GMER 1.0.14.14536 - http://www.gmer.net Rootkit scan 2009-03-02 12:22:45 Windows 5.1.2600 Service Pack 3 ---- System - GMER 1.0.14 ---- Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xEDC7B9AA] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateKey [0xEDC7BA41] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xEDC7B958] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xEDC7B96C] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xEDC7BA55] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xEDC7BA81] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateKey [0xEDC7BAEF] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateValueKey [0xEDC7BAD9] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xEDC7B9EA] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0xEDC7BB1B] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xEDC7BA2D] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xEDC7B930] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xEDC7B944] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xEDC7B9BE] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryKey [0xEDC7BB57] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0xEDC7BAC3] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryValueKey [0xEDC7BAAD] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xEDC7BA6B] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0xEDC7BB43] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0xEDC7BB2F] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0xEDC7B996] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xEDC7B982] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetValueKey [0xEDC7BA97] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xEDC7BA19] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnloadKey [0xEDC7BB05] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xEDC7BA00] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xEDC7B9D4] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess ---- Kernel code sections - GMER 1.0.14 ---- .text ntoskrnl.exe!ZwYieldExecution 804F0EA6 7 Bytes JMP EDC7B9D8 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwOpenKey 80568D59 5 Bytes JMP EDC7BA31 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwQueryValueKey 8056A1F2 7 Bytes JMP EDC7BAB1 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!NtCreateFile 8056CDC0 5 Bytes JMP EDC7B9AE \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!NtSetInformationProcess 8056DC01 5 Bytes JMP EDC7B986 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwCreateKey 8057065D 5 Bytes JMP EDC7BA45 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwQueryKey 80570A6D 7 Bytes JMP EDC7BB5B \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwEnumerateKey 80570D64 7 Bytes JMP EDC7BAF3 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!NtOpenProcess 805717C7 5 Bytes JMP EDC7B934 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwProtectVirtualMemory 80571CB1 7 Bytes JMP EDC7B9C2 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwSetValueKey 80572889 7 Bytes JMP EDC7BA9B \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwUnmapViewOfSection 805736E6 5 Bytes JMP EDC7BA04 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!NtMapViewOfSection 80573B61 7 Bytes JMP EDC7B9EE \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwCreateProcessEx 8057FC6C 7 Bytes JMP EDC7B970 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwTerminateProcess 805822EC 5 Bytes JMP EDC7BA1D \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!NtOpenThread 8058A1C9 5 Bytes JMP EDC7B948 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwNotifyChangeKey 8058A699 5 Bytes JMP EDC7BB1F \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwEnumerateValueKey 80590677 7 Bytes JMP EDC7BADD \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwDeleteValueKey 80592D5C 7 Bytes JMP EDC7BA85 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwDeleteKey 805952CA 7 Bytes JMP EDC7BA59 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwCreateProcess 805B136A 5 Bytes JMP EDC7B95C \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwSetContextThread 8062DCF7 5 Bytes JMP EDC7B99A \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwUnloadKey 8064DA12 7 Bytes JMP EDC7BB09 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwQueryMultipleValueKey 8064E338 7 Bytes JMP EDC7BAC7 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwRenameKey 8064E7B6 7 Bytes JMP EDC7BA6F \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwRestoreKey 8064ECA9 5 Bytes JMP EDC7BB33 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) PAGE ntoskrnl.exe!ZwReplaceKey 8064F112 5 Bytes JMP EDC7BB47 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ---- User code sections - GMER 1.0.14 ---- .text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[636] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0041C340 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.) .text c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe[636] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 0041C3C0 c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (McAfee Proxy Service Module/McAfee, Inc.) .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00070FEF .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 0007008C .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 0007007B .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0007005E .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00070FA1 .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00070FCD .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 000700A7 .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00070F5F .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00070F29 .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00070F3A .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 000700DD .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00070FB2 .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00070FDE .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00070F7C .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 0007002F .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00070014 .text C:\WINDOWS\system32\services.exe[828] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 000700B8 .text C:\WINDOWS\system32\services.exe[828] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00060F9E .text C:\WINDOWS\system32\services.exe[828] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00060F57 .text C:\WINDOWS\system32\services.exe[828] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00060FC3 .text C:\WINDOWS\system32\services.exe[828] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00060FDE .text C:\WINDOWS\system32\services.exe[828] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00060014 .text C:\WINDOWS\system32\services.exe[828] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00060FEF .text C:\WINDOWS\system32\services.exe[828] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 00060F72 .text C:\WINDOWS\system32\services.exe[828] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ 26, 88 ] .text C:\WINDOWS\system32\services.exe[828] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00060F8D .text C:\WINDOWS\system32\services.exe[828] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00040000 .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C10FEF .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C10076 .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C1005B .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C10F8D .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C10040 .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C10FA8 .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C10F55 .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C1009D .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C100D3 .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C10F3A .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 00C10F1F .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00C1002F .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00C10FDE .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00C10F66 .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00C10FB9 .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00C10014 .text C:\WINDOWS\system32\lsass.exe[840] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 00C100B8 .text C:\WINDOWS\system32\lsass.exe[840] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00C0001B .text C:\WINDOWS\system32\lsass.exe[840] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00C00F80 .text C:\WINDOWS\system32\lsass.exe[840] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00C00FC0 .text C:\WINDOWS\system32\lsass.exe[840] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00C00FE5 .text C:\WINDOWS\system32\lsass.exe[840] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00C00047 .text C:\WINDOWS\system32\lsass.exe[840] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00C00000 .text C:\WINDOWS\system32\lsass.exe[840] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 00C00FA5 .text C:\WINDOWS\system32\lsass.exe[840] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ E0, 88 ] .text C:\WINDOWS\system32\lsass.exe[840] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00C0002C .text C:\WINDOWS\system32\lsass.exe[840] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BA0FEF .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00E30000 .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00E30080 .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00E30F81 .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00E30F92 .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00E30FAF .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00E30047 .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00E300AE .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00E30091 .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00E30F4B .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00E300E4 .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 00E30F30 .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00E30FC0 .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00E30FEF .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00E30F70 .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00E30036 .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00E3001B .text C:\WINDOWS\system32\svchost.exe[1004] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 00E300C9 .text C:\WINDOWS\system32\svchost.exe[1004] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00E20014 .text C:\WINDOWS\system32\svchost.exe[1004] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00E20F57 .text C:\WINDOWS\system32\svchost.exe[1004] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00E20FB9 .text C:\WINDOWS\system32\svchost.exe[1004] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00E20FD4 .text C:\WINDOWS\system32\svchost.exe[1004] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00E20F68 .text C:\WINDOWS\system32\svchost.exe[1004] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00E20FEF .text C:\WINDOWS\system32\svchost.exe[1004] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 00E20F8D .text C:\WINDOWS\system32\svchost.exe[1004] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ 02, 89 ] .text C:\WINDOWS\system32\svchost.exe[1004] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00E20F9E .text C:\WINDOWS\system32\svchost.exe[1004] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00E00FEF .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C90000 .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C90F7C .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C90F8D .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C90067 .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C9004A .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C90F9E .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C90F46 .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C9008E .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C90F10 .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C90F2B .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 00C90EEB .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00C9002F .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00C90FE5 .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00C90F61 .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00C90FC3 .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00C90FD4 .text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 00C900A9 .text C:\WINDOWS\system32\svchost.exe[1072] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00C8001B .text C:\WINDOWS\system32\svchost.exe[1072] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00C80F94 .text C:\WINDOWS\system32\svchost.exe[1072] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00C80FCA .text C:\WINDOWS\system32\svchost.exe[1072] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00C80FE5 .text C:\WINDOWS\system32\svchost.exe[1072] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00C80051 .text C:\WINDOWS\system32\svchost.exe[1072] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00C80000 .text C:\WINDOWS\system32\svchost.exe[1072] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 00C80FAF .text C:\WINDOWS\system32\svchost.exe[1072] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes CALL C89FEDB5 .text C:\WINDOWS\system32\svchost.exe[1072] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00C8002C .text C:\WINDOWS\system32\svchost.exe[1072] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00C60000 .text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 029F0000 .text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 029F0073 .text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 029F0062 .text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 029F0F88 .text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 029F0051 .text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 029F002C .text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 029F009A .text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 029F0F52 .text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 029F00D0 .text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 029F0F2D .text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 029F0F1C .text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 029F0FA5 .text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 029F0011 .text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 029F0F63 .text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 029F0FC0 .text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 029F0FE5 .text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 029F00AB .text C:\WINDOWS\System32\svchost.exe[1160] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 02960022 .text C:\WINDOWS\System32\svchost.exe[1160] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 02960044 .text C:\WINDOWS\System32\svchost.exe[1160] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 02960011 .text C:\WINDOWS\System32\svchost.exe[1160] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 02960FE5 .text C:\WINDOWS\System32\svchost.exe[1160] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 02960F87 .text C:\WINDOWS\System32\svchost.exe[1160] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 02960000 .text C:\WINDOWS\System32\svchost.exe[1160] ADVAPI32.dll!RegCreateKeyW 77DFBA25 5 Bytes JMP 02960033 .text C:\WINDOWS\System32\svchost.exe[1160] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 02960FB6 .text C:\WINDOWS\System32\svchost.exe[1160] WS2_32.dll!socket 71AB4211 5 Bytes JMP 02940FEF .text C:\WINDOWS\System32\svchost.exe[1160] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 02970FEF .text C:\WINDOWS\System32\svchost.exe[1160] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 0297000A .text C:\WINDOWS\System32\svchost.exe[1160] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 02970025 .text C:\WINDOWS\System32\svchost.exe[1160] WININET.dll!InternetOpenUrlW 780BAEB9 3 Bytes JMP 02970FCA .text C:\WINDOWS\System32\svchost.exe[1160] WININET.dll!InternetOpenUrlW + 4 780BAEBD 1 Byte [ 8A ] .text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 007B000A .text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 007B0F7E .text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 007B007D .text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 007B006C .text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 007B0051 .text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 007B0FB9 .text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 007B0F46 .text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 007B0F57 .text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 007B00C1 .text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 007B00B0 .text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 007B0F0D .text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 007B0040 .text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 007B001B .text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 007B008E .text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 007B0FD4 .text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 007B0FE5 .text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 007B009F .text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 007A0FB2 .text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 007A0F5A .text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 007A0FC3 .text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 007A0FDE .text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 007A0F6B .text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 007A0FEF .text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 007A0F86 .text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ 9A, 88 ] .text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 007A0F97 .text C:\WINDOWS\system32\svchost.exe[1212] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00780000 .text C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00C20000 .text C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00C20FAA .text C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00C20FC5 .text C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C2009F .text C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00C20084 .text C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00C20058 .text C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00C200E6 .text C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00C200CB .text C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C20112 .text C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00C20101 .text C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 00C2012D .text C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00C20073 .text C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00C2001B .text C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00C200BA .text C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00C2003D .text C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00C2002C .text C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 00C20F83 .text C:\WINDOWS\system32\svchost.exe[1268] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 009B0FA8 .text C:\WINDOWS\system32\svchost.exe[1268] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 009B0032 .text C:\WINDOWS\system32\svchost.exe[1268] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 009B0FB9 .text C:\WINDOWS\system32\svchost.exe[1268] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 009B0FD4 .text C:\WINDOWS\system32\svchost.exe[1268] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 009B0F6B .text C:\WINDOWS\system32\svchost.exe[1268] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 009B0FEF .text C:\WINDOWS\system32\svchost.exe[1268] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 009B0F7C .text C:\WINDOWS\system32\svchost.exe[1268] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ BB, 88 ] .text C:\WINDOWS\system32\svchost.exe[1268] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 009B0F8D .text C:\WINDOWS\system32\svchost.exe[1268] WS2_32.dll!socket 71AB4211 5 Bytes JMP 0099000A .text C:\WINDOWS\system32\svchost.exe[1268] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 009C0000 .text C:\WINDOWS\system32\svchost.exe[1268] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 009C0FE5 .text C:\WINDOWS\system32\svchost.exe[1268] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 009C0FCA .text C:\WINDOWS\system32\svchost.exe[1268] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 009C0FB9 .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00B80000 .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00B80F4D .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00B80F5E .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00B80F79 .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00B80F8A .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00B80FAF .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00B80F1C .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00B8006E .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00B8009A .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00B80089 .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 00B800B5 .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00B8002C .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00B80FE5 .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00B8005D .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00B8001B .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00B80FCA .text C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 00B80F0B .text C:\WINDOWS\system32\svchost.exe[1624] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00B70FCA .text C:\WINDOWS\system32\svchost.exe[1624] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00B70F79 .text C:\WINDOWS\system32\svchost.exe[1624] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00B7001B .text C:\WINDOWS\system32\svchost.exe[1624] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00B70FE5 .text C:\WINDOWS\system32\svchost.exe[1624] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00B70F94 .text C:\WINDOWS\system32\svchost.exe[1624] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00B70000 .text C:\WINDOWS\system32\svchost.exe[1624] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 00B70FAF .text C:\WINDOWS\system32\svchost.exe[1624] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ D7, 88 ] .text C:\WINDOWS\system32\svchost.exe[1624] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00B70036 .text C:\WINDOWS\Explorer.EXE[1696] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 01740000 .text C:\WINDOWS\Explorer.EXE[1696] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 01740F58 .text C:\WINDOWS\Explorer.EXE[1696] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 01740F69 .text C:\WINDOWS\Explorer.EXE[1696] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 01740F7A .text C:\WINDOWS\Explorer.EXE[1696] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 01740F97 .text C:\WINDOWS\Explorer.EXE[1696] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 0174002F .text C:\WINDOWS\Explorer.EXE[1696] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 01740085 .text C:\WINDOWS\Explorer.EXE[1696] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 01740068 .text C:\WINDOWS\Explorer.EXE[1696] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 017400BB .text C:\WINDOWS\Explorer.EXE[1696] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 01740F22 .text C:\WINDOWS\Explorer.EXE[1696] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 017400CC .text C:\WINDOWS\Explorer.EXE[1696] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 01740FA8 .text C:\WINDOWS\Explorer.EXE[1696] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 01740FE5 .text C:\WINDOWS\Explorer.EXE[1696] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 01740F3D .text C:\WINDOWS\Explorer.EXE[1696] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 01740FC3 .text C:\WINDOWS\Explorer.EXE[1696] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 01740FD4 .text C:\WINDOWS\Explorer.EXE[1696] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 017400A0 .text C:\WINDOWS\Explorer.EXE[1696] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00FE0040 .text C:\WINDOWS\Explorer.EXE[1696] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00FE0F97 .text C:\WINDOWS\Explorer.EXE[1696] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00FE001B .text C:\WINDOWS\Explorer.EXE[1696] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00FE0FE5 .text C:\WINDOWS\Explorer.EXE[1696] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00FE0FA8 .text C:\WINDOWS\Explorer.EXE[1696] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00FE0000 .text C:\WINDOWS\Explorer.EXE[1696] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 00FE0FB9 .text C:\WINDOWS\Explorer.EXE[1696] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ 1E, 89 ] .text C:\WINDOWS\Explorer.EXE[1696] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00FE0FCA .text C:\WINDOWS\Explorer.EXE[1696] WININET.dll!InternetOpenA 7806C865 5 Bytes JMP 00FF0FEF .text C:\WINDOWS\Explorer.EXE[1696] WININET.dll!InternetOpenW 7806CE99 5 Bytes JMP 00FF0FCA .text C:\WINDOWS\Explorer.EXE[1696] WININET.dll!InternetOpenUrlA 78070BCA 5 Bytes JMP 00FF000A .text C:\WINDOWS\Explorer.EXE[1696] WININET.dll!InternetOpenUrlW 780BAEB9 5 Bytes JMP 00FF001B .text C:\WINDOWS\Explorer.EXE[1696] WS2_32.dll!socket 71AB4211 5 Bytes JMP 02260000 .text C:\WINDOWS\System32\svchost.exe[2372] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 001A0000 .text C:\WINDOWS\System32\svchost.exe[2372] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 001A0078 .text C:\WINDOWS\System32\svchost.exe[2372] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 001A0F83 .text C:\WINDOWS\System32\svchost.exe[2372] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 001A0067 .text C:\WINDOWS\System32\svchost.exe[2372] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 001A0FA8 .text C:\WINDOWS\System32\svchost.exe[2372] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 001A004A .text C:\WINDOWS\System32\svchost.exe[2372] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 001A0F52 .text C:\WINDOWS\System32\svchost.exe[2372] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 001A009A .text C:\WINDOWS\System32\svchost.exe[2372] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 001A0F41 .text C:\WINDOWS\System32\svchost.exe[2372] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 001A00DA .text C:\WINDOWS\System32\svchost.exe[2372] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 001A0F30 .text C:\WINDOWS\System32\svchost.exe[2372] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 001A0FB9 .text C:\WINDOWS\System32\svchost.exe[2372] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 001A0FEF .text C:\WINDOWS\System32\svchost.exe[2372] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 001A0089 .text C:\WINDOWS\System32\svchost.exe[2372] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 001A0FDE .text C:\WINDOWS\System32\svchost.exe[2372] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 001A0025 .text C:\WINDOWS\System32\svchost.exe[2372] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 001A00BF .text C:\WINDOWS\System32\svchost.exe[2372] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00290040 .text C:\WINDOWS\System32\svchost.exe[2372] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00290080 .text C:\WINDOWS\System32\svchost.exe[2372] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00290FE5 .text C:\WINDOWS\System32\svchost.exe[2372] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 0029001B .text C:\WINDOWS\System32\svchost.exe[2372] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00290FB9 .text C:\WINDOWS\System32\svchost.exe[2372] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00290000 .text C:\WINDOWS\System32\svchost.exe[2372] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 00290FCA .text C:\WINDOWS\System32\svchost.exe[2372] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ 49, 88 ] .text C:\WINDOWS\System32\svchost.exe[2372] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00290051 .text C:\WINDOWS\System32\svchost.exe[2372] WS2_32.dll!socket 71AB4211 5 Bytes JMP 009B0FEF ---- Devices - GMER 1.0.14 ---- AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ---- Registry - GMER 1.0.14 ---- Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL@Installed 1 Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI@NoChange 1 Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI@Installed 1 Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS@Installed 1 ---- EOF - GMER 1.0.14 ----