsHookExA                                                      7E431211 5 Bytes  JMP 003A00A8 
.text           C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3252] USER32.dll!SetWinEventHook                                                        7E4317F7 5 Bytes  JMP 003A0030 
.text           C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[3252] USER32.dll!UnhookWinEvent                                                         7E4318AC 5 Bytes  JMP 003A006C 
.text           C:\WINDOWS\system32\Ati2evxx.exe[3292] ntdll.dll!LdrLoadDll                                                                                               7C91632D 5 Bytes  JMP 00140030 
.text           C:\WINDOWS\system32\Ati2evxx.exe[3292] ntdll.dll!LdrUnloadDll                                                                                             7C9171CD 5 Bytes  JMP 0014006C 
.text           C:\WINDOWS\system32\Ati2evxx.exe[3292] USER32.dll!SetWindowsHookExW                                                                                       7E42820F 5 Bytes  JMP 003800E4 
.text           C:\WINDOWS\system32\Ati2evxx.exe[3292] USER32.dll!UnhookWindowsHookEx                                                                                     7E42D5F3 5 Bytes  JMP 00380120 
.text           C:\WINDOWS\system32\Ati2evxx.exe[3292] USER32.dll!SetWindowsHookExA                                                                                       7E431211 5 Bytes  JMP 003800A8 
.text           C:\WINDOWS\system32\Ati2evxx.exe[3292] USER32.dll!SetWinEventHook                                                                                         7E4317F7 5 Bytes  JMP 00380030 
.text           C:\WINDOWS\system32\Ati2evxx.exe[3292] USER32.dll!UnhookWinEvent                                                                                          7E4318AC 5 Bytes  JMP 0038006C 
.text           C:\WINDOWS\system32\Ati2evxx.exe[3292] ADVAPI32.dll!SetServiceObjectSecurity                                                                              77E36D81 5 Bytes  JMP 003901D4 
.text           C:\WINDOWS\system32\Ati2evxx.exe[3292] ADVAPI32.dll!ChangeServiceConfigA                                                                                  77E36E69 5 Bytes  JMP 003900E4 
.text           C:\WINDOWS\system32\Ati2evxx.exe[3292] ADVAPI32.dll!ChangeServiceConfigW                                                                                  77E37001 5 Bytes  JMP 00390120 
.text           C:\WINDOWS\system32\Ati2evxx.exe[3292] ADVAPI32.dll!ChangeServiceConfig2A                                                                                 77E37101 5 Bytes  JMP 0039015C 
.text           C:\WINDOWS\system32\Ati2evxx.exe[3292] ADVAPI32.dll!ChangeServiceConfig2W                                                                                 77E37189 5 Bytes  JMP 00390198 
.text           C:\WINDOWS\system32\Ati2evxx.exe[3292] ADVAPI32.dll!CreateServiceA                                                                                        77E37211 5 Bytes  JMP 00390030 
.text           C:\WINDOWS\system32\Ati2evxx.exe[3292] ADVAPI32.dll!CreateServiceW                                                                                        77E373A9 5 Bytes  JMP 0039006C 
.text           C:\WINDOWS\system32\Ati2evxx.exe[3292] ADVAPI32.dll!DeleteService                                                                                         77E374B1 5 Bytes  JMP 003900A8 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[3432] ntdll.dll!LdrLoadDll                                                                7C91632D 5 Bytes  JMP 00090030 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[3432] ntdll.dll!LdrUnloadDll                                                              7C9171CD 5 Bytes  JMP 0009006C 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[3432] USER32.dll!SetWindowsHookExW                                                        7E42820F 5 Bytes  JMP 002D00E4 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[3432] USER32.dll!UnhookWindowsHookEx                                                      7E42D5F3 5 Bytes  JMP 002D0120 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[3432] USER32.dll!SetWindowsHookExA                                                        7E431211 5 Bytes  JMP 002D00A8 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[3432] USER32.dll!SetWinEventHook                                                          7E4317F7 5 Bytes  JMP 002D0030 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[3432] USER32.dll!UnhookWinEvent                                                           7E4318AC 5 Bytes  JMP 002D006C 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[3432] ADVAPI32.dll!SetServiceObjectSecurity                                               77E36D81 5 Bytes  JMP 002E01D4 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[3432] ADVAPI32.dll!ChangeServiceConfigA                                                   77E36E69 5 Bytes  JMP 002E00E4 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[3432] ADVAPI32.dll!ChangeServiceConfigW                                                   77E37001 5 Bytes  JMP 002E0120 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[3432] ADVAPI32.dll!ChangeServiceConfig2A                                                  77E37101 5 Bytes  JMP 002E015C 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[3432] ADVAPI32.dll!ChangeServiceConfig2W                                                  77E37189 5 Bytes  JMP 002E0198 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[3432] ADVAPI32.dll!CreateServiceA                                                         77E37211 5 Bytes  JMP 002E0030 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[3432] ADVAPI32.dll!CreateServiceW                                                         77E373A9 5 Bytes  JMP 002E006C 
.text           C:\Program Files\Norton AntiVirus\Engine\16.8.0.41\ccSvcHst.exe[3432] ADVAPI32.dll!DeleteService                                                          77E374B1 5 Bytes  JMP 002E00A8 
.text           C:\Documents and Settings\David\Desktop\gmer.exe[3572] ntdll.dll!LdrLoadDll                                                                               7C91632D 5 Bytes  JMP 00160030 
.text           C:\Documents and Settings\David\Desktop\gmer.exe[3572] ntdll.dll!LdrUnloadDll                                                                             7C9171CD 5 Bytes  JMP 0016006C 
.text           C:\WINDOWS\system32\ctfmon.exe[3648] ntdll.dll!LdrLoadDll                                                                                                 7C91632D 5 Bytes  JMP 000A0030 
.text           C:\WINDOWS\system32\ctfmon.exe[3648] ntdll.dll!LdrUnloadDll                                                                                               7C9171CD 5 Bytes  JMP 000A006C 
.text           C:\WINDOWS\system32\ctfmon.exe[3648] ADVAPI32.dll!SetServiceObjectSecurity                                                                                77E36D81 5 Bytes  JMP 002C01D4 
.text           C:\WINDOWS\system32\ctfmon.exe[3648] ADVAPI32.dll!ChangeServiceConfigA                                                                                    77E36E69 5 Bytes  JMP 002C00E4 
.text           C:\WINDOWS\system32\ctfmon.exe[3648] ADVAPI32.dll!ChangeServiceConfigW                                                                                    77E37001 5 Bytes  JMP 002C0120 
.text           C:\WINDOWS\system32\ctfmon.exe[3648] ADVAPI32.dll!ChangeServiceConfig2A                                                                                   77E37101 5 Bytes  JMP 002C015C 
.text           C:\WINDOWS\system32\ctfmon.exe[3648] ADVAPI32.dll!ChangeServiceConfig2W                                                                                   77E37189 5 Bytes  JMP 002C0198 
.text           C:\WINDOWS\system32\ctfmon.exe[3648] ADVAPI32.dll!CreateServiceA                                                                                          77E37211 5 Bytes  JMP 002C0030 
.text           C:\WINDOWS\system32\ctfmon.exe[3648] ADVAPI32.dll!CreateServiceW                                                                                          77E373A9 5 Bytes  JMP 002C006C 
.text           C:\WINDOWS\system32\ctfmon.exe[3648] ADVAPI32.dll!DeleteService                                                                                           77E374B1 5 Bytes  JMP 002C00A8 
.text           C:\WINDOWS\system32\ctfmon.exe[3648] USER32.dll!SetWindowsHookExW                                                                                         7E42820F 5 Bytes  JMP 002D00E4 
.text           C:\WINDOWS\system32\ctfmon.exe[3648] USER32.dll!UnhookWindowsHookEx                                                                                       7E42D5F3 5 Bytes  JMP 002D0120 
.text           C:\WINDOWS\system32\ctfmon.exe[3648] USER32.dll!SetWindowsHookExA                                                                                         7E431211 5 Bytes  JMP 002D00A8 
.text           C:\WINDOWS\system32\ctfmon.exe[3648] USER32.dll!SetWinEventHook                                                                                           7E4317F7 5 Bytes  JMP 002D0030 
.text           C:\WINDOWS\system32\ctfmon.exe[3648] USER32.dll!UnhookWinEvent                                                                                            7E4318AC 5 Bytes  JMP 002D006C 
.text           C:\Program Files\Java\jre6\bin\jucheck.exe[3760] ntdll.dll!LdrLoadDll                                                                                     7C91632D 5 Bytes  JMP 00160030 
.text           C:\Program Files\Java\jre6\bin\jucheck.exe[3760] ntdll.dll!LdrUnloadDll                                                                                   7C9171CD 5 Bytes  JMP 0016006C 
.text           C:\Program Files\Java\jre6\bin\jucheck.exe[3760] ADVAPI32.dll!SetServiceObjectSecurity                                                                    77E36D81 5 Bytes  JMP 003A01D4 
.text           C:\Program Files\Java\jre6\bin\jucheck.exe[3760] ADVAPI32.dll!ChangeServiceConfigA                                                                        77E36E69 5 Bytes  JMP 003A00E4 
.text           C:\Program Files\Java\jre6\bin\jucheck.exe[3760] ADVAPI32.dll!ChangeServiceConfigW                                                                        77E37001 5 Bytes  JMP 003A0120 
.text           C:\Program Files\Java\jre6\bin\jucheck.exe[3760] ADVAPI32.dll!ChangeServiceConfig2A                                                                       77E37101 5 Bytes  JMP 003A015C 
.text           C:\Program Files\Java\jre6\bin\jucheck.exe[3760] ADVAPI32.dll!ChangeServiceConfig2W                                                                       77E37189 5 Bytes  JMP 003A0198 
.text           C:\Program Files\Java\jre6\bin\jucheck.exe[3760] ADVAPI32.dll!CreateServiceA                                                                              77E37211 5 Bytes  JMP 003A0030 
.text           C:\Program Files\Java\jre6\bin\jucheck.exe[3760] ADVAPI32.dll!CreateServiceW                                                                              77E373A9 5 Bytes  JMP 003A006C 
.text           C:\Program Files\Java\jre6\bin\jucheck.exe[3760] ADVAPI32.dll!DeleteService                                                                               77E374B1 5 Bytes  JMP 003A00A8 
.text           C:\Program Files\Java\jre6\bin\jucheck.exe[3760] USER32.dll!SetWindowsHookExW                                                                             7E42820F 5 Bytes  JMP 003B00E4 
.text           C:\Program Files\Java\jre6\bin\jucheck.exe[3760] USER32.dll!UnhookWindowsHookEx                                                                           7E42D5F3 5 Bytes  JMP 003B0120 
.text           C:\Program Files\Java\jre6\bin\jucheck.exe[3760] USER32.dll!SetWindowsHookExA                                                                             7E431211 5 Bytes  JMP 003B00A8 
.text           C:\Program Files\Java\jre6\bin\jucheck.exe[3760] USER32.dll!SetWinEventHook                                                                               7E4317F7 5 Bytes  JMP 003B0030 
.text           C:\Program Files\Java\jre6\bin\jucheck.exe[3760] USER32.dll!UnhookWinEvent                                                                                7E4318AC 5 Bytes  JMP 003B006C 
.text           C:\WINDOWS\Explorer.EXE[3812] ntdll.dll!LdrLoadDll                                                                                                        7C91632D 5 Bytes  JMP 00090030 
.text           C:\WINDOWS\Explorer.EXE[3812] ntdll.dll!LdrUnloadDll                                                                                                      7C9171CD 5 Bytes  JMP 0009006C 
.text           C:\WINDOWS\Explorer.EXE[3812] ADVAPI32.dll!SetServiceObjectSecurity                                                                                       77E36D81 5 Bytes  JMP 002C01D4 
.text           C:\WINDOWS\Explorer.EXE[3812] ADVAPI32.dll!ChangeServiceConfigA                                                                                           77E36E69 5 Bytes  JMP 002C00E4 
.text           C:\WINDOWS\Explorer.EXE[3812] ADVAPI32.dll!ChangeServiceConfigW                                                                                           77E37001 5 Bytes  JMP 002C0120 
.text           C:\WINDOWS\Explorer.EXE[3812] ADVAPI32.dll!ChangeServiceConfig2A                                                                                          77E37101 5 Bytes  JMP 002C015C 
.text           C:\WINDOWS\Explorer.EXE[3812] ADVAPI32.dll!ChangeServiceConfig2W                                                                                          77E37189 5 Bytes  JMP 002C0198 
.text           C:\WINDOWS\Explorer.EXE[3812] ADVAPI32.dll!CreateServiceA                                                                                                 77E37211 5 Bytes  JMP 002C0030 
.text           C:\WINDOWS\Explorer.EXE[3812] ADVAPI32.dll!CreateServiceW                                                                                                 77E373A9 5 Bytes  JMP 002C006C 
.text           C:\WINDOWS\Explorer.EXE[3812] ADVAPI32.dll!DeleteService                                                                                                  77E374B1 5 Bytes  JMP 002C00A8 
.text           C:\WINDOWS\Explorer.EXE[3812] USER32.dll!SetWindowsHookExW                                                                                                7E42820F 5 Bytes  JMP 002D00E4 
.text           C:\WINDOWS\Explorer.EXE[3812] USER32.dll!UnhookWindowsHookEx                                                                                              7E42D5F3 5 Bytes  JMP 002D0120 
.text           C:\WINDOWS\Explorer.EXE[3812] USER32.dll!SetWindowsHookExA                                                                                                7E431211 5 Bytes  JMP 002D00A8 
.text           C:\WINDOWS\Explorer.EXE[3812] USER32.dll!SetWinEventHook                                                                                                  7E4317F7 5 Bytes  JMP 002D0030 
.text           C:\WINDOWS\Explorer.EXE[3812] USER32.dll!UnhookWinEvent                                                                                                   7E4318AC 5 Bytes  JMP 002D006C 

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\WINDOWS\system32\services.exe[1004] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW]                                             005E0002
IAT             C:\WINDOWS\system32\services.exe[1004] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW]                                                   005E0000
IAT             C:\Program Files\Google\Chrome\Application\chrome.exe[2320] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW]                              002E0010
IAT             C:\Program Files\Google\Chrome\Application\chrome.exe[2548] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW]                              002E0010

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                                                                    aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software)
AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                                                                  SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                                                                  aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                                                 aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                                                 SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                                                                 aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                                                                 SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                                                               SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                                                               aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls@C:\Program Files\LucasArts\LEGO\xae Indiana Jones\x2122 2\Audio\Audio.CFG                       1
Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls@C:\Program Files\LucasArts\LEGO\xae Indiana Jones\x2122 2\Audio\_CutScenes\AkatorHub_Intro.ogg  1
Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls@C:\Program Files\LucasArts\LEGO\xae Indiana Jones\x2122 2\Audio\_Music\1_0_HUB_1Nepal_Qui.ogg   1
Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls@C:\Program Files\LucasArts\LEGO\xae Indiana Jones\x2122 2\Movies\PC\attract.bik                 1

---- EOF - GMER 1.0.15 ----
